Today we removed multiple Pages, groups and accounts for coordinated inauthentic behavior on Facebook and Instagram. Some of this activity originated in Iran, and some originated in Russia. These were distinct campaigns and we have not identified any link or coordination between them. However, they used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing.
We ban this kind of behavior because we want people to be able to trust the connections they make on Facebook. And while we’re making progress rooting out this abuse, as we’ve said before, it’s an ongoing challenge because the people responsible are determined and well funded. We constantly have to improve to stay ahead. That means building better technology, hiring more people and working more closely with law enforcement, security experts and other companies. Their collaboration was critical to our investigation since no one company can fight this on their own.
There is always a tension between taking down these bad actors quickly and improving our defenses over the long term. If we remove them too early, it’s harder to understand their playbook and the extent of their network. It also limits our ability to coordinate with law enforcement, who often have investigations of their own. It’s why we’ve investigated some of these campaigns for many months and why we will continue working to find out more. We’ll update this post with more details when we have them, or if the facts change.
What We’ve Found So Far
By Nathaniel Gleicher, Head of Cybersecurity Policy
We’ve removed 652 Pages, groups and accounts for coordinated inauthentic behavior that originated in Iran and targeted people across multiple internet services in the Middle East, Latin America, UK and US. FireEye, a cybersecurity firm, gave us a tip in July about “Liberty Front Press,” a network of Facebook Pages as well as accounts on other online services. They’ve published an initial analysis and will release a full report of their findings soon. We wanted to take this opportunity to thank them for their work.
Based on FireEye’s tip, we started an investigation into “Liberty Front Press” and identified additional accounts and Pages from their network. We are able to link this network to Iranian state media through publicly available website registration information, as well as the use of related IP addresses and Facebook Pages sharing the same admins. For example, one part of the network, “Quest 4 Truth,” claims to be an independent Iranian media organization, but is in fact linked to Press TV, an English-language news network affiliated with Iranian state media. The first “Liberty Front Press” accounts we’ve found were created in 2013. Some of them attempted to conceal their location, and they primarily posted political content focused on the Middle East, as well as the UK, US, and Latin America. Beginning in 2017, they increased their focus on the UK and US. Accounts and Pages linked to “Liberty Front Press” typically posed as news and civil society organizations sharing information in multiple countries without revealing their true identity.
- Presence on Facebook and Instagram: 74 Pages, 70 accounts, and 3 groups on Facebook, as well as 76 accounts on Instagram.
- Followers: About 155,000 accounts followed at least one of these Pages, 2,300 accounts joined at least one of these groups, and more than 48,000 accounts followed at least one of these Instagram accounts.
- Advertising: More than $6,000 in spending for ads on Facebook and Instagram, paid for in US and Australian dollars. The first ad was run in Jan 2015, and the last was run in August 2018. Some ads have been blocked since the launch of our political ads transparency tools launched. We have not completed our review of the organic content coming from these accounts.
- Events: 3 events hosted.
The second part of our investigation found links between “Liberty Free Press” and another set of accounts and Pages, the first of which was created in 2016. They typically posed as news organizations and didn’t reveal their true identity. They also engaged in traditional cybersecurity attacks, including attempts to hack people’s accounts and spread malware, which we had seen before and disrupted.
- Presence on Facebook and Instagram: 12 Pages and 66 accounts on Facebook, as well as 9 accounts on Instagram.
- Followers: About 15,000 accounts followed at least one of these Pages and more than 1,100 followed at least one of these Instagram accounts.
- Advertising: We have found no advertising associated with these accounts or Pages. We have not completed our review of the organic content from these accounts.
- Events: We have found no events associated with these accounts or Pages.
The third part of our investigation uncovered another set of accounts and Pages, the first of which was created in 2011, that largely shared content about Middle East politics in Arabic and Farsi. They also shared content about politics in the UK and US in English. We first discovered this set in August 2017 and expanded our investigation in July 2018 as we stepped up our efforts ahead of the US midterm elections.
- Presence on Facebook and Instagram: 168 Pages and 140 accounts on Facebook, as well as 31 accounts on Instagram.
- Followers: About 813,000 accounts followed at least one of these Pages and more than 10,000 followed at least one of these Instagram accounts.
- Advertising: More than $6,000 in spending for ads on Facebook and Instagram, paid for in US dollars, Turkish lira, and Indian rupees. The first ad was run in July 2012, and the last was run in April 2018. We have not completed our review of the organic content coming from these accounts.
- Events: 25 events hosted.
We’re still investigating, and we have shared what we know with the US and UK governments. Since there are US sanctions involving Iran, we’ve also briefed the US Treasury and State Departments. These sanctions allow companies to provide people internet services for personal communications, including the government and its affiliates. But Facebook takes steps to prevent people in Iran and other sanctioned countries from using our ad tools. For example, our systems screen every advertiser to identify their current location and whether they’re named on the US government’s list of sanctioned individuals. Based on what we learn in this investigation and from government officials, we’ll make changes to better detect people who try to evade our sanctions compliance tools and prevent them from advertising.
Finally, we’ve removed Pages, groups and accounts that can be linked to sources the US government has previously identified as Russian military intelligence services. This is unrelated to the activities we found in Iran. While these are some of the same bad actors we removed for cybersecurity attacks before the 2016 US election, this more recent activity focused on politics in Syria and Ukraine. For example, they are associated with Inside Syria Media Center, which the Atlantic Council and other organizations have identified for covertly spreading pro-Russian and pro-Assad content. To date, we have not found activity by these accounts targeting the US.
We’re working closely with US law enforcement on this investigation, and we appreciate their help. These investigations are ongoing – and given the sensitivity we aren’t sharing more information about what we removed.
Receive the latest tech news straight to your email inbox.
As a sponsor of Glamour’s 2017 Women of the Year Summit, we launched a new mentor program in partnership with The Girl Project—Glamour Magazine’s philanthropic initiative. The Girl Project aims to unleash the vast economic and social power of girls through education to ensure that girls everywhere have access to quality secondary education. This mentorship…
In any sport, athletes and amateurs alike are concerned about how their equipment might impact their performance. For gamers, the capabilities of their hardware are fundamental to their experiences. It can be particularly frustrating when the viewing field of the game is interrupted by the bezels of three monitors, or by the slow response of…