Why is META’s “Q3 Adversarial Threat Report” for 2024 so opaque about the networks from India?

So, META just released its Adversarial Threat Report for Third Quarter(archived link). It has been a while since I looked at these reports closely, but they’ve acquired a very templated/standardised form.

Index page from Meta’s Q3 Adversarial Threat Report

There is something interesting about this one. Specifically, how the 2 networks that were identified as being from India, were represented differently from the others (identified as being from Iran, Lebanon and Moldova).

In this report, we’re sharing threat research into five covert influence operations we disrupted, including from India, Iran, Lebanon and Moldova (first reported on October 11, 2024). We detected and removed these campaigns before they were able to build authentic audiences on our apps. We’re also including an update on the most persistent Russian covert influence operation known as Doppelganger.

Information about the 2 networks are on pages 8 and 9 of the report). Based on the write-up, it is pretty hard to get a sense of kind of narratives these networks were pushing. This is in contrast to the levels of specificity about the other networks.

For the network from Moldova, it references the nature of the content:

It included criticism of President Sandu, pro-EU politicians, and close ties between Moldova and Romania. They also posted supportive commentary about pro-Russia parties in Moldova, including a small fraction referencing exiled oligarch Shor and his party” For Iran: One brand called for banning Israeli athletes from participating in the Paris Olympics, attracting the attention of French authorities. Two others appeared to have appropriated the branding of previously existing entities but with slight modifications. One of these brands also ran a website mimicking the Jerusalem Post where they published their content.

For Lebanon:

This network posted original content in Hebrew about news and geopolitical events in Israel with generic hashtags like #Israel, #Jerusalem, #Netanyahu, among others. It included posts about Israel’s dependence on US support, claims that Israeli people are leaving the country, claims of food shortages in Israel, and criticism of the Israeli government and its military strikes in the Middle East.

But the report is noticeably more subtle about the ones from India:

While this campaign created original content, it also amplified posts by official political accounts in an attempt to make them appear more popular than they were. The people behind this effort posted primarily in English and Hindi about news and current events in India, including elections and political parties, and India’s economic development.

The network posted primarily in English and Hindi about news and current events in India, including elections and local candidates from a regional party in India.

You could argue with me that this is quite subjective, and I won’t dismiss you entirely.

But the key difference isn’t about what has been said. Rather, it is about what hasn’t been said.

In the Appendix (page 18 onwards), the report provides additional details about the networks identified as being from Moldova, Iran, and Lebanon. See who is missing?

The section is titled ‘Threat Indicators’, and this is how the report describes it:

The following section details unique threat indicators that we assess to be associated with the malicious networks we disrupted and described in this report. To help the broader research community to study and protect people across different internet services, we’ve collated and organized these indicators according to the Online Operations Kill Chain framework, which we use to analyze many sorts of malicious online operations, identify the earliest opportunities to disrupt them, and share information across investigative teams. The kill chain describes the sequence of steps that threat actors go through to establish a presence across the internet, disguise their operations, engage with potential audiences, and respond to takedowns.

We’re sharing these threat indicators to enable further research by the open-source community into any related activity across the web (GitHub). This section includes the latest threat indicators and is not meant to provide a full cross-internet, historic view into these operations. It’s important to note that, in our assessment, the mere sharing of these operations’ links or engaging with them by online users would be insufficient to attribute accounts to a given campaign without corroborating evidence.

In case you’re wondering, these networks don’t even make it to the GitHub repo.

In addition to repeating the numbers about Facebook pages, accounts, Instagram accounts, the tables in these sections lists TikTok and Twitter accounts, Telegram channels, YouTube channels, Assets/Brands used, methods used to evade detection, get engagement, etc.

Perhaps, the 2 networks identified as being from India did not have any information that warranted being put into this format? But here’s the thing, the section about the first network references the use of Twitter and YouTube accounts, even comments on evasion techniques, so I am not convinced that this was the reason.

The report also doesn’t appear to give any reasons as to why these 2 networks are not included in the appendix at all. In a scenario where, say they just didn’t have this information, calling that out would have been warranted, and understandable, even. But, the descriptions provided on pages 8 and 9 do not say that. And, the nature of the descriptions suggests that they had some of this information, if not all.

So, the question is, why are the networks that were identified as being from India presented in this inscrutable manner?

Update 1

I went back and looked at the reports for Q1 (archive), and Q2 (archive), and as far as I can tell, no networks have been excluded from the appendix like this in either of these.

More reports are listed here (archive).

No. Of Networks listed in the Table Of Contents: 6 (4 Russia-based, 1 Vietnam-based, 1 US-based).

No. Of Networks listed in the Appendix: 6 (4 Russia-based, 1 Vietnam-based, 1 US-based)

No. Of Networks listed in the Table Of Contents: 6 (1 Bangladesh-based, 1 China-based, 1 Croatia-based, 1 Iran-based, 1 Israel-based, 1 Unknown origin).

No. Of Networks listed in the Appendix: 6 (1 Bangladesh-based, 1 China-based, 1 Croatia-based, 1 Iran-based, 1 Israel-based, 1 Unknown origin)