In what seemed like a plot from a science fiction horror movie, thousands of Filipinos discovered over the weekend that not only had their Facebook accounts been cloned, but some of the duplicates were messaging the real owners with death threats. “How are you? Are you ready to die?” read one message. “Anyway you’re useless to society. Just wait for us in [your hometown].” Many of the accounts targeted belonged to critics of the Rodrigo Duterte administration, while students and journalists who have voiced opposition to a controversial new anti-terrorism bill that critics say will stifle free speech were also among the victims. Philippine police investigate 23 for coronavirus ‘fake news’, cyber libel The state-run University of the Philippines was the first to issue an alert against the dummy accounts, asking its students, officials and alumni to check their accounts and file reports with Facebook. “Following protests [against the new anti-terrorism bill] on our campuses and threats to our students, there are now multiple reports of empty, duplicate and fake accounts bearing the names of students,” the university said. “We express our utmost alarm since these accounts are suspected to cause harm or spread false information.” Other universities, journalists and Facebook users soon reported having multiple accounts using their names. Most of the suspicious accounts were empty and had no profile photos, but some used photos of the original users. Facebook said it was investigating and urged people to report inauthentic accounts, while Justice Secretary Menardo Guevarra has said his department’s cybercrime office will coordinate with the National Bureau of Investigation and the police to investigate. “This gives me cause for worry,” Guevarra said. “We don’t need false information at a time when we’re dealing with a serious public health crisis .” However, the bureau has appeared to play down the matter, claiming that “in all probability” the cloned accounts were caused by a “glitch” because “it’s so difficult to create an account on Facebook”. WHO’S BEHIND IT? Few people have been convinced by the bureau’s explanation. Raymund Liboro, the national privacy commissioner, said the large number of reported impostor accounts was “not ordinary”, while the former solicitor general (and noted Duterte critic) Florin Hilbay said there was a clear pattern to the attacks. “Thousands of Facebook accounts have suddenly been created, targeting students, professors, journalists, critics. The objectives are obvious: to harass, create fear, and sow terror,” said Hilbay. Analysts said the cloning was no accident. “The sheer scale of it seems to indicate that it is organised and coordinated,” said one IT security expert. The expert, who asked not to be identified, said the duplicate accounts usually consisted of “a blank face profile, almost always nothing on the wall, with just a handful of friends”. Sometimes the spelling of the person’s name was slightly wrong and some victims had found they had many duplicates. Particularly sinister was that some of the cloned accounts shared personal information about the victim, such as their birthday or sexual orientation. In Philippines and Singapore, one man’s fake news is another man’s free speech The expert said that in a discussion on Reddit one commenter had offered 3,000 Philippine pesos (US$60) a day to anyone who would help duplicate Facebook accounts. At the same time, said the expert, there appeared “to be some amount of automation”. In one case, when a victim changed his name, all the duplicate accounts promptly changed their names as well. “I think this operation is meant to silence critics, cow them into fear and create a spiral of silence,” the expert said. He added: “The thing that surprises me is the brazenness and clumsiness of the operation.” Some analysts saw parallels to the 2016 election when the disgraced (and now defunct) data firm Cambridge Analytica boasted of helping to get Duterte elected. Jonathan Corpus Ong, associate professor of communication at the University of Massachusetts at Amherst, said that while many fake accounts had appeared in 2016 Facebook had clamped down on the problem since then. “For folks to have done this again suggests to me that there might be new tech at work,” said Ong, adding that his own mother’s account had been cloned. Ong who has written extensively about Philippine fake news, said the duplicates could have been created using information from a “data breach”. He said that based on a study he co-authored “hackers and data analytics firms have the capacity to execute this”. What puzzled him, though, was why they would do something so counterproductive. “It’s sophisticated tech with an unsophisticated outcome,” he said, noting that the fake accounts could easily be spotted and reported. Philippine troll armies set sights on US politics He said disinformation strategists usually wanted “to control the narrative”, and clone accounts weren’t a good way of doing this. This suggested there was a “new player” demonstrating its abilities, he said. “It might be a pitch for the next election, a strategist seeking a client [by showing off]: look at what I can do.” Despite Facebook’s vow to investigate, Ong criticised the social media giant. “While some of the employees are well meaning, others downplay this, and say ‘we’ve seen this before, just report it’.” “It’s like we’re children, they don’t acknowledge the emotional stress and harm of digital bullying and potential data exposure. That is exactly the attitude that got us to data breaches like Cambridge Analytica.” “Fake Accounts” and “Mark Zuckerberg” have been trending in the Philippines with 63,400 and 31,400 tweets respectively, according to Twitter. The hashtag #HandsOffOurStudents had some 30,000 tweets on Sunday. Additional reporting by Bloomberg and DPA