Facebook Removed Hundreds of Accounts and Ads Originating From 'Bad Actors' in Iran

Facebook said it's found and removed hundreds more pages, organic content and ads meant to spread misinformation in the U.S. and abroad. However, while many of the "bad actors" in the past have been suspected to have come from Russia, the latest batch seems to have originated from another nation: Iran. In a blog post published last night, the social network said it removed 652 pages, groups and accounts targeting users not just in the U.S., but also in the Middle East, Latin America and the United Kingdom. Facebook credited the cybersecurity firm FireEye for a tip back in July about a network of pages called "Liberty Front Press," then led to an investigation by Facebook that found pages dating all the way back to 2013. "We are able to link this network to Iranian state media through publicly available website registration information, as well as the use of related IP addresses and Facebook Pages sharing the same admins," wrote Nathaniel Gleicher, Facebook's head of cybersecurity policy. "For example, one part of the network, 'Quest 4 Truth,' claims to be an independent Iranian media organization, but is in fact linked to Press TV, an English-language news network affiliated with Iranian state media." As a result of the investigation, Facebook found 74 pages, 70 accounts and three groups on Facebook, along with another 76 accounts on Instagram. About 155,000 Facebook accounts followed at least one of the pages, while 2,300 accounts joined at least one group. On Instagram, 48,000 users followed at least one of the bad actors' accounts. Meanwhile, more than $6,000 was spent on ads on Facebook and Instagram from January 2015 to August 2018, which Facebook said were paid for in both U.S. and Australian currency. The content found included English language text next to memes criticizing politicians including President Donald Trump while also promoting British Jeremy Corbyn—the British politician who has been in favor of Brexit—along with other content mocking the UK's decision to leave the European Union. Other content included Arabic text and featured images such as one of German Chancellor Angela Merkel shaking hands with Russia President Vladimir Putin. A second part of the investigation found another batch of accounts dating back to 2016, including 12 pages and 66 accounts on Facebook and another nine on Instagram. Among those, 15,000 accounts followed at least one Facebook page, while more than 1,100 followed at least one on Instagram. However, in this batch from "Liberty Front Press," Facebook found no ads or events created. On its website, FireEye also provided details of how it found and identified the actors on Facebook by tracing various accounts back to shared email addressed. "The activity we have uncovered highlights that multiple actors continue to engage in and experiment with online, social media-driven influence operations as a means of shaping political discourse," the company said in a blog post about the findings. "These operations extend well beyond those conducted by Russia, which has often been the focus of research into information operations over recent years. Our investigation also illustrates how the threat posed by such influence operations continues to evolve, and how similar influence tactics can be deployed irrespective of the particular political or ideological goals being pursued." Perhaps the largest number of inauthentic accounts were found in a third part of the investigation, which uncovered another 168 pages and 140 accounts on Facebook along with 31 accounts on Instagram. According to Facebook, about 813,000 users followed at least one Facebook page, while more than 10,000 followed at least one account on Instagram. On the advertising side, more than $6,000 was spent using U.S. dollars, Turkish lira and Indian rupees, with the first ads found dating back to 2012 and the last ending in April 2018. Facebook wasn't the only social network that has found and removed content from Iran. On Tuesday night, Twitter announced it had suspended 284 accounts for “engaging in coordinated manipulation.” The company’s own findings were based on an investigation that identified accounts based on phone numbers, email addresses, locations based in Iran. However, unlike much of the Russia-linked content on various platforms, Twitter said the Iranian-based actors seem to have originated after the 2016 presidential election. And unlike Facebook, Twitter said it has not yet discovered any advertising campaigns from the accounts. According to Twitter, the investigation is not yet finish, with the company expecting the update the total numbers in the future. YouTube also seems to have found and removed at least one Iranian account, according to The Washington Post. "As with prior investigations, we are committed to engaging with other companies and relevant law enforcement entities,” according to a tweet from Twitter’s safety team. "Our goal is to assist investigations into these activities and where possible, we will provide the public with transparency and context on our efforts." The most recent revelations come just weeks after Facebook announced it had found a variety of organic content and ads from "bad actors" of unknown origin aimed at spreading misinformation ahead of the 2018 midterm elections. On July 31, the company announced it had found and removed dozens of accounts that had spent around $11,000 on 150 ads. At the time, Facebook said it did not have enough information to say where the accounts originated. "We always know that our adversaries are going to get better and we’re going to have to get better," Facebook COO Sheryl Sandberg said last month. Along with the content originating from Iran, Facebook said it also removed pages, groups and accounts linked to sources already identified as coming from Russian military intelligence. However, that content did not target the U.S.