The Facebook Ban Hammer Struck Inauthentic Behavior in Iran, Russia, Macedonia, Kosovo

2,632 pages, groups and accounts were removed

Content from one of the pages Facebook removed in Iran Facebook

Facebook’s efforts to strike inauthentic behavior from its platform continued with the removal of 2,632 pages, groups and accounts connected to Iran, Russia, Macedonia and Kosovo.

Head of cybersecurity policy Nathaniel Gleicher said in a Newsroom post that there was no evidence of links between the bad actors, but they used similar tactics, such as creating networks of accounts to mislead people about who they were and what they were doing.

A total of 513 pages, groups and accounts were removed for engaging in coordinated inauthentic behavior as part of multiple networks tied to Iran. They operated out of Egypt, Indonesia, Israel, Italy, Kashmir, Kazakhstan and other locations in the Middle East and North Africa, and page administrators and account holders misrepresented themselves as locals or media entities that don’t exist, often using fake accounts. They also impersonated real political groups and media organizations.

Gleicher wrote, “They posted news stories on current events and frequently repurposed and amplified content from Iranian state media about topics including sanctions against Iran; tensions between India and Pakistan; conflicts in Syria and Yemen; terrorism; tensions between Israel and Palestine; Islamic religious issues; Indian politics; and the recent crisis in Venezuela. Although the people behind this activity attempted to conceal their identities, our review linked these accounts to Iran.”

He added that 158 Facebook pages, 263 Facebook accounts, 35 groups and 57 Instagram accounts were removed. Some 1.4 million accounts followed one or more of those pages, approximately 108,000 joined at least one of the groups and about 38,000 followed one or more of the Instagram accounts.

About $15,000 was spent on ads from December 2013 through February 2019, paid for in U.S. dollars, Indonesian rupiah, Indian rupees, Pakistan rupees, Swiss francs and Canadian dollars.

Gleicher said some of these bad actors were discovered as a follow-up of its investigations in Iran earlier this year, and information has been shared with law enforcement in the U.S.

Examples of content that was removed follow below:

Caption: Palestine’s flag was fluttered at annual British Trade Union conference.
Headline: Iran is able to hinder hostile tactics
Image Text: Organizing and coordination between the UK and Zionist Regime on BBC Persian. According to information provided on the website of the British Parliament, Jenny Tonge, a member of the House of Lords of the British Parliament, has asked the Ministry of Defense why London has been using the Zionist Air Force to participate in the Cobra exercise, scheduled for this summer. A senior official in the United Kingdom recently said that the two sides are working closely together to confront Iran and Hezbollah in response to a question on military cooperation between London and Tel Aviv.
Caption: Amed News, lets cry blood, we will not forget you ever, Tehran, Mashahd, Shahin Najafi, Restart, Wednesday without suppression, White Wednesday, Human Echo, Celebrity Image text: Neither, Ghaza nor Lebanon, my [soul] is for Iran
Caption: Viral: Iran’s fast boat threaten US aircraft carrier – For the real Muslims, don’t forget to give comment allahu akbar and click share
Headline: Venezuela praises rejection of the United States to Trump’s interference

In Russia, 86 Facebook pages, 64 Facebook accounts and 1,757 groups were removed, mostly for posting spam content. Some also posted content related to news and politics in Ukraine, including: the ongoing conflict in the eastern part of the country; local and regional politics; patriotism; refugee issues; military; the situation in Crimea; and corruption.

Gleicher said about 50,000 accounts followed one or more of those pages, and some 1.7 million joined one or more of the groups.

No ad spend was associated with any of the removed accounts, and Facebook shared information with relevant law enforcement and policymakers. Below are examples of some of the content that was removed:

Caption: Urgent! We are looking for candidates for the role of an information manager. FOR WOMEN! Work is remote and in your spare time, career opportunities. If you want to earn, you are from 18 to 60 y.o., you have average computer skills and internet access, then leave +++ in the comments or reach out in pm.
Caption: Just in! Average earnings project on monitoring from top-admin! Register here: [link]. Serious earnings with impressive turnover! It is your key for financial success! I can’t help but admire the way the platform works! Everything is fast, clear, with no delays, always on time! Pure pleasure! This project rocks! Worldwide exchange! Pays back! My deposit is 45,000 RUB…. Image Text: Earn from any spot in the world.
Headline: The number of children with autism is rising in Azerbaijan, but there are no specialists on this issue

Finally, 40 Facebook pages and 172 accounts were removed for engaging in coordinated inauthentic behavior that originated in Macedonia and Kosovo.

Violations included creating fake accounts to run pages that shared general, non-country-specific content such as astrology, celebrities and beauty tips, as well as pages misrepresenting themselves as political communities in Australia, the U.K. and the U.S., posting about religious and political topics like nationalism, Islam and political figures.

The removed pages and accounts were linked to a network of individuals operating in Macedonia and Kosovo, and Gleicher said Facebook’s investigation was helped by open source reporting, including from the press in Australia, adding that it shared information with relevant law enforcement and policymakers.

Some 685,000 accounts followed one or more of those pages, and a total of $5,800 was spent on ads between October 2013 and March 2019, paid for in U.S. dollars, euros, pounds and Philippine pesos. Examples of removed content follow:


Gleicher wrote, “We are constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. We’re taking down these pages and accounts based on their behavior, not the content they posted. In each case, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.” David Cohen is editor of Adweek's Social Pro Daily.