By Nathaniel Gleicher, Head of Cybersecurity Policy
Today, we removed four separate networks of accounts, Pages and Groups for engaging in coordinated inauthentic behavior on Facebook and Instagram. Three of them originated in Iran and one in Russia, and they targeted a number of different regions of the world: the US, North Africa and Latin America. All of these operations created networks of accounts to mislead others about who they were and what they were doing. We have shared information about our findings with law enforcement, policymakers and industry partners.
We’re constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. We’re taking down these Pages, Groups and accounts based on their behavior, not the content they posted. In each of these cases, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.
We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing challenge. We’re committed to continually improving to stay ahead. That means building better technology, hiring more people and working closer with law enforcement, security experts and other companies.
What We’ve Found So Far
Today, we removed 93 Facebook accounts, 17 Pages and four Instagram accounts for violating our policy against coordinated inauthentic behavior. This activity originated in Iran and focused primarily on the US, and some on French-speaking audiences in North Africa. The individuals behind this activity used compromised and fake accounts — some of which had already been disabled by our automated systems — to masquerade as locals, manage their Pages, join Groups and drive people to off-platform domains connected to our previous investigation into the Iran-linked “Liberty Front Press” and its removal in August 2018. The Page admins and account owners typically posted about local political news and geopolitics including topics like public figures in the US, politics in the US and Israel, support of Palestine and conflict in Yemen.
- Presence on Facebook and Instagram: 93 Facebook accounts, 17 Pages and 4 accounts on Instagram.
- Followers: About 7,700 accounts followed one or more of these Pages and around 145 people followed one or more of these Instagram accounts.
We found this activity as part of our internal investigations into Iran-linked, suspected coordinated inauthentic behavior.
Below is a sample of the content posted by some of these Pages:
We also removed 38 Facebook accounts, 6 Pages, 4 Groups and 10 Instagram accounts that originated in Iran and focused on countries in Latin America, including Venezuela, Brazil, Argentina, Bolivia, Peru, Ecuador and Mexico. The Page administrators and account owners typically represented themselves as locals, used fake accounts to post in Groups and manage Pages posing as news organizations, as well as directed traffic to off-platform domains. They frequently repurposed Iranian state media stories on topics like Hezbollah, conflict between Iran and Saudi Arabia, tensions between Israel and Palestine and Iran and the US, war in Yemen, as well as posted content tailored for a particular country including domestic news, geopolitics and public figures.
- Presence on Facebook and Instagram: 38 Facebook accounts, 6 Pages, 4 Groups and 10 accounts on Instagram.
- Followers: About 13,500 accounts followed one or more of these Pages, about 4,200 accounts joined at least one of these Groups and around 60,000 people followed one or more of these Instagram accounts.
We found this activity as part of our internal investigations into suspected coordinated inauthentic behavior linked to one of the Iran-linked networks we removed in August 2018.
Below is a sample of the content posted by some of these Pages:
Additionally, we removed a small network of four Facebook accounts, three Pages and seven Instagram accounts that originated in Iran and focused mainly on the US. The individuals behind this activity posed as locals and used fake accounts to manage Pages and an app, and also to drive people to an off-platform domain. Rather than posting directly to one of their Pages, they used the app whose sole purpose appeared to be pushing content to a Page called BLