Facebook pulls hundreds of fake accounts engaged in co-ordinated influence campaign
Inauthentic behaviour flagged on 652 accounts and pages
Facebook Inc. dismantled a new set of influence campaigns originating in Iran and Russia designed to sow division in global politics, part of the social-media company’s broader purge of bad actors on its site.
Those originating in Iran, a total of 652 pages and accounts, were flagged for “coordinated inauthentic behavior” and targeted internet services in the U.S., Middle East, U.K. and Latin America.
The activity appears to reflect increasing attempts by the Iranian regime to push its geopolitical agenda through online subterfuge.
Facebook separately took down an unspecified number of accounts and pages that it said originated in
Russia.
While much of Russia’s alleged activity on Facebook in the past has centered on U.S. social issues, the bad actors identified in the latest purge were focused on politics in Syria and Ukraine.
Facebook said it found no evidence the campaigns by Russia and Iran were connected.
“We’ve been investigating some of these campaigns for months now, which highlights the tension we face in every investigation
between removing bad actors quickly and improving our defenses over time,”
Chief Executive Mark Zuckerberg said during a hastily scheduled conference call with reporters late Tuesday.
“Because if we remove them too early, it’s harder to understand their playbook and the extent of their network. It can also make it harder for law enforcement.”
Mr. Zuckerberg said the action announced Tuesday reflected the firm’s newfound approach to finding and stamping out fake activity.
“The shift we made from reactive to proactive detection is a big change, and it’s going to make Facebook safer for everyone over time,” he told reporters.
Facebook’s allegation that the offenders were tied to Russia and Iran marks a departure from last month when it announced a purge of 32 pages and was reluctant to assign responsibility for the content it pulled from the platform. On Tuesday, executives reiterated they couldn’t attribute last month’s campaign to any actor.
“We’re still investigating and there’s a lot that we don’t know yet,” Mr. Zuckerberg said. “As a company, we don’t have all the investigative tools and intelligence that governments have, which makes it hard to always attribute a particular abuse to particular countries or groups.”
Facebook’s new disclosures come just a day after Microsoft Corp said Russian hackers linked to the 2016 election cyberattacks on the Democratic Party are broadening their efforts to target U.S. politics ahead of the midterms to include well-connected conservative groups.
Facebook first learned about a network of bogus Iranian pages from U.S.-based cybersecurity firm FireEye. Using FireEye’s tip, Facebook said it was able to identify additional accounts and pages that were spreading disinformation and link the activity to Iranian state media by checking against website registration information, among other indicators.
Some of the Iranian accounts and pages were created as far back as 2011, Facebook said.
Facebook officials were reticent to speculate on motive of the Iranian or Russian campaigns during a press call with reporters. Lee Foster, a researcher with FireEye who worked on the Iran investigation, said the pages sought to promote Tehran’s interests, including “antiSaudi, anti-Israeli and pro-Palestinian themes.”
Facebook executives said they expect to find more bad activity. “We have a number of investigations going on, and we’ll update you when we know more,” Mr. Zuckerberg said.
FireEye said it also identified suspicious behavior on Twitter.
In a tweet posted to a corporate account, Twitter said on Tuesday that it has suspended 284 accounts “for engaging in coordinated manipulation.”
It “appears many of these accounts originated from Iran,” the Twitter message states.
A Twitter spokesman declined to comment further, saying the company will post further updates when it has more to say.
Iran for years has been seen as increasingly adept at using social media to deploy phishing schemes or other malicious acts, often relying on elaborately created fake online personas to ensnare targets, according to cybersecurity researchers. The country is frequently cited by U.S. intelligence officials as among the four most hostile and advanced nation-state cyberthreats alongside Russia, China and North Korea.
Facebook said it had shared its findings with both the U.S. and British governments on the Iranian activity and the U.S. treasury and state departments about Iran’s activity.
Senator Richard Burr (R., N.C.), who chairs the Senate Intelligence Committee that has been investigating online influence operations, said that Facebook’s disclosure further reflected that foreign actors wanted to use social media to sow political discord and that “Russia is not the only hostile foreign actor developing this capability.”
Mr. Burr said he intended to discuss the foreign operations with Sheryl Sandberg, Facebook’s chief operating officer, when she testified before his panel in early September. Robert McMillan contributed to this article.