In a Washington Post opinion piece today, Patrick Ruffini discusses the Russian social media ads and how minute they appear compared to the advertising bought by campaigns themselves. However, one particular case caught my eye in the context of ADINT:

The most successful case appears to be an anti-Trump rally in New York City on Nov. 12, just five days after the election. More than 33,000 people expressed interest in an announcement of the event posted by Russian agents, and thousands ended up attending. The ad spending that we know of to promote the rally was piddling – $1.93 to serve the post to 188 people. Yet, touching a raw nerve, news of this event spread organically. And no one bothered to dig into the sockpuppet Facebook page behind the announcement.

In the realm of political rallies this may not be particularly large and just represents a lucky case in terms of a tiny budget resulting in 33,000 expressions of interest. However, from an ADINT perspective, that “expression of interest” can be a critical foothold for further tracking and surveillance.

False-Flag Operations for Finding ADINT Targets

One of the most difficult parts of successfully conducting ADINT surveillance can be getting a permanent and unique identifier for an individual. If an ADINT operator does not already know precisely who they want to target, then they can begin their operation by using ad-targeting to find the type of people they want to target – e.g., users of a certain app, visitors of a certain website, or perhaps, those expressing interest in a specific political action event.

However, making the jump from targeting a type of person to targeting specific individuals to say, track their location, requires getting a unique (and ideally permanent) advertising identifier for each person the first ad went to. This can be achieved in a variety of ways, but having people voluntarily click on your ads generally nets the best identifiers. In a mobile or web ad this would get you the mobile advertising ID or cookie. In Facebook, a user sharing or liking your ad for a group makes them immediately retargetable by Facebook.

Using these kinds of social media ads for ADINT makes the idea of false-flag operations a bit more unnerving. Rather than just sowing discord and trying to increase political division, this kind of advertising can also get lists of identifiers for conducting ADINT on. Getting thousands of people to turn out for a political rally to increase division is certainly advantageous in some circumstances, but so is being able to enumerate and track thousands of people that “like” the idea of such an event. It is probably also a lot easier to get people to click a button than show up to a rally.

The exact information you can acquire using ADINT after getting these identifiers varies: you can read more about the potential surveillance we discovered in the paper on Exploring ADINT.

In conclusion, social media ads for causes you oppose seems like a good way to acquire targeting identifiers for the rest of an ADINT operation to surveil those targets. Something to consider the next time you share or like a post: you are letting the often-obscure source of that post use ADINT on you if they want.

A final note: there is no evidence I am aware of, nor do I intend to imply, that any of the Russian-funded advertising being discussed was actually conducting ADINT operations.