
Facebook plans to use U.S. mail to verify IDs of election ad buyers - anigbrowl
https://www.reuters.com/article/us-usa-election-facebook/facebook-plans-to-use-u-s-mail-to-verify-ids-of-election-ad-buyers-idUSKCN1G10VD
======
eganist
I mean...... were foreign agents so obviously involved that they were buying
election ads on foreign cards/wires with foreign billing addresses?

This honestly seems like it solves literally nothing. I'd be shocked to hear
that foreign powers didn't already have e.g. diplomatic staff living in the US
who were buying ads and listing their home or non-consular work addresses...

Actually, is there any indication that listing a consular address is
prohibited? Because if not, then not only does this _seem_ to not solve
anything, it would in fact fail _with certainty_ to solve anything at all,
except maybe give the USPS some extra much-needed revenue.

Seriously, what am I missing here?

~~~
ggg9990
What you’re missing is that Facebook doesn’t really want to solve this problem
— dollars from Russians are still green. They just want the news story to go
away.

~~~
adventured
They generated $20 billion in operating income last year. They have $41
billion in cash.

There's zero chance they're interested in the $2 million ad buy from Russian
propaganda agents.

~~~
ggg9990
It’s not these ads in particular — it’s that culturally, Facebook believes
that it should be able to sell whatever the hell ads it wants to whomever it
pleases, and when someone questions that, Facebook’s instinctual response is
“shut up please.”

------
justboxing
This is D.O.A, because most of the Russians indicted were charged with
identity theft. They stole US Ids / SSNs and made all their ad buys using US
IDs.

Source: Russia’s troll identities were more sophisticated than anyone thought
=> [https://www.theverge.com/2018/2/16/17021684/facebook-
twitter...](https://www.theverge.com/2018/2/16/17021684/facebook-twitter-
mueller-russia-troll-factory)

~~~
Larrikin
Stolen IDs can be bought anywhere in the world and used online. A stolen ID
linked to a PO Box means that someone went into a federal facility with stolen
information.

~~~
DrScump
There are private party "mailboxes" everywhere.

The UPS Store chain used to be called "Mailboxes, Etc."

------
duxup
Richard Pinedo pleaded guilty to selling information and identities to
foreigners who then used that to appear as someone(s) inside the US. I'm
guessing folks like him will be happy to offer some mail related services as
well. Although it would provide yet another link to possibly track someone
down, if only after the fact...

[https://arstechnica.com/tech-policy/2018/02/mueller-flips-
am...](https://arstechnica.com/tech-policy/2018/02/mueller-flips-american-who-
unwittingly-sold-bank-info-to-russian-trolls/)

------
throwaway1748
This is a good step, but more reforms are needed for political ads on
Facebook.

One of the most glaring problems is dynamic ad pricing. Ads from different
candidates can see wildly different prices based on how 'engaging' their ads
are. In my mind this gives a clear advantage to incendiary, sensational,
populist candidates. In some cases the difference in pricing between ads can
be as much as 10X, based on how 'engaging' each ad is.

That's fundamentally unfair for someone running a clean, policy-driven
campaign.

------
shard972
Why bother when you can still vote in American federal elections without being
required to show ID?

As an Australian i just find this refusal to do this as bonkers considering we
have a much lesser issue when it comes to election fraud.

~~~
dannyw
As an Australian who has never shown ID to vote in any local, state, or
federal election, where do you live?

"In Australia, where voting is compulsory for all adult citizens, no form of
ID is required to cast a ballot at an election; instead, voters are asked
three questions before being issued a ballot, so that they can be checked off
the electoral roll: (1) what is your full name; (2) where do you live; and (3)
have you [voted in this election]"

\- Wikipedia

~~~
shard972
> As an Australian who has never shown ID to vote in any local, state, or
> federal election, where do you live?

I showed my ID at a voting poll on the Central Coast NSW in the 2013 federal
election and in the previous state election of WA when i voted i was asked to
show a drivers license.

------
ppbutt
"Facebook to put out PR story to try to stay relevant"

------
natch
No envelope? Sort of invites cultivation of corruption in the USPS, unless the
codes are further protected by something like a scratch-off layer.

~~~
eganist
I'm getting a suspicious feeling that this product (I'm calling it a product
at this point rather than a mitigation as it seems like it's intended to
enhance election ad buys rather than actually mitigate a particular risk)
wasn't actually designed with Alex Stamos' team's involvement. Which somewhat
surprises me considering it's essentially acting as a second-factor for
authenticating your physical location.

Expanding on your point, the biggest risk I see with postcards rather than
_really plain security envelopes_ would be that savvy postal workers may
become acquainted with what even ambiguous or anonymous-sender postcards would
look like, enabling them to literally deny service (acting, again literally,
as a web service DoS) to particular street addresses making election ad buys
by suppressing delivery. With time-critical ad purchases just weeks or even
potentially <7 days before election day, this would seem like a legal
pandora's box, and even anonymizing postcards wouldn't sufficiently mitigate
the risk of an employee blackballing a postcard with an exposed PIN or
scratch-off on it that's heading e.g. to Koch HQ or MoveOn.org within weeks of
election day.

------
askafriend
It seems like they took a page out of Nextdoor.com's playbook. That's another
social network that verifies identity by postcard. I haven't really seen this
technique used elsewhere at scale.

~~~
acct1771
Besides Google Places/Maps/Business whatever listings, you mean?

~~~
askafriend
Didn't know they used postcard, that's interesting! I've never listed a place
on those platforms so I wouldn't know..

------
justonepost
It'll have to go to a residential / business address. I suspect that theses
addresses and contact information will be provided to the FEC for double
checking against internal DHS lists.

~~~
DrScump

      It'll have to go to a residential / business address
    
    

How about "1050 Kiely Blvd #666, Santa Clara CA 95055"?

That's actually a PO Box. (Replace 666 with a real number) Do you think
Facebook would care?

~~~
justonepost
There's a way to get a list of PO boxes, banks use them and so do other orgs.

~~~
DrScump
That's just a USPS example. Anybody can open up their own private mailbox
center. At worst, you have to live with some address standardization software
sticking a "Unit" in front of the number.

------
farseer
Does this apply to all countries or only the United States? Doesn't seem fair
if American orgs are allowed to purchase ads to influence foreign elections.

~~~
jonnydubowsky
What do you mean by "fair"?

~~~
farseer
Facebook, while registered in the United States is a truly global multi-
national with a majority of the users based outside the US. Users and
legislators from other countries would soon start demanding similar treatment
to protect their own democratic process from foreign intelligence. So yeah
fair treatment of all users is kind of expected if facebook hopes to legally
operate in all those countries.

~~~
rhizome
Surely this will be one thing Facebook will default to opt-in.

------
markholmes
Sometimes, the answer isn’t more technology, I guess.

------
datboitom
Lob.com (YC13) will service this?

------
adamnemecek
Who designs this shit? How is this preventing anything? Russian intelligence
agencies definitely can't crack this defense measure. /s

They should also require the buyer take a photo saluting the American flag
while eating a hamburger.

~~~
toomuchtodo
People who have never done this before. To be good at something, you must
first be bad at it. Although I'm smh considering Facebook resources.

"“If you run an ad mentioning a candidate, we are going to mail you a postcard
and you will have to use that code to prove you are in the United States,”
Harbath said at a weekend conference of the National Association of
Secretaries of State, where executives from Twitter Inc and Alphabet Inc’s
Google also spoke.

“It won’t solve everything,” Harbath said in a brief interview with Reuters
following her remarks.

But sending codes through old-fashioned mail was the most effective method the
tech company could come up with to prevent Russians and other bad actors from
purchasing ads while posing as someone else, Harbath said."

Less postcards, more unraveling shell corporations using their corporate
metadata. Authenticate political ad buyers using LexisNexis, IRS tax
IDs/political org registrations, perhaps going so far as to implement KYC [1]
controls and procedures. It's not going to scale, plan on hiring if this
matters. Otherwise, this is going to be defeated with a UPS store mailbox.

"KYC controls typically include the following:

* Collection and analysis of basic identity information such as Identity documents (referred to in US regulations and practice as a "Customer Identification Program" or CIP)

* Name matching against lists of known parties (such as "politically exposed person" or PEP)

* Determination of the customer's risk in terms of propensity to commit money laundering, terrorist finance, or identity theft

* Creation of an expectation of a customer's transactional behavior

* Monitoring of a customer's transactions against expected behavior and recorded profile as well as that of the customer's peers"

[1]
[https://en.wikipedia.org/wiki/Know_your_customer](https://en.wikipedia.org/wiki/Know_your_customer)

Source: I work in risk management for a financial services firm.

~~~
adamnemecek
Not running some ads (like political) is also an option.

~~~
toomuchtodo
Facebook is only going to turn money down as a last resort, either because the
PC backlash is too intense or it's regulated by the government. I assure you,
they're not at the point where they'll turn political ad money away.

