Facebook’s ‘solution’ to political ads — your Social Security number — will bring more trouble

Following concerns that foreign actors influenced American voters using online platforms like Facebook, the social media giant has taken steps to prevent the same thing from happening again. And while Facebook’s efforts are well-intentioned, its solutions are just the latest in a series of unwise, excessively broad reforms.

In its most recent move, Facebook will now require those who create advertisements about candidates and certain policy issues on its platform to fulfill three steps: They must input the last four digits of their Social Security number, upload a photo copy of a form of government-issued ID, and input their mailing address so that Facebook can mail them a code.

{mosads}Authenticators of identity only work if they derive from confidential, nonpublic information – classically defined as something you know, something you have or something you are. None of the factors on which Facebook plans to rely meet this standard.

To begin, the Social Security number (SSN) is a horribly ineffective way by which to authenticate identity. SSNs are so deeply compromised and so widely available to the public (often through criminal settings) that they can no longer be considered confidential. Estimates vary, but somewhere between 60 and 80 percent of all American SSNs are available from public sources.

As a result, any enterprise that continues to use an SSN as an authenticator is engaging in borderline cybersecurity malpractice. Yet that’s precisely what Facebook proposes to do.

Facebook to end “trending” topics feature, will highlight “breaking news” instead https://t.co/WPIJZ0U4PV pic.twitter.com/vp4N4qePEx

— The Hill (@thehill) June 1, 2018

Layered on top of the SSN requirement is the request for a photo copy of a driver’s license. Here, the usefulness of an ID as a verification tool depends on the state in which the license was issued. Congress passed the REAL ID Act – a bill to make driver’s licenses into secure identification documents – over 13 years ago. Yet today, at least nine states are still not producing identification that meets the Act’s security standards – in fact, TSA plans to stop taking those licenses as valid identification in airports. If hard copy licenses aren’t good enough for airports, photos of licenses surely aren’t good enough for authentication efforts that seek to thwart bad actors attempting to undermine American democracy.

And, of course, there is the requirement to have a mailing address in the United States. Which is no requirement at all. You don’t need to apply for one, there is no screening in place to prevent certain people from acquiring one, and any ill-minded Russian could have a dozen at his or her fingertips tomorrow.

Facebook’s latest security measure also approaches the issue in an overly-broad manner by imposing requirements not just on political pages, but on the pages of news outlets. Some have already taken issue with this strategy. In a letter to Facebook, a trade group representing many high-profile publishers like The New York Times and The Wall Street Journal wrote, “Newsgathering and reporting about politics is not the same thing as advocacy or politics.”

This is true. But where and how is the line to be drawn? Expecting Facebook to perfect its differentiation of “news” and “not news” to the satisfaction of most – or even many – in an age in which every side shouts “fake news” at the other, and at every news outlet, is ridiculous.

Apple declines invitation to EU hearing on tax evasion https://t.co/Qr0q1xoGDI pic.twitter.com/Q0Cu9214tj

— The Hill (@thehill) June 1, 2018

This is just the latest in a series of changes Facebook has made to all pages rather than to a narrow few. The platform has already ended some features, such as the ability of users to edit the appearance of link previews on timelines, and has removed the benefits of secrecy from its “dark ads” – ads shown to certain groups of people but not to everyone. Whereas pages could once publish ads and show different audiences unique messages, Facebook will now enable users to see all ads that a page is running.

It is nearly impossible for Facebook to draw the line perfectly between bad actors and those who do not misuse its features. This is why the platform applies its changes to all pages – punishing the class for the bad actions of a few students.

Unfortunately, Congress – an institution whose members largely misunderstand how bad actors used Facebook during the election – is putting enormous pressure on the platform to perfect this futile art. This is the same Congress that demands Facebook implement sweeping restrictions while decrying any instance where the speech it favors is caught up in the wide net.

The task is Sisyphean, and the solutions are broad but lacking. Fortunately for Congress – and for Diamond and Silk – it will make everlasting fodder for televised congressional hearings.

Shoshana Weissmann is the digital media specialist and a policy analyst at the R Street Institute. Paul Rosenzweig is a senior fellow at R Street