Facebook announced on Friday that it removed 82 groups and accounts for “coordinated inauthentic behavior” originating from Iran that targeted users in the United States and United Kingdom.
The company could not find any present ties to the Iranian government and was unable to say who was responsible for the accounts and pages, which posted divisive messages and images about social and political topics like former NFL player Colin Kaepernick and special counsel Robert Mueller's investigation into Russian meddling in the 2016 election an attempt to sow discord. They also made several posts about the upcoming midterm elections.
“Despite attempts to hide their true identities, a manual review of these accounts linked their activity to Iran,” the company said in a blog post. “We also identified some overlap with the Iranian accounts and pages we removed in August.”
In August, Facebook suspended 652 fake pages, groups, and accounts from Facebook and Instagram for “coordinated, inauthentic behavior” associated with Iranian and Russian political influence operations. Hours later, Twitter suspended 284 accounts “for engaging in coordinated manipulation.”
Facebook suspended those accounts in August after the cybersecurity firm FireEye identified them and notified the company. Afterward, Facebook CEO Mark Zuckerberg noted that his company was “signal sharing” with other social media platforms to help trace bad actors across platforms.
Facebook detected the manipulative network that it disclosed on Friday about a week ago, according to the Nathaniel Gleicher, the company's head of cybersecurity policy. Its presence spanned 30 pages on Facebook, 33 Facebook accounts, 3 groups on Facebook, and 16 Instagram accounts. About 1 million accounts followed at least one of these pages, which had names like “Wake Up America” and “No racism no war,” while 25,000 accounts joined at least one of these groups. More than 28,000 accounts followed at least one of the Instagram accounts.
The pages and accounts also hosted seven events, though Facebook would not disclose details about those events, such as whether they actually took place in the real world. Facebook also said that it found less than $100 in spending for ads, one of which ran in June 2016 and another in January 2018.
On a call with reporters on Friday, Gleicher seemed to suggest that the accounts were broadly focused on “targeting broad division” as opposed to upcoming events, like November's US midterm elections. Some of the pages' posts, however, were clearly about the elections, including one that encouraged people to vote and another featuring a photo of two young women who had supposedly voted for Beto O'Rourke, the Democratic candidate for Texas's Senate seat.
Gleicher later clarified on a call with BuzzFeed News that the point of these operations was to focus “a range of politically charged topics,” narrowing in on the most divisive one to sow the most discord. Some of those topics happen to be around the midterms, he said.
Gleicher also said that the company had been in touch with the Foreign Influence Task Force at the FBI and the Department of Homeland Security about the accounts and pages and had informed them about their removal. Facebook has also notified other related social networking and internet companies about their findings.
In its own report, the Atlantic Council's Digital Forensic Research Lab, which was allowed to preview the removed material, provided more detail about the nature of the accounts and pages.
“Facebook shared 10 pages and 14 Instagram accounts with @DFRLab, 12 hours before the takedown,” the group wrote. “These accounts masqueraded primarily as American liberals, posting only small amounts of anti-Saudi and anti-Israeli content interspersed within large volumes of divisive political content such as race relations, police brutality, and US President Donald Trump. This evolution of tactics from previous more blatant pro-Iranian messaging suggests the operation had learned from earlier takedowns.”
Friday’s news expands upon an August report from FireEye that uncovered a large Iranian fake news influence operation similar to that which was utilized by the Kremlin in past election cycles. In this report, FireEye detailed a network of Iranian-run fake American personas, some of which were tied to Iranian state media, spread out over multiple social media platforms. The pages and accounts announced on Friday by Facebook had some overlap with the ones disclosed in August, though they did not have any clear ties to the Iranian government or state media.
While sometimes sloppy and rudimentary, the accounts FireEye uncovered in August frequently linked to misleading or fake news sites and pushed political narratives that appeared to support or align with the Iranian government. Unlike Kremlin-based accounts, which impersonated both sides of the political aisle, most of those Iranian-linked accounts appeared to impersonate liberals. The network pushed the fake news site “Real Progressive Front,” an organization claiming to be “a progressive NGO that aims to support people’s movements for freedom, peace and justice, reaffirm civil rights and reduce the influence of money in politics.”
Ben Nimmo, an Atlantic Council fellow who studies online influence efforts, noted that the accounts move away from obvious pro-Iranian messaging suggested that whoever is running political influence campaigns from the country was becoming more sophisticated.
“It's mainly based on social media, not websites, and posts engaging content — mostly memes,” he said. “Almost all the accounts pose as liberal groups, focusing on race, police violence, and attacking Trump. Divisive content, like the Russian operation, but in the mix there are systematic attacks on Israel and Saudi Arabia, especially regarding Palestine and Yemen.”