- Facebook claims a series of reports by an Indian news site, The Wire, were based on faked documents.
- The reports claimed that a member of the country's ruling party had the ability to takedown posts on Instagram.
For more than a week, Facebook has pushed back against a series of investigations from The Wire, a nonprofit newsroom in India, saying they're based entirely on faked documents and incorrect claims.
It didn't stop the stories from coming.
On Oct. 10, the publication, which is known in the country for its adversarial coverage of the ruling right-wing, Bharatiya Janata Party (BJP), claimed a member of the party, Amit Malviya, could effectively remove posts he didn't approve of from Meta's Instagram.
The Wire showed screenshots in the story of what it said were moderation actions taken within Facebook, which last year changed its corporate name to Meta.
Part of the story was about Malviya being included in Facebook's "cross check" program, revealed last year as part of disclosures made by whistleblower Frances Haugen. After The Wire story was published, Facebook took a stance it has never taken before about a negative news story: that the underlying documentation was faked. It then floated that The Wire was the victim of "a hoax."
Since then, The Wire has followed up its reporting with two additional stories, one based on what it said was an email from Facebook's top press representative Andy Stone, in which Stone appears to admit the authenticity of The Wire's first story. The other was an attempt by The Wire to back up its sourcing that included a recording of what it said was its source accessing Facebook's internal Workplace forum. Facebook decried both follow up stories as based on false information and even said a fake account of its Workplace product "was deliberately set up with Instagram's name and brand insignia in order to deceive people."
On Monday, the publication called Facebook's allegations "ludicrous" in a statement. On Tuesday, an expert The Wire used in a story denied publicly that he commented in any way to the publication. A representative of Facebook did not respond to a request for comment and an inquiry into whether it was considering legal action. The Wire also did not respond to a request for comment.
By Tuesday, The Wire announced that it had taken down the series of stories pending an internal review of the reporting.
For a complete timeline of what has transpired between The Wire and Facebook so far, read on:
Thursday, Oct. 6, The Wire published its first story about moderation actions at Instagram
The Wire's first story in this saga is relatively straightforward. It wrote about seemingly improper content moderation actions against a "satirical" Instagram account that frequently takes aim at the political right in India.
People behind the account, @cringearchivist, said several of its posts had been quickly removed after being flagged as containing nudity, which the posts did not show. They questioned the moderation actions, wondering "whether there was any actual oversight involved, or if an algorithm was taking spot decisions based on criteria that may not always be valid," The Wire wrote.
It said Facebook did not offer a comment on the story, only that an outside PR firm emailed to ask for a link to the specific posts the publication was asking about.
Monday, Oct. 10, The Wire publishes a follow up
In a follow up story, titled "If BJP's Amit Malviya Reports Your Post, Instagram Will Take it Down – No Questions Asked" The Wire cites "a well-placed source at Meta" in saying the posts of the satirical account was the target of Malviya, a politician leading an "infamous" part of India's government.
According to the reporting, he was afforded special privileges under Facebook's "Cross Check" program. While the existence of the program was previously made public by reporting in The Wall Street Journal and Haugen, the basis of The Wire's story, if true, meant new and far-reaching privileges were afforded to its members.
After the story came out and began to gain traction on Twitter in the U.K. and U.S., Facebook began to push back.
Stone tweeted in a reply to WSJ reporter Jeff Horowitz, who retweeted The Wire report, "X-check has nothing to do with the ability to report posts," Stone said. "The posts in question were surfaced for review by automated systems, not humans," he continued.
Stone also alleged that the underlying documentation appeared to be fabricated.
Tuesday, Oct. 11, The Wire responds to Facebook's pushback with a new story
It didn't take long for The Wire to double down. The day after its initial story, it said it had received an internal email written by Stone to some Meta staffers, in which he appeared to admit the story was real.
The Wire published a closeup screenshot it said it had received of the email, in which Stone, referencing a Scribd link, asked "how the hell" it "got leaked." The email further asked "Who is the reporter, not on our watchlist, and why didn't anyone of you bother to link me up?" adding the reporter of the story needed to be placed "on watchlist." It added a demand for an activity record of the document The Wire reported on "for the last one month" and other information related to the story.
Again, Stone and Facebook responded publicly saying the email was a fake and the story based on it, as well as the previous story were, too. Reporters covering Facebook, current and former employees, executives of other companies and various tech experts began to publicly question the legitimacy of The Wire's reports.
Guy Rosen, Facebook's chief information security officer, took to Twitter to explain the falsity of both reports, saying "these stories are fabrications." He pointed to the purpose of Cross Check as being to "prevent over-enforcement mistakes," not a tool offered to certain users in order for them to more effectively report posts they dislike. He said the URL shown in the initial report was "not in use" at Facebook, nor was Stone's email address shown in the follow up story.
"These accusations are outlandish and riddled with falsities," Rosen added. "Let's hope @thewire_in is the victim not the perpetrator of this hoax."
The Wire focused on the claim that Stone's @fb.com email was not in use. Founding Editor Siddharth Varadarajan retweeted claims by two people that the email address had indeed recently been used by Stone.
Wednesday, Oct. 12, Facebook writes its own post denouncing the stories
The following day, Facebook published a post on its corporate Newsroom page, reiterating earlier arguments from Stone and Rosen. It added that, "Our cross-check program does not grant enrolled accounts the power to automatically have content removed from our platform." The company also said it never identified any user report about the @cringearchivist account, that there is no existence of a reporter "watchlist" at the company, and that the emails shown in The Wire's second story "are fake." "There are no such emails," the company said.
"We accept scrutiny of our content decisions, but we fundamentally reject these false allegations based on what we believe to be fabricated evidence," the company added.
