Removing Coordinated Inauthentic Behavior From Iran

By Nathaniel Gleicher, Head of Cybersecurity Policy

Today we removed multiple Pages, groups and accounts that engaged in coordinated inauthentic behavior on Facebook and Instagram. This activity was directed from Iran, in some cases repurposing Iranian state media content, and engaged in coordinated inauthentic behavior targeting people across the world, although more heavily in the Middle East and South Asia. These were interconnected and localized operations, which used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing.

We are constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. We’re taking down these Pages, groups and accounts based on their behavior, not the content they post. In this case, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.

To ensure that we stay ahead in rooting out abuse we’re investing heavily in building better technology, hiring more people and working more closely with law enforcement, security experts and other technology companies. Their collaboration was critical to this investigation.

We’ll update this post with more details when we have them or if the facts change.

January 31, 2019
What We’ve Found So Far
By Nathaniel Gleicher, Head of Cybersecurity Policy

This morning we removed 783 Pages, groups and accounts for engaging in coordinated inauthentic behavior tied to Iran. There were multiple sets of activity, each localized for a specific country or region, including Afghanistan, Albania, Algeria, Bahrain, Egypt, France, Germany, India, Indonesia, Iran, Iraq, Israel, Libya, Mexico, Morocco, Pakistan, Qatar, Saudi Arabia, Serbia, South Africa, Spain, Sudan, Syria, Tunisia, US, and Yemen. The Page administrators and account owners typically represented themselves as locals, often using fake accounts, and posted news stories on current events. This included commentary that repurposed Iranian state media’s reporting on topics like Israel-Palestine relations and the conflicts in Syria and Yemen, including the role of the US, Saudi Arabia, and Russia. Some of the activity dates back to 2010. Although the people behind this activity attempted to conceal their identities, our manual review linked these accounts to Iran.

Presence on Facebook and Instagram: 262 Pages, 356 accounts, and 3 groups on Facebook, as well as 162 accounts on Instagram. Followers: About 2 million accounts followed at least one of these Pages, about 1,600 accounts joined at least one of these groups, and more than 254,000 accounts followed at least one of these Instagram accounts. Advertising: Less than $30,000 in spending for ads on Facebook and Instagram paid for primarily in US dollars, UK pounds, Canadian dollars, and euros. We have not completed our review of the organic content coming from these accounts. Events: 8 events hosted. The first was scheduled for May 2014, and the most recent was scheduled for May 2018. Up to 210 people expressed interest in at least one of these events. We cannot confirm whether any of these events actually occurred.

We identified some of these accounts through our continued investigation into Iranian coordinated inauthentic behavior we found and removed last year. Our investigation was aided by open source reporting and information provided to us by our industry peers. We have shared information about our investigation with US law enforcement, the US Congress, and policymakers in impacted countries.

Below is a sample of the content posted by some of these Pages:

Agreement between Tunisia and Algeria to remove the tariff of phone calls between the two countries. When this is takes place, Algerians will be able to use thier Algerian phones in Tunisia with no extra payment and with the same rate.

More than 300 women went out on a march in Saudi in a campaign called “Hiking Saudi” to encourage women to join sports.

“We are all Maryam. Al Quds is Palestine’s eternal capital.”

How is Syria resisting Israel with the support of Russia.

Iranian foreign minister: UAE is entering a new phase of unacceptable behavior

“I do not recognize Israel at all”

Reporting on an emergency session held by the UN to discuss the results reached at the Tehran tripartite summit regarding the situation in the province of Idlib in northern Syria.

Report on “Geopolitis,” a TV show on RTS that showed a documentary, “Libya – Anatomy of Crime” that discussed human rights violations over the seven years after the fall of Muammar Gaddafi, specifically investigating into cases of rape of men inside prisons across the country.

“Tens of millions of dollars went up in flames. Watch the footage: Mechanic accidentally fired from an airplane – and destroyed an F-16 /////////////////// * Link in Bio * ////////////////”

“The deal of the century!”

Khaled Abu Hilal the Secretary General of Ahrar Movement to Shihab: Any government formed by Mahmoud Abbas should be presented to the Knesset because it does not represent the Palestinian people.

EuroNews reported that Taliban rescued people after the snow collapse, which killed more than 100 Afghans.

 

Read more about our investigations into cyber threats and information operations.