Iran’s Facebook and Twitter propaganda targeted hundreds of thousands
Facebook said on Tuesday it shut down hundreds of pages and accounts operated by Iran- and Russia-backed accounts that concealed their true identities and roped in hundreds of thousands of unwitting users over a seven-year period. Within an hour of Facebook’s announcement, Twitter said it had suspended similar accounts on its platform.
Facebook said four separate and ongoing investigations had so far resulted in the take-down of 652 pages, groups, and accounts, some of which had been identified as early as last August. Twitter announced it had suspended 284 accounts–many of which also originated in Iran–for engaging in “coordinated manipulation.”
Twitter said it had worked “with our industry peers” to identify the accounts, and reiterated promises to engage “with other companies and relevant law enforcement entities.”
The Iranian efforts may be the first publicly documented instance of an Iran-based influence campaign conducted through U.S. social media. That’s according to security firm FireEye, which tipped Facebook off to the Iranian operation and released its own report. Thus far, Facebook and other social media platforms have largely identified information operations conducted by Russia.
The majority of Facebook’s removals were pages, groups, and numerous Facebook and Instagram accounts connected to pages traced to operators located in Iran. In a blog post Tuesday, Facebook said it saw “coordinated inauthentic behavior that originated in Iran and targeted people across multiple internet services in the Middle East, Latin America, U.K. and U.S.” Beyond a handful of sample posts, the company was vague about the content being shared on the pages or featured in ads purchased by the operators.
The Iranian and Russian operators may not have been interested in disrupting elections in the U.S. or elsewhere, but rather at promoting a variety of pro-government agendas. Facebook said it could not identify the campaigns’ specific goals. FireEye said of the pages it examined that “it is important to note that the activity does not appear to have been specifically designed to influence the 2018 U.S. midterm elections, as it extends well beyond U.S. audiences and U.S. politics.”
Facebook found three separate networks of pages run by Iranian entities that attempted to hide their true identity and pushed Iranian political causes. One set of pages, sharing political content in Arabic, Farsi, and English, began operating in 2011 and accumulated some 820,000 followers on Facebook and Instagram.
“These were distinct campaigns and we have not identified any link or coordination between them,” Nathaniel Gleicher, Facebook’s head of cybersecurity policy, wrote in a blog post Tuesday. “However, they used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing.”
FireEye said that the activity it studied broadly appears to “promote Iranian political interests, including anti-Saudi, anti-Israeli, and pro-Palestinian themes, as well as to promote support for specific U.S. policies favorable to Iran, such as the U.S.-Iran nuclear deal (JCPOA).” In the U.S., “this also includes significant anti-Trump messaging and the alignment of social media personas with an American liberal identity.”
One of Facebook’s investigations found that an Iranian news organization and website called Liberty Front Press was operating a network of pages and accounts on and off Facebook. After learning of the Liberty Front Press network from FireEye, Facebook said it was able to link the network to Iranian state media through publicly available website registration information. It also found that some of the pages in the network were run by the same administrators, and often posed as news and civil society organizations.
In all, Liberty Front Press accounted for 74 pages, 70 accounts, and three groups on Facebook, and 76 accounts on Instagram. It had also purchased more than $6,000 worth of ads on Facebook and Instagram.
The campaigns used multiple currencies: Liberty Front Press Facebook and Instagram ads were purchased using U.S. and Australian dollars. A separate Iranian campaign spent another $6,000 on ads in U.S. dollars, Turkish lira, and Indian rupees.
Liberty Front Press did not immediately respond to a request for comment.
A fourth investigation centered on a Russian entity that gave no notice on Facebook that its pages, groups, and accounts were connected with the Russian military. “While these are some of the same bad actors we removed for cybersecurity attacks before the 2016 U.S. election, this more recent activity focused on politics in Syria and Ukraine,” Facebook said in its blog post.
Some early reporting on Facebook’s announcement, including by the New York Times and Axios, seemed to link the campaigns with efforts to disrupt the U.S. midterm elections, an ongoing concern for Facebook and other platforms. But Facebook confirmed to Fast Company it had established no specific motive for the operations.
“We’re not really in a position to understand the direct targeted goals of these actors,” Gleicher said on a conference call with reporters. “We’re best placed to comment on the technical indicators but not on the intelligence analysis that law enforcement might do.”
On a July 31 conference call about a previous set of “bad actor” pages it had identified, Facebook executives were also reluctant to say if it had detected disinformation campaigns focused on disrupting the midterms.
Facebook has also shied away from policing pages based on their content, which might include propaganda and disinformation. Rather, it’s removing pages and canceling accounts based on the whether the operators are honest about their identities, origins, and affiliations.
Working with our industry peers today, we have suspended 284 accounts from Twitter for engaging in coordinated manipulation. Based on our existing analysis, it appears many of these accounts originated from Iran.
— Twitter Safety (@TwitterSafety) August 22, 2018
Facebook said it first identified some of the suspicious pages and accounts on its platforms in August 2017. “There is always a tension between taking down these bad actors quickly and improving our defenses over the long term,” the company explained in its blog post. “If we remove them too early, it’s harder to understand their playbook and the extent of their network. It also limits our ability to coordinate with law enforcement, who often have investigations of their own.”
Facebook is trying to demonstrate that it’s making real progress in protecting its platform from disinformation campaigns. The company had already said that it has stepped up its investigative activities in advance of the midterms. The intent behind today’s news and conference call may be a desire by Facebook to show that it’s getting better at preventing hackers from masterfully using its social media platform to screw up elections as they did in 2016.
It’s also sought to get ahead of the problem before journalists and independent researchers do it for them. Facebook has held a number of journalist conference calls throughout the spring and summer; today Mark Zuckerberg was on the line.
“There have been several big elections since the 2016 election,” Zuckerberg said. “There have been elections in Germany and France, and the special election in Alabama, and each time we get better at detecting this type of activity up front. The four investigations here are just one more step.”
Facebook executives will likely face more questions about the new campaigns and how they were uncovered when they appear before the Senate Intelligence Committee, along with leaders from Twitter and Google, at a hearing on September 5.
“I’ve been saying for months that there’s no way the problem of social media manipulation is limited to a single troll farm in St. Petersburg, and that fact is now beyond a doubt,” Senator Mark Warner, D-VA, said in a statement.
Fast Company , Read Full Story
(22)
