Published online 23 April 2009 | Nature 458, 1089 (2009) | doi:10.1038/news.2009.398

News

Fake Facebook pages spin web of deceit

Stem-cell scientists are caught up in fictional friend network — but no-one knows why.

In September 2008, Forbes science editor Matthew Herper and former Washington Post reporter Rick Weiss appeared together on a panel at the World Stem Cell Summit in Madison, Wisconsin. In late February, Herper received an invitation to 'friend' Weiss on the Internet social-networking site Facebook. On the basis of their acquaintance, Herper accepted, noticing that a number of other people involved with stem cells were listed as friends on Weiss's profile. However, that profile — and many of those it was linked to — was a fake.

HerperMatthew Herper was the target of a 'Sybil' attack.

Weiss is one of more than 100 scientists, policy-makers and journalists, many linked to stem-cell research, whose identities have been purloined to create a convincing — but bogus — network of apparent friends on Facebook. The victims have no control over the profiles that carry their names, and the perpetrators — and their motive — remain unknown.

Security experts call the creation of a network of impostors a Sybil attack. "People use impostors to create the image that a certain idea is more accepted or under more fire than it really is," says John Wilbanks, vice-president of science at the non-profit corporation Creative Commons, which provides free intellectual-property licences for online content.

The second of those possibilities was a worry to Alta Charo, a bioethicist at the University of Wisconsin-Madison, when she discovered fake Facebook profiles in her name and in those of other Wisconsin researchers with connections to stem-cell work in February. The list included Carolyn 'Biddy' Martin, who attended the stem-cell summit in her role as university chancellor. Facebook removed the profiles after the university's legal counsel contacted the company. A Facebook official told attendees at the e-Crime Congress in London last month that the company removes thousands of profiles a week.

Charo has no real Facebook profile: the fake one contained information easily gleaned from web searches as well as some made-up but harmless material. Weiss did have a real profile under his own control, and updates to this were channelled to the doppelgänger, adding verisimilitude. The bogus site suggests that at least one of the true Weiss's friends was an impostor. What it lacks, according to someone who has seen both profiles, is the affiliation that links Weiss's real profile to the network of the think-tank the Center for American Progress, where Weiss worked before becoming the communications director and policy analyst at the White House Office of Science & Technology Policy. Such affiliations require e-mail confirmation, and none of the bogus profiles has any.

WeissRick Weiss's identity was faked on Facebook.2008 World Stem Cell Summit

Davide Balzarotti, a computer-security researcher at the communication systems research centre Eurecom in Sophia-Antipolis, France, estimates that it would take only a day or so for a programmer to create the stem-cell impostor network using a mixture of manual and automated processes to harvest data from elsewhere. Balzarotti and colleagues have created cloning software that replicates networks found on one site on a second — such as LinkedIn, XING and Facebook — in order to test the ease with which a Sybil attack could be automated1. Balzarotti's Eurecom colleague Engin Kirda sees nothing to suggest that the scientists were targeted for imposture because of their specific work, but says it is possible to imagine a researcher creating a false profile and a Sybil network around it in order to obtain sensitive information from a hoodwinked competitor.

There is little activity on the impostor network, but it is not moribund: two of the suspected impostor profiles disappeared from public view after Nature tried to make contact (we have also brought the situation to Facebook's attention). And the false Rick Weiss profile has had one comment on it from a 'John Birch' that didn't appear on the real profile. John Birch, who died in China in 1945, is the namesake of a right-wing political organization, the John Birch Society, which is headquartered in Appleton, Wisconsin. The society, like many on the American right, is against research that involves viable embryonic stem cells, says William Jasper, senior editor of the society's magazine, The New American. He had not heard of the impostor network, but noted that John Birch is a common name that could easily be real or fake.

ADVERTISEMENT

Although no harm seems to have been done, the experience of being cloned remains a disconcerting one. As Elaine Fuchs, a stem-cell researcher at Rockefeller University in New York, puts it: "I'm afraid to open it … I feel safer remaining completely oblivious to whatever is in there." Instead, she asked an official from her institution to deal with it. She writes, "I guess I'm not really interested in trying to come up with speculation about the mind(lessness) of the person who did". 

  • References

    1. Bilge, L. et al. 'All your contacts are belong to us: automated identity theft attacks on social networks.' WWW 2009 conf., Madrid, 20–24 April 2009)

Comments

If you find something abusive or inappropriate or which does not otherwise comply with our Terms or Community Guidelines, please select the relevant 'Report this comment' link.

Comments on this thread are vetted after posting.

  • #60658

    Consider the old rule that says, If if sounds too good to be true, it probably is.lewisi

Commenting is now closed.