Facebook wants to combat fake news with ID checks – but the implications on privacy could be grave

The last time I recall someone demanding: “Show me your ID” was on the streets of Beirut during the final days of the civil war. Now, I get the same thing when I log into Facebook.

Facebook started rolling out a new tool in April. Under updated procedures, the social media website would request ID verification for people who wish to advertise or promote political posts or ads. The announcement received very little publicity, but it can be interpreted as Facebook’s latest attempt to curb Russia’s anticipated interference in EU elections and prepare to manage any meddling in the 2020 US presidential elections.

I only came across this development when one of my friends mentioned that he had been locked out of his Facebook account after responding to a political post. To be readmitted, he had to submit his mobile number and a photo of his face. When the moderators were still not satisfied, they asked him to submit ID.

Facebook has policies to investigate potential fake profiles and what they call “suspicious activities”. My concern is that the lines between those two areas are becoming ever more blurred in Facebook’s eyes, with implications for our privacy.

A social experiment

I wanted to test how quickly Facebook’s algorithm could sniff out a fake profile, so I opened one under an assumed Arabic name, set my location in the Middle East and started indiscriminately sharing secular political posts. I also accepted any friend requests, quickly building more than 500 “friends”. I had no identifiable photo of my face, and most of those who befriended me did not seem real either.

Three weeks into the experiment, the system picked up the scent, locked me out and demanded I confirm my telephone number and ID. Three weeks is a long time in a Facebook lifetime, enough to influence an election. Still, was it my political interests or my questionable friends that attracted Facebook’s attention? I am not sure.

I restarted my project with a new profile, this time to test if the algorithm had learned anything. It had. In less than 24 hours, the algorithm locked me out, ironically, while I was in the middle of a conversation with another user about dodging Facebook’s algorithm. Is the algorithm reading our messages? There’s nothing in Facebook’s fine print to suggest it does not.

The third time, I tried to evade the algorithm with a new browser, different IP address, email, phone number and a photo of my father. Still, the algorithm locked me out in under 30 minutes. I was impressed.

From what the algorithm now suspects is a serial fake profile-generating IP address, I tried to log in into my own personal profile. The system requested additional security checks. Once in, I went about investigating where the voluntary ID check took place and found it under “settings”.

The system asked me to confirm my home country and address, and it came back with: “verified”. I can only assume it ran an Electoral Roll check. Then I was asked to upload an identification document, so I uploaded my passport. It took less than one minute for an approval message to flash on the screen. Now I can “run ads related to politics or issues of national importance”. But what’s an ad? Does it have to be paid? Facebook doesn’t define it and, as my friend found, you don’t need to be an advertiser to be asked for ID when things turn political.

What’s on your mind?

Facebook’s ID checks are clearly designed to make it harder to generate the kind of troll armies for which Russia is famous. But we already know hackers have commandeered large stashes of IDs, not least from Facebook. And a determined, state-sponsored troll army would surely be able to impersonate hundreds of thousands of people and overcome basic identity checks.

\Anti-vax posts and fake cancer treatments are rife on social media, and potentially even more harmful. Will we be required to upload medical records or professional qualifications before we share advice on treatments?

Facebook says that when people upload ID documents, they’re encrypted and then deleted within 30 days. Let’s hope that’s true. One user from India who runs a page critical of religious authorities told me he had to do an ID check to protect his page from being closed. Now he is terrified that his life will be endangered if his details fall into the wrong hands. He communicated with me using text written on images to avoid his conversation being detected by the algorithm.

What will this new policy mean for people who prefer to remain anonymous online? Facebook requires us only to use our real names. In many regimes there are good reasons to prefer to remain anonymous when sharing perfectly valid political views, just as people escaping abusive relationships, or parents of adopted children may wish to use Facebook without being so easily traced.

Perhaps this is the cost we pay to stop social media becoming a battleground, fought over by shadowy forces bent on misleading us. But Facebook’s approach is also changing the fabric of the social debate – and it may yet have grave implications for our individual privacy.

Fadi Safieddine, Associate Professor in Management Information Systems, Queen Mary University of London.

This article first appeared on The Conversation.