Facebook Shuts Down More Coordinated Inauthentic Activity in Iran, Russia

Three networks originated in the former, one in the latter

Sample content from a page that originated in Iran and focused on Latin America
Facebook

Facebook provided details on four separate networks of accounts, pages and groups originating in Iran and Russia that were removed from its platform for engaging in coordinated inauthentic behavior.

Three of the networks originated in Iran, while Russia was the base for the fourth.

Facebook head of cybersecurity policy Nathaniel Gleicher elaborated in a Newsroom post.

The first network was based in Iran and focused primarily on the U.S., as well as on some French-speaking audiences in North Africa.

Facebook removed 93 accounts, 17 pages and four Instagram accounts, saying that fake accounts were used to impersonate locals, manage pages, join groups and divert people to off-platform domains connected to the social network’s previous investigation into Iran-linked Liberty Front Press, which was removed from its platform in August 2018.

Topics discussed typically included U.S. public figures, U.S. politics, Israeli politics, support of Palestine and the conflict in Yemen.

Gleicher said about 7,700 accounts followed one or more of the pages in the group, and some 145 people followed at least one of the Instagram accounts. He also shared samples of content posted by some of the pages:

Facebook
Facebook
Translation: Trump accuses John McCain and Lindsey Graham of wanting to launch a war against Russia
Facebook
Facebook

Facebook removed 38 accounts, six pages, four groups and 10 Instagram accounts as part of the second Iran-originated network, which was focused on Latin American countries including Argentina, Bolivia, Brazil, Ecuador, Mexico, Peru and Venezuela.

Gleicher said page administrators and account owners in the group represented themselves as locals and used fake accounts to post in groups, manage pages posting as news organizations and direct traffic to off-platform domains.

He added that this network frequently repurposed Iranian state media on topics such as: Hezbollah; conflict between Iran and Saudi Arabia; tensions between Israel and Palestine and Iran and the U.S.; and the war in Yemen.

They also posted content tailored for particular countries, including domestic news, geopolitics and public figures.

Roughly 13,500 accounts followed at least one of the pages, while around 4,200 joined one or more of the groups and about 60,000 followed one or more of the Instagram accounts.

Gleicher shared samples of content posted by some of the pages:

Translation: “The FANB: More than 54 airplanes from the United States performed “Radio exploration” of Venezuelan Territory during September. The operations commander reported that radar had detected at least 54 incursions of US spy planes during this month.”
Facebook
Translation: The American congresswoman AOC resumed Tuesday the accusations against President Donald Trump, after he assured everyone that “he did not have a racist bone” in his body, within the framework of attacks against her and three other progressive legislatures and insisted they” go back to the countries they came from”. I agree with you Mr President: you don’t have a racist bone in your body, you have a racist mind in your head and a racist heart in your chest.”
Facebook
Translation: Line 1 “Palestinians claim that the area called south…” Line2: “Israel carries out the largest project of demolition of Palestinian houses in occupied Jerusalem. How does the world react?”
Facebook
Translation: “we must remember, respect and emulate this photo … Love for the great motherland and nothing else”
Facebook

The third and final network that originated in Iran was made up of four accounts, three pages and seven Instagram accounts, focused mainly on the U.S.

The individuals behind this small network used fake accounts to manages pages and an application and to drive Facebook users to an off-platform domain.

Gleicher said the app’s sole purpose appeared to be pushing content to a page called BLMNews, which masqueraded as a news entity.

Topics included race relations in the U.S., criticism of the U.S. and Israeli policy on Iran, the Black Lives Matter movement, African-American culture and Iranian foreign policy.

About 45 accounts followed at least one of the pages, while some 7,300 people followed one or more of the Instagram accounts.

This network spent less than $2 on Facebook ads, paid for in U.S. dollars.

Gleicher shared samples of content posted by some of the pages:

Facebook
Facebook
Facebook
Facebook

Finally, the network of one Facebook account and 50 Instagram accounts that originated in Russia showed some links to the Internet Research Agency.

Gleicher said during a press call Monday related to the social network’s efforts to safeguard the 2020 U.S. presidential election that this network “had the hallmarks of a well-funded operation and was focused on trying to build its audience when we took it down.”

Fake accounts were used to follow, like and comment on each other’s posts in order to boost engagement, and they primarily repurposed content shared by others, including screenshots of social media posts by news organizations and public figures. Some of the accounts also repurposed and modified old IRA memes.

Recommended articles