Facebook Removes 652 Accounts Linked To "Inauthentic Behavior" Originating In Iran And Russia

Facebook said late on Tuesday that it had removed multiple pages, groups and accounts for "coordinated inauthentic behavior" on its site and on Instagram. The company said in a long blog post  that it removed 652 pages, groups and accounts from activities that originated in Iran and "targeted people across multiple internet services in the Middle East, Latin America, UK and US." Facebook noted that the activity appears to reflect increasing attempts by the Iranian regime to push its geopolitical agenda through online subterfuge.

Facebook said that they were acting based on a tip from a cybersecurity firm FireEye, known for its work in exposing "Russian hackers" and funding the controversial Center for European Policy Analysis. Some of the Iranian accounts and pages were created as far back as 2011, Facebook said.

Separately, Facebook also took down an unspecified number of accounts and pages that it said originated in Russia. While much of Russia’s alleged activity on Facebook in the past has centered on U.S. social issues, the bad actors identified in the latest purge were focused on politics in Syria and Ukraine.

"Finally, we’ve removed Pages, groups and accounts that can be linked to sources the US government has previously identified as Russian military intelligence services,” the social media giant wrote in bold text. It provided no number of removed accounts, when exactly they were blocked, or any details of their alleged wrongdoings. The company only said that some of these accounts are believed to be "associated with Inside Syria Media Center," which, according to the Atlantic Council aka the academic wing of NATO, is “covertly spreading pro-Russian and pro-Assad content.”

Facebook said it found no evidence the campaigns by Russia and Iran were connected.

"We’ve been investigating some of these campaigns for months now, which highlights the tension we face in every investigation between removing bad actors quickly and improving our defenses over time,” Chief Executive Mark Zuckerberg said during a hastily scheduled conference call with reporters late Tuesday. “Because if we remove them too early, it’s harder to understand their playbook and the extent of their network. It can also make it harder for law enforcement."

Zuckerberg said the action announced Tuesday reflected the firm’s "newfound approach" to finding and stamping out fake activity. "The shift we made from reactive to proactive detection is a big change, and it’s going to make Facebook safer for everyone over time,” the CEO told reporters.

Facebook’s allegation that the offenders were tied to Russia and Iran marks a departure from July when it announced a purge of 32 pages and was reluctant to assign responsibility for the content it pulled from the platform. On Tuesday, executives reiterated they couldn’t attribute last month’s campaign to any actor.

“We’re still investigating and there’s a lot that we don’t know yet,” Mr. Zuckerberg said. “As a company, we don’t have all the investigative tools and intelligence that governments have, which makes it hard to always attribute a particular abuse to particular countries or groups.”

Facebook’s account closures came one day after Microsoft said Russian hackers linked to the 2016 election cyberattacks on the Democratic Party are broadening their efforts to target U.S. politics ahead of the midterms to include well-connected conservative groups.

Facebook refused to speculate on the motive of the Iranian or Russian campaigns during the press call with reporters. Lee Foster, a researcher with FireEye who worked on the Iran investigation, said the pages sought to promote Tehran’s interests, including "anti-Saudi, anti-Israeli and pro-Palestinian themes."

There was no mention of any accounts deleted for promoting pro-Saudi, pro-Israeli and anti-Palestinian themes.

Nearly simultaneously, in a tweet posted to a corporate account, Twitter announced that it was "working with our industry peers today, we have suspended 284 accounts from Twitter for engaging in coordinated manipulation. Based on our existing analysis, it appears many of these accounts originated from Iran."

It “appears many of these accounts originated from Iran,” the Twitter message states as Iran has now clearly become the media's new bogeyman.

Facebook said it had shared its findings with both the U.S. and British governments on the Iranian activity and the U.S. treasury and state departments about Iran’s activity.

According to the WSJ, Senator Richard Burr (R., N.C.), who chairs the Senate Intelligence Committee that has been investigating online influence operations, said Facebook’s disclosure further reflected that foreign actors wanted to use social media to sow political discord and that “Russia is not the only hostile foreign actor developing this capability.”

Mr. Burr said he intended to discuss the foreign operations with Sheryl Sandberg, Facebook’s chief operating officer, when she testified before his panel in early September.

In other words, if the midterm elections produce an outcome that is the opposite of what the media broadly expects, this time it will be Iran's fault.