Facebook and Twitter remove hundreds of accounts linked to Iranian and Russian political meddling

Facebook has removed hundreds of accounts and pages for what it calls “coordinated inauthentic behavior,” generally networks of ostensibly independent outlets that were in fact controlled centrally by Russia and Iran. Some of these accounts were identified as much as a year ago.

In a post by the company’s head of cybersecurity policy, Nathaniel Gleicher, the company described three major operations that it had monitored and eventually rolled up with the help of security firm FireEye. The latter provided its own initial analysis, with more to come.

Notably, few or none of these were focused on manipulating the 2018 midterm elections here in the states, but rather had a variety of topics and apparent goals. The common theme is certainly attempting to sway political opinion — just not in Ohio.

For instance a page may purport to be an organization trying to raise awareness about violence perpetrated by immigrants, but is in fact operated by a larger shadowy group attempting to steer public opinion on the topic. The networks seem to originate in Iran, and were promoting narratives including “anti-Saudi, anti-Israeli, and pro-Palestinian themes, as well as support for specific U.S. policies favorable to Iran,” as FireEye describes them.

The first network Facebook describes, “Liberty Front Press,” comprised 74 pages, 70 accounts, and 3 groups on Facebook, and 76 accounts on Instagram. Some 155,000 people followed at least one piece of the Facebook network and they had 48,000 Instagram followers. They were generally promoting political views in the Middle East and only recently expanded to the States; they spent $6,000 on ads beginning in January 2015 up until this month.

A related network to this one also engaged in cyberattacks and hacking attempts. Its 12 pages and 66 accounts, plus 9 on Instagram, were posing as news organizations.

A third network had accounts going back to 2011; it was sharing content in the Middle East as well, about local, U.S., and U.K. political issues. With 168 pages and 140 Facebook accounts and 31 Instagram accounts, this was a big one. As you’ll recall, the big takedown of Russia’s IRA accounts only amounted to 135. (The full operation was of course much larger than that.)

This network had 813,000 accounts following it on Facebook and 10,000 on Instagram, and had also spent about $6,000 on ads between 2012 and April of this year. Notably that means that Facebook was taking ad dollars from a network it was investigating for “coordinated inauthentic behavior.” I’ve asked Facebook to explain this — perhaps it was done so as not to tip off the network that it was under investigation.

Interestingly this network also hosted 25 events, meaning it was not just a bunch of people in dark rooms posting under multiple pseudonyms and fake accounts. People attended real-life events for these pages, suggesting the accounts supported real communities despite being sockpuppets for some other organization.

Twitter, almost immediately after Facebook’s post, announced that it had banned 284 of accounts for “coordinated manipulation” originating in Iran.

The Iranian networks were not alleged to be necessarily the product of state-backed operations, but of course the implication is there and not at all unreasonable. But Facebook also announced that it was removing pages and accounts “linked to sources the U.S. government has previously identified as Russian military intelligence services.”

The number and nature of these accounts is not gone into in detail, except to say that their activity was focused more on Syrian and Ukrainian political issues. “To date, we have not found activity by the accounts targeting the U.S.,” the post reads. But at least the origin is relatively clear: Russian state actors.

This should be a warning that it isn’t just the U.S. that is the target of coordinated disinformation campaigns online — wherever one country has something to gain by promoting a certain viewpoint or narrative, you will find propaganda and other efforts underway via whatever platforms are available.

Senator Mark Warner (D-VA) issued a brief I-told-you-so following the news.

“I’ve been saying for months that there’s no way the problem of social media manipulation is limited to a single troll farm in St. Petersburg, and that fact is now beyond a doubt,” he said in a statement. “We also learned today that the Iranians are now following the Kremlin’s playbook from 2016. While I’m encouraged to see Facebook taking steps to rid their platforms of these bad actors, there’s clearly more work to be done.”

He said he plans to bring this up at the Senate Intelligence Committee’s grilling of Facebook, Twitter, and Google leadership on September 5th.