Varadarajan responded by saying his publication now had "additional corroborative material" and was preparing another story about Facebook for the following day "answering and debunking all of their obfuscation."
Friday, Oct. 14, Facebook asks where the new story is
After more than two days, The Wire's follow up story had failed to appear. Facebook's Stone again took to Twitter, saying "days ago" the story was expected and in the meantime, "The Wire still has not corrected its reporting" despite the company's repeated denials.
Saturday, Oct. 15, The Wire publishes the fourth story, saying it disproves all Facebook's arguments
In another follow-up, which The Wire described as a "point by point response" to everything Facebook had used to refute the earlier stories.
The Wire said the Workplace URL shown by its source documents is only accessible to "a limited set of people," including its source. It said it sent a "test email" to Stone's @fb.com address that did not bounce back and that a service offering read receipts of sent emails showed that it was active and in use.
The Wire also claimed to show the Stone emails it showed had "been technically verified" as real. The Wire included a video showing the process of verification it used. It showed emails from two "independent domain experts" backing up the claims. As for the claim that the URL shown in the original story did not exist, The Wire published another video. It said the video showed its source inside the company navigating Facebook's internal Workplace forum, where nearly all company communications and activity takes place.
The story does not appear to do what The Wire intended. Stone responded on Twitter saying, "as it's been clear from the outset @thewire_in's stories are based on fabrications." He added, "I never sent, wrote, or even thought what's expressed in that supposed email."
Many tech experts and current and former Facebook employees and experts pointed out inconsistencies in what The Wire showed. Its former head of business integrity, Rob Leathern, wrote on Twitter "It seems ridiculously and obviously fake; crazy." David Thiel, part of Stanford's Internet Observatory and a former Facebook security engineer, called out discrepancies in the header information The Wire said it used to verify the Stone email. Others, including Sophie Zhang, another Facebook whistleblower, noted more discrepancies, like a lack of two-factor authentication when The Wire's source was recorded entering Workplace and how the platform was organized once there. Alex Stamos, also of Stanford, noted all of the purported tickets in the source's Workplace were created by that user in the previous few hours. Elsewhere it was found that the dates in the emails from experts The Wire published had the incorrect year and that they were manually changed.
An employee of The Wire said the discrepancy was due to a technical issue he failed to catch before publication. The publication later added a "note" to the bottom of the story explaining the change.
Sunday, Oct. 16, Facebook again responds, saying website shown is "a spoof"
Facebook's Rosen took to Twitter the following day to say The Wire's latest reporting didn't actually show Facebook's internal system like it claimed.
"Our investigation has identified a spoof created on October 13 using our enterprise Meta Workplace product," Rosen added. Spoofing in tech or cybersecurity is when a source of information is fake but appears real through access to publicly accessible information and imagery.
Any person can set up a Workplace account through a free trial. Rosen said that's part of what happened with The Wire's source.
"The spoof was set up as a free trial Workplace account under the name 'Instagram' and using the IG brand as its profile pic," Rosen said. "We've locked the account for violating policies and are continuing to investigate."
Facebook also added to its own newsroom post, saying simply the Workplace account purportedly shown by The Wire "is not an internal account."
"Based on the timing of this account's creation on October 13, it appears to have been set up specifically in order to manufacture evidence to support the Wire's inaccurate reporting," Facebook said. "We have locked the account because it's in violation of our policies and is being used to perpetuate fraud and mislead journalists."
Varadarajan wrote on Twitter that the email account The Wire uses, a protonmail.com address, had been "hacked via the hacking of a MacBook." The Gmail and Twitter accounts of an employee, Devesh Kumar, the same employee who said he was to blame for the earlier date discrepancy on the expert emails, had also been hacked. Of the hacks, Varadarajan said they had been resolved and "the Andy Stone email is safe and sound and will not fall into the hands of those keen to identify The Wire's whistleblower in Meta in this manner."
Monday, Oct. 17, The Wire triples down
The Wire responded again, this time with a statement not attributed to any one person "on Meta's responses so far." The publication said Facebook was merely attempting to "goad us into releasing more and more corroborative information in the hope that this would somehow help them glean the identity of our sources."
The publication reiterated "the faith we have in our sources, whose identities and positions in Meta are known to us." It added that it was "still trying to develop, with recognized experts, a transparent method for the independent verification of Andy Stone's email."
The Wire separately updated its rebuttal story from Saturday, removing all mention of one of the two experts, saying the expert had asked to be expunged from it. A story came out from the tech newsletter Platformer, with The Wire reporters insisting its key source was real, had been met in person and had provided real documents.
Later, Pranesh Parkash, a fellow at Yale Law School's Information Society Project who had previously detailed technical discrepancies in The Wire's reporting, said on Twitter that he'd been in touch with one of the experts the publication used to back up its claims that the Stone email was legitimate. He claimed the expert told him "he never sent the mail he's purported to have sent and that he never undertook any DKIM verification for them."
Tuesday, Oct. 18, an expert used by The Wire to verify the Stone email denies any involvement
One of the security experts The Wire cited, Kanishk Karan, as having independently verified the authenticity of the Stone email it published said he had nothing to do with the publication's reporting and never participated in any verification effort.
"A fake email and my persona were used to suggest that I am the person who did it," Karan said. He noted that while he had "considered" trying to verify the email, after Kumar had contacted him for the story, he ultimately did not participate and recommended two other people who may be able to do it. When he learned he was cited as an expert, Karan said it was a "surprise."
Kumar of The Wire deactivated his Twitter account. He had spent several days responding to critics and defending The Wire's stories. Varadarajan appears to have gone quiet on Twitter as well. Facebook has yet to formally respond, but Stone retweeted Karan's denial.