In September 2008, Forbes science editor Matthew Herper and former Washington Post reporter Rick Weiss appeared together on a panel at the World Stem Cell Summit in Madison, Wisconsin. In late February, Herper received an invitation to ‘friend’ Weiss on the Internet social-networking site Facebook. On the basis of their acquaintance, Herper accepted, noticing that a number of other people involved with stem cells were listed as friends on Weiss’s profile. However, that profile — and many of those it was linked to — was a fake. Weiss is one of more than 100 scientists, policy-makers and journalists, many linked to stem-cell research, whose identities have been purloined to create a convincing — but bogus — network of apparent friends on Facebook. The victims have no control over the profiles that carry their names, and the perpetrators — and their motive — remain unknown.

Security experts call the creation of a network of impostors a Sybil attack. “People use impostors to create the image that a certain idea is more accepted or under more fire than it really is,” says John Wilbanks, vice-president of science at the non-profit corporation Creative Commons, which provides free intellectual-property licences for online content.

The second of those possibilities was a worry to Alta Charo, a bioethicist at the University of Wisconsin-Madison, when she discovered fake Facebook profiles in her name and in those of other Wisconsin researchers with connections to stem-cell work in February. The list included Carolyn ‘Biddy’ Martin, who attended the stem-cell summit in her role as university chancellor. Facebook removed the profiles after the university’s legal counsel contacted the company. A Facebook official told attendees at the e-Crime Congress in London last month that the company removes thousands of profiles a week.

Charo has no real Facebook profile: the fake one contained information easily gleaned from web searches as well as some made-up but harmless material. Weiss did have a real profile under his own control, and updates to this were channelled to the doppelgänger, adding verisimilitude. The bogus site suggests that at least one of the true Weiss’s friends was an impostor. What it lacks, according to someone who has seen both profiles, is the affiliation that links Weiss’s real profile to the network of the think-tank the Center for American Progress, where Weiss worked before becoming the communications director and policy analyst at the White House Office of Science & Technology Policy. Such affiliations require e-mail confirmation, and none of the bogus profiles has any.

Davide Balzarotti, a computer-security researcher at the communication systems research centre Eurecom in Sophia-Antipolis, France, estimates that it would take only a day or so for a programmer to create the stem-cell impostor network using a mixture of manual and automated processes to harvest data from elsewhere. Balzarotti and colleagues have created cloning software that replicates networks found on one site on a second — such as LinkedIn, XING and Facebook — in order to test the ease with which a Sybil attack could be automated¹. Balzarotti’s Eurecom colleague Engin Kirda sees nothing to suggest that the scientists were targeted for imposture because of their specific work, but says it is possible to imagine a researcher creating a false profile and a Sybil network around it in order to obtain sensitive information from a hoodwinked competitor.

There is little activity on the impostor network, but it is not moribund: two of the suspected impostor profiles disappeared from public view after Nature tried to make contact (we have also brought the situation to Facebook’s attention). And the false Rick Weiss profile has had one comment on it from a ‘John Birch’ that didn’t appear on the real profile. John Birch, who died in China in 1945, is the namesake of a right-wing political organization, the John Birch Society, which is headquartered in Appleton, Wisconsin. The society, like many on the American right, is against research that involves viable embryonic stem cells, says William Jasper, senior editor of the society’s magazine, The New American. He had not heard of the impostor network, but noted that John Birch is a common name that could easily be real or fake.

Although no harm seems to have been done, the experience of being cloned remains a disconcerting one. As Elaine Fuchs, a stem-cell researcher at Rockefeller University in New York, puts it: “I’m afraid to open it … I feel safer remaining completely oblivious to whatever is in there.” Instead, she asked an official from her institution to deal with it. She writes, “I guess I’m not really interested in trying to come up with speculation about the mind(lessness) of the person who did”.

First published in Nature: [pdf] [html].