Allegations that Facebook and Twitter are being manipulated by non-U.S. groups have now been extended against Iran after the two social media giants separately announced Tuesday night they have taken down hundreds of accounts, pages and groups for suspicious behavior.
“Working with our industry peers today, we have suspended 284 accounts from Twitter for engaging in co-ordinated manipulation,” the company said in a tweet. “Based on our existing analysis, it appears many of these accounts originated from Iran.”
Facebook said in a statement that it removed multiple pages, groups and accounts for “co-ordinated inauthentic behavior on Facebook and Instagram. Some of this activity originated in Iran, and some originated in Russia, These were distinct campaigns and we have not identified any link or co-ordination between them. However, they used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing.”
Below: Some of the English-language posts Facbook says were made by suspended groups
More specifically, Nathaniel Gleicher, Facebook’s head of cybersecurity policy, said the company removed 652 Pages, groups and accounts for co-ordinated “inauthentic” behavior that originated in Iran and targeted people across multiple internet services in the Middle East, Latin America, U.K. and the U.S.
Separately, Facebook pages, groups and accounts that can be linked to sources the U.S. government has previously identified as Russian military intelligence services were removed. “While these are some of the same bad actors we removed for cybersecurity attacks before the 2016 US election,” Gleicher said, this more recent activity focused on politics in Syria and Ukraine. For example, they are associated with Inside Syria Media Center, which the Atlantic Council and other organizations have identified for covertly spreading pro-Russian and pro-Assad content. To date, we have not found activity by these accounts targeting the U.S.”
He said the investigation into Iran-related material started with a tip in July from security vendor FireEye about “Liberty Front Press,” a network of Facebook Pages as well as accounts on other online services (see below for FireEye’s analysis. FireEye said it uses the term “inauthentic” to describe sites that are not transparent in their origins and affiliations, undertake concerted efforts to mask these origins, and often use false social media personas to promote their content).
“We are able to link this network to Iranian state media through publicly available website registration information, as well as the use of related IP addresses and Facebook Pages sharing the same admins,” Gleicher wrote. “For example, one part of the network, “Quest 4 Truth,” claims to be an independent Iranian media organization, but is in fact linked to Press TV, an English-language news network affiliated with Iranian state media. The first “Liberty Front Press” accounts we’ve found were created in 2013. Some of them attempted to conceal their location, and they primarily posted political content focused on the Middle East, as well as the U.K, U.S, and Latin America. Beginning in 2017, they increased their focus on the U.K. and U.S.. Accounts and Pages linked to “Liberty Front Press” typically posed as news and civil society organizations sharing information in multiple countries without revealing their true identity.
Facebook estimates about 155,000 accounts followed at least one of the Liberty Front Press Pages. About 2,300 accounts joined at least one of the groups, and more than 48,000 accounts followed at least one of the Instagram accounts. More than $6,000 in U.S. or Australian dollars were paid for ads on Facebook and Instagram.
Links were also found between “Liberty Front Press” and another set of accounts and Pages, the first of which was created in 2016. They typically posed as news organizations and didn’t reveal their true identity. They also engaged in traditional cybersecurity attacks, including attempts to hack people’s accounts and spread malware, which we had seen before and disrupted.
Another set of accounts and Facebook Pages, the first of which was created in 2011, largely shared content about Middle East politics in Arabic and Farsi. They also shared content about politics in the U.K. and U.S. in English. This group had 168 Pages and 140 accounts on Facebook, as well as 31 accounts on Instagram. About 813,000 accounts followed at least one of these Pages and more than 10,000 followed at least one of these Instagram accounts.
In a blog describing its part in Facebook’s investigation, FireEye was cautious in attribution. “We assess with moderate confidence that this activity originates from Iranian actors.”
Broadly speaking, the intent behind all the activity discovered appears to be to promote Iranian political interests, including anti-Saudi, anti-Israeli, and pro-Palestinian themes, FireEye said, as well as to promote support for specific U.S. policies favorable to Iran, such as the U.S.-Iran nuclear deal.
“In the context of the U.S.-focused activity, this also includes significant anti-Trump messaging and the alignment of social media personas with an American liberal identity. However, it is important to note that the activity does not appear to have been specifically designed to influence the 2018 U.S. midterm elections, as it extends well beyond U.S. audiences and U.S. politics.”
In an interview this morning security and defence expert Christian Leuprecht of Queen’s University and Royal Military College said the discovery of manipulative activity on the two social media sites isn’t surprising. Russia, China, North Korea and Iran “having consistently shown they are willing and able to do what it takes to influence the way people think about issues and policies.”
On the other hand, he thinks social media companies aren’t doing enough to root out such activity, “in part because that would cut at the core of their business model. I think they’re doing the absolute minimum to demonstrate they’re serious, and hopefully by doing that keep the state out of their lives in terms of either regulation or more stringent requirements to co-operate with intelligence and law enforcement agencies.” But, he warned, social media providers face the risk of damage to their reputation and loss of customers if their platforms are seen as largely sources of misinformation.
Leuprecht didn’t agree that social media face a daunting task of screening content because of the millions of posts added daily. His research also includes work on large scale data analytics of text. “It’s not rocket science to identify certain types of patterns of certain types of postings, even with millions of accounts and the huge material that gets posted.”
But the deletion of content shouldn’t be automated, he added.
Facebook and Twitter have been cracking down on fake or suspicious accounts since allegations surfaced that the Russian military set up bogus accounts before the 2016 U.S. election.
Meanwhile this week Microsoft said it closed five web sites mimicking prominent American political or think tank organizations and allegedly run by a Russian government-backed threat group.
(Editor’s note: This story has been updated from the original with quotes from Christian Leuprecht.)