Facebook announced today they are taking down 652 pages, groups and fake accounts for "coordinated inauthentic behavior."
You can read all about it in the Facebook corporate blog post titled "Taking Down More Coordinated Inauthentic Behavior."
Yes, "Coordinated Inauthentic Behavior" is the language Facebook is using, instead of saying they're killing the pages for being fake, promoting fake news, or being part of a state-sponsored disinformation and cyberwar campaign.
The accounts Facebook nuked were from Russia and Iran, and targeted the U.S., UK, Middle East, and Latin America. They were discovered and purged as a result of an investigation based on a tip from the FireEye cybersecurity firm.
NYT:
The campaign's scale exceeded that of another influence operation that Facebook revealed last month, in which the company said it detected and removed 32 pages and fake accounts that had engaged in activity around divisive social issues ahead of the midterms.
Sen. Mark R. Warner (D-VA), Vice Chairman of the Senate Select Committee on Intelligence, issued the following statement today after Facebook's late-day announcement, which comes "just weeks ahead of the September 5th open hearing of the Senate Intelligence Committee with the leadership of Facebook, Twitter, and Google on the subject of social media manipulation."
"This is further evidence that foreign adversaries are actively using social media to divide Americans and undermine our democratic institutions," Warner says:
I've been saying for months that there's no way the problem of social media manipulation is limited to a single troll farm in St. Petersburg, and that fact is now beyond a doubt. We also learned today that the Iranians are now following the Kremlin's playbook from 2016. While I'm encouraged to see Facebook taking steps to rid their platforms of these bad actors, there's clearly more work to be done. I look forward to questioning the leadership of Facebook, Twitter, and Google about this at the Intelligence Committee's hearing on September 5th.
Here's the entire Facebook statement:
Today we removed multiple Pages, groups and accounts for coordinated inauthentic behavior on Facebook and Instagram. Some of this activity originated in Iran, and some originated in Russia. These were distinct campaigns and we have not identified any link or coordination between them. However, they used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing.
We ban this kind of behavior because we want people to be able to trust the connections they make on Facebook. And while we're making progress rooting out this abuse, as we've said before, it's an ongoing challenge because the people responsible are determined and well funded. We constantly have to improve to stay ahead. That means building better technology, hiring more people and working more closely with law enforcement, security experts and other companies. Their collaboration was critical to our investigation since no one company can fight this on their own.
There is always a tension between taking down these bad actors quickly and improving our defenses over the long term. If we remove them too early, it's harder to understand their playbook and the extent of their network. It also limits our ability to coordinate with law enforcement, who often have investigations of their own. It's why we've investigated some of these campaigns for many months and why we will continue working to find out more. We'll update this post with more details when we have them, or if the facts change.
What We've Found So Far
By Nathaniel Gleicher, Head of Cybersecurity Policy
We've removed 652 Pages, groups and accounts for coordinated inauthentic behavior that originated in Iran and targeted people across multiple internet services in the Middle East, Latin America, UK and US. FireEye, a cybersecurity firm, gave us a tip in July about "Liberty Front Press," a network of Facebook Pages as well as accounts on other online services. They've published an initial analysis and will release a full report of their findings soon. We wanted to take this opportunity to thank them for their work.
Based on FireEye's tip, we started an investigation into "Liberty Front Press" and identified additional accounts and Pages from their network. We are able to link this network to Iranian state media through publicly available website registration information, as well as the use of related IP addresses and Facebook Pages sharing the same admins. For example, one part of the network, "Quest 4 Truth," claims to be an independent Iranian media organization, but is in fact linked to Press TV, an English-language news network affiliated with Iranian state media. The first "Liberty Front Press" accounts we've found were created in 2013. Some of them attempted to conceal their location, and they primarily posted political content focused on the Middle East, as well as the UK, US, and Latin America. Beginning in 2017, they increased their focus on the UK and US. Accounts and Pages linked to "Liberty Front Press" typically posed as news and civil society organizations sharing information in multiple countries without revealing their true identity.
- Presence on Facebook and Instagram: 74 Pages, 70 accounts, and 3 groups on Facebook, as well as 76 accounts on Instagram.
- Followers: About 155,000 accounts followed at least one of these Pages, 2,300 accounts joined at least one of these groups, and more than 48,000 accounts followed at least one of these Instagram accounts.
- Advertising: More than $6,000 in spending for ads on Facebook and Instagram, paid for in US and Australian dollars. The first ad was run in Jan 2015, and the last was run in August 2018. Some ads have been blocked since the launch of our political ads transparency tools launched. We have not completed our review of the organic content coming from these accounts.
- Events: 3 events hosted.
The second part of our investigation found links between "Liberty Front Press" and another set of accounts and Pages, the first of which was created in 2016. They typically posed as news organizations and didn't reveal their true identity. They also engaged in traditional cybersecurity attacks, including attempts to hack people's accounts and spread malware, which we had seen before and disrupted.
- Presence on Facebook and Instagram: 12 Pages and 66 accounts on Facebook, as well as 9 accounts on Instagram.
- Followers: About 15,000 accounts followed at least one of these Pages and more than 1,100 followed at least one of these Instagram accounts.
- Advertising: We have found no advertising associated with these accounts or Pages. We have not completed our review of the organic content from these accounts.
- Events: We have found no events associated with these accounts or Pages.
The third part of our investigation uncovered another set of accounts and Pages, the first of which was created in 2011, that largely shared content about Middle East politics in Arabic and Farsi. They also shared content about politics in the UK and US in English. We first discovered this set in August 2017 and expanded our investigation in July 2018 as we stepped up our efforts ahead of the US midterm elections.
- Presence on Facebook and Instagram: 168 Pages and 140 accounts on Facebook, as well as 31 accounts on Instagram.
- Followers: About 813,000 accounts followed at least one of these Pages and more than 10,000 followed at least one of these Instagram accounts.
- Advertising: More than $6,000 in spending for ads on Facebook and Instagram, paid for in US dollars, Turkish lira, and Indian rupees. The first ad was run in July 2012, and the last was run in April 2018. We have not completed our review of the organic content coming from these accounts.
- Events: 25 events hosted.
We're still investigating, and we have shared what we know with the US and UK governments. Since there are US sanctions involving Iran, we've also briefed the US Treasury and State Departments. These sanctions allow companies to provide people internet services for personal communications, including the government and its affiliates. But Facebook takes steps to prevent people in Iran and other sanctioned countries from using our ad tools. For example, our systems screen every advertiser to identify their current location and whether they're named on the US government's list of sanctioned individuals. Based on what we learn in this investigation and from government officials, we'll make changes to better detect people who try to evade our sanctions compliance tools and prevent them from advertising.
Finally, we've removed Pages, groups and accounts that can be linked to sources the US government has previously identified as Russian military intelligence services. This is unrelated to the activities we found in Iran. While these are some of the same bad actors we removed for cybersecurity attacks before the 2016 US election, this more recent activity focused on politics in Syria and Ukraine. For example, they are associated with Inside Syria Media Center, which the Atlantic Council and other organizations have identified for covertly spreading pro-Russian and pro-Assad content. To date, we have not found activity by these accounts targeting the US.
We're working closely with US law enforcement on this investigation, and we appreciate their help. These investigations are ongoing – and given the sensitivity we aren't sharing more information about what we removed.
