Facebook has removed dozens of pages that were using “coordinated inauthentic behavior” intended to “mislead” other users ahead of the 2018 U.S. midterm elections, the company announced today.

It’s the first known coordinated effort that Facebook has discovered and announced ahead of the midterms. The company says it’s unclear who is behind the efforts, but CNN reported Tuesday that it is believed a “Russian group” is behind the coordinated campaign.

“Some of the activity is consistent with what we saw from the IRA before and after the 2016 elections,” Facebook wrote, referring to Russia’s Internet Research Agency, the group that was most prevalent on Facebook around the 2016 election. Still, Facebook declined to name Russia outright.

The coordinated campaign included just 32 Pages and accounts on both Facebook and Instagram. Some of those Pages created events, shared thousands of posts, and even bought around $11,000 in Facebook ads over a 14-month period. That’s a small campaign compared to what we saw on Facebook during the U.S. election in 2016.

But any possible coordinated campaign is concerning for Facebook and the democratic process. And it’s crucial for Facebook — which is under all kinds of scrutiny over how it missed this misuse of its platform two years ago — to be upfront and transparent about it. The New York Times first reported Facebook’s discovery.

Facebook executives, including COO Sheryl Sandberg and Chief Security Officer Alex Stamos, hosted a conference call with reporters Tuesday shortly after Facebook’s blog post was published. Sandberg says Facebook is choosing to share this information now because it is trying to get ahead of a Washington, D.C., protest set for next week that was planned and promoted by these inauthentic accounts — an event titled “No Unite the Right 2 - DC,” which Facebook says was planning to protest a separate “Unite the Right” event, also in August.

Facebook says there have been close to 30 events created by these “bad actors” so far, and all but two of them have already passed on the calendar. Facebook says it doesn’t know if people actually showed up.

“[On] the previous events, we can assess what happened on Facebook; we can’t assess what happened in the real world — in the external world,” said Nathaniel Gleicher, Facebook’s head of cybersecurity policy.

Facebook has not released all the posts from these recently deleted accounts, but did publish a small set of examples. Most of them were anti-Trump in nature and appeared to fall under a theme of “resistance.” Facebook says an outside think tank focused on international affairs, the Atlantic Council, is analyzing all of the posts and will share a full report once that analysis is complete.

Facebook also elaborated a bit on why these new accounts may have ties to the IRA. It turns out that a known IRA account was listed as an administrator for one of these inauthentic pages for a very short time in 2017. The page, titled “Resisters,” had “an IRA account as one of its admins for only seven minutes,” Facebook wrote.

Last week, on a separate conference call with reporters, Facebook executives were asked repeatedly if they had seen any behavior from foreign actors that looked similar to the campaigns Russia implemented around the 2016 U.S. election. Executives dodged the questions, refusing to say whether or not Facebook has come across any questionable behavior ahead of this November’s midterm elections.

Facebook has made a number of changes in the past 18 months in the hope of thwarting another disinformation campaign. The company now flags and downgrades so-called fake news stories, using outside fact-checkers to identify them so Facebook can cut their reach in News Feed. It’s also requiring political advertisers to register with the company, and catalogues all political advertisements in a new dashboard so users can see who paid for them.

The hope is that these efforts will make it harder for foreign actors to run ads or promotional campaigns that may influence U.S. voters.

Sign up for the newsletter Recode Daily Email (required) By signing up, you agree to our Privacy Notice and European users agree to the data transfer policy. Subscribe