Facebook Shuts 652 Iran-Backed Accounts Linked In Global Disinformation Campaign

Aug 21, 2018
Originally published on August 22, 2018 9:31 am

Updated at 9:45 p.m. ET

Facebook has taken down 652 accounts, pages and groups that originated in Iran. The accounts were used for political disinformation and targeted at users in the Middle East, Latin America, the UK and the U.S., according to Facebook.

This is the first announcement of this magnitude from Facebook about a coordinated influence campaign from Iran. Twitter followed soon after, saying it too had suspended 284 accounts "for engaging in coordinated manipulation." Those accounts too appeared to originate in Iran.

Facebook said it was tipped off by the cybersecurity firm FireEye, which said the network of accounts across social media platforms pushed "narratives [that] include anti-Saudi, anti-Israeli, and pro-Palestinian themes, as well as support for specific U.S. policies favorable to Iran," such as the U.S.-Iran nuclear deal.

"The activity we have uncovered is significant, and demonstrates that actors beyond Russia continue to engage in and experiment with online, social media-driven influence operations to shape political discourse," FireEye said in its initial report.

The accounts shut down by Facebook altogether had at least 813,000 followers and posted in English, Arabic and Farsi. They falsely posed as news and civil society organizations to spread political disinformation and ran at least $12,000 worth of ads on Facebook and Instagram.

Facebook says it was able to draw a link between a part of the network called "Liberty Front Press" to Iranian state media. Its first accounts date back to 2013.

Another subset of the network dates back to 2016 and was "also engaged in traditional cybersecurity attacks, including attempts to hack people's accounts and spread malware," according to Facebook.

Separately, Facebook also said it removed an unspecified number of accounts linked to the Russian military intelligence services.

Facebook said the campaign originating from Iran and Russia did not appear to be linked or coordinated with each other, but "used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing."

In July, Facebook shut down 32 Russia-linked accounts and pages on Facebook and Instagram.

The Facebook news comes on the same day that Microsoft revealed that a Russian military intelligence unit had targeted conservative American think tanks. Microsoft said it had shut down 84 fake websites associated with this group in just two years.

Facebook said it is still investigating these findings, and has shared the information with the U.S. and UK governments. Due to U.S. sanctions involving Iran, the company has also briefed the U.S. Treasury and State Departments.



We're learning more today about ongoing cyberattacks against political targets in the United States. We've been talking a lot about how Russia has been involved in disinformation campaigns, but now they're not the only state actor that has been accused by a major U.S. tech company of these types of efforts. Facebook said tonight that it has discovered and disrupted an Iranian disinformation campaign on its network. That is in addition to a new Russian disinformation campaign.

NPR political reporter Tim Mak is on this story, and he joins us now. Welcome.

TIM MAK, BYLINE: Thank you.

CHANG: So can you just start us off by telling us, exactly what did Facebook discover tonight?

MAK: So Facebook says it has taken down a coordinated network of pages originating in Iran and targeting users in the Middle East, in Latin America, the U.K. and the United States. And so this campaign involves some 652 pages with close to a million Facebook followers and thousands of dollars of advertising buys.

So these Facebook and Instagram accounts - they did a number of things. They pretended to be an independent Iranian media organization while actually linking back to Iranian state media. In other parts of the network, they falsely posed as news and civil society organizations to spread political disinformation. And this campaign also involved more traditional kind of cyberattacks. This is like attempted hacking and efforts to spread what we call malware. The network of accounts also pushed narratives that include anti-Saudi, anti-Israeli, pro-Palestinian themes as well as support for specific American policies favorable to Iran.

CHANG: So how did Facebook find out that these campaigns were even happening?

MAK: It's interesting. They were originally tipped off not by kind of their internal security processes but by FireEye, a third-party cybersecurity firm. And so Facebook launched an investigation, and they revealed hundreds of these Iranian-linked accounts. Facebook has also been emphasizing its work with American law enforcement, and it shared the information about this disinformation campaign that it has discovered with the U.K. and American governments. Also because Iran is currently subject to some pretty strict sanctions, Facebook has briefed the Treasury and State Departments on what they found through the investigation that they announced this evening.

CHANG: Now, hasn't much of this kind of activity been connected to Russia usually?

MAK: Yeah, we've talked a lot about...


MAK: ...Russian disinformation.

CHANG: Over and over again.

MAK: And what it looks like now is that the Iranian campaign took a page out of Russia's playbook, that, you know - and we know that not - that Facebook tonight announced not just an Iranian campaign because that - I mean, that is what is new about...

CHANG: Right.

MAK: ...What we're learning today. But they also announced that it's - that Facebook has disrupted new Russian accounts. I mean, we talked three weeks ago when Facebook shut down more than 30 Russian accounts. It had a massive scope and following that seems similar to what Iranians have done in this case. Separately, Microsoft in a separate announcement - they said that they had shut down an attempted attack on conservative think tanks and the U.S. government by a Russian hacking group called Fancy Bear. So here's Senator Lindsey Graham at a cybersecurity hearing this afternoon.


LINDSEY GRAHAM: America is under cyberattack. We're beginning to act but not quick enough and not forcefully enough.

CHANG: Does it seem like there will be more cyberattacks going forward this year? I mean, are you getting any sense of that in your reporting?

MAK: Yeah. Senator Mark Warner said that there's a lot of tech companies lining up essentially to disrupt some of these campaigns by state actors. We'll see that over and over again probably in the coming months as we approach the midterm elections. We're - what we're worried about is not only Russian cyber operations, not only Iranian cyber operations but possibly from North Korea and China as well.

CHANG: That's NPR's Tim Mak. Thank you.
