Head of cybersecurity policy Nathaniel Gleicher said in a Newsroom post that there was no evidence of links between the bad actors, but they used similar tactics, such as creating networks of accounts to mislead people about who they were and what they were doing.
A total of 513 pages, groups and accounts were removed for engaging in coordinated inauthentic behavior as part of multiple networks tied to Iran. They operated out of Egypt, Indonesia, Israel, Italy, Kashmir, Kazakhstan and other locations in the Middle East and North Africa, and page administrators and account holders misrepresented themselves as locals or media entities that don’t exist, often using fake accounts. They also impersonated real political groups and media organizations.
Gleicher wrote, “They posted news stories on current events and frequently repurposed and amplified content from Iranian state media about topics including sanctions against Iran; tensions between India and Pakistan; conflicts in Syria and Yemen; terrorism; tensions between Israel and Palestine; Islamic religious issues; Indian politics; and the recent crisis in Venezuela. Although the people behind this activity attempted to conceal their identities, our review linked these accounts to Iran.”
He added that 158 Facebook pages, 263 Facebook accounts, 35 groups and 57 Instagram accounts were removed. Some 1.4 million accounts followed one or more of those pages, approximately 108,000 joined at least one of the groups and about 38,000 followed one or more of the Instagram accounts.
About $15,000 was spent on ads from December 2013 through February 2019, paid for in U.S. dollars, Indonesian rupiah, Indian rupees, Pakistan rupees, Swiss francs and Canadian dollars.
Gleicher said some of these bad actors were discovered as a follow-up of its investigations in Iran earlier this year, and information has been shared with law enforcement in the U.S.
Examples of content that was removed follow below:
In Russia, 86 Facebook pages, 64 Facebook accounts and 1,757 groups were removed, mostly for posting spam content. Some also posted content related to news and politics in Ukraine, including: the ongoing conflict in the eastern part of the country; local and regional politics; patriotism; refugee issues; military; the situation in Crimea; and corruption.
Gleicher said about 50,000 accounts followed one or more of those pages, and some 1.7 million joined one or more of the groups.
No ad spend was associated with any of the removed accounts, and Facebook shared information with relevant law enforcement and policymakers. Below are examples of some of the content that was removed:
Finally, 40 Facebook pages and 172 accounts were removed for engaging in coordinated inauthentic behavior that originated in Macedonia and Kosovo.
Violations included creating fake accounts to run pages that shared general, non-country-specific content such as astrology, celebrities and beauty tips, as well as pages misrepresenting themselves as political communities in Australia, the U.K. and the U.S., posting about religious and political topics like nationalism, Islam and political figures.
The removed pages and accounts were linked to a network of individuals operating in Macedonia and Kosovo, and Gleicher said Facebook’s investigation was helped by open source reporting, including from the press in Australia, adding that it shared information with relevant law enforcement and policymakers.
Some 685,000 accounts followed one or more of those pages, and a total of $5,800 was spent on ads between October 2013 and March 2019, paid for in U.S. dollars, euros, pounds and Philippine pesos. Examples of removed content follow: