Victoria Police social media incompetence laid bare for all to see

Victoria Police utilize hundreds of fake Facebook accounts to manage their expansive social media presence; their poor online security practices with these accounts have exposed their entire social media team.

Last week, a group of homelessness activists in Melbourne announced they would be holding a public forum to discuss “Melbourne’s rough sleeping ban”.

Shortly after posting this information to a public campaign Facebook page, organizers received a cryptic message from an individual claiming to be from Victoria Police:

This is Victoria Police. We’ve been informed of your protest action and want to let you know we’ll be monitoring this event with interest.

The message originated from a “Mark Darryl”, on an account with the URL slug markd.bayly. The account uses a Victoria Police shield as it’s profile picture, contains some generic police related content, and has approximately eighty friends.

The vast majority of these Facebook friends are fake accounts. They all have generic names, no content, one Facebook friend, and the same blank red Facebook profile photo.

Whoever operates the “Mark Daryl” Facebook account appears (at first glance) to have gone to the effort of registering 80+ fake Facebook profiles so that their fake Facebook profile could have some friends.

That said, not all of the accounts linked to this profile are fake. One of “Mark Darryl’s” Facebook friends is a “Mark Bayly”, URL slug mark.bayly.71.

A quick search for “Mark Bayly” reveals that:

Mark Bayly is the manager of online communications for Victoria Police.

Bayly’s hobbies include drumming, his band occasionally plays at Pause Bar in Balaclava, he’s a fan of Pink Floyd, his partner’s name is Margaret, and he has appallingly bad social media security practice for someone who manages the social media presence of a state police force.

It seems that Mark Bayly has received awards for his work in social media, the day to day tasks of which appear to include messaging activist groups to let them know that big brother is always watching:

But back to the fake accounts. Bayly didn’t just register these so that his fake account could have some friends, instead this appears to be the method by which Victoria Police manage their network of “Eyewatch” pages.

Rather than using any commercial solution, it appears that the Victoria Police social media team have registered hundreds of almost identical fake Facebook profiles in order to manage this plethora of different pages. There are presumably fake profiles for every officer who would ever need admin access to one of these Facebook pages.

It’s a clumsy practice but it makes some weird sense. Facebook pages are often subject to mass reporting, and Facebooks’s appalling automated moderation system routinely removes reported content and imposes bans on the admin account that posted the material.

To avoid this problem, most business would just employ a commercial solution (like Hootesuite). Instead, Victoria Police appear to have manually registered an army of paper accounts.

Unfortunately for them, the officers (presumably) using these these fake profiles have appallingly bad security habits. The account names are often similar (or identical to) the names of serving officers, and many of these profiles link back to their personal accounts. Simply by tracking the friends lists of these accounts it is possible to build an extensive map of Victoria Police’s social media presence and the officers who operate it.

The entire operation looks amateurish, but it just gets worse for Victoria Police. Operating fake profiles is a breach of Facebook’s terms of service, and every Facebook user has the ability to report a fake profile.

If sufficient reports are made, the operator of these fake accounts will have to prove to Facebook that the accounts are not fake, that they use real names and so on. Usually Facebook’s system demands a user upload photo ID. If you can’t do this, Facebook will lock your account.

A campaign of mass reporting could see Victoria Police progressively locked out of the accounts they use to manage their sprawling social media presence.

In December, the Andrews government announced that it would establish a “high tech monitoring hub” that would enable Victoria Police to engage in “real-time monitoring of social media”.

I wonder whether this “real time monitoring” system will include a subscription to Hootsuite, and whether it will be available before activists report every single one of these accounts.

Maybe the “manager of online communications for Victoria Police” shouldn’t have taken it upon himself to try and intimidate activists holding a public forum on homelessness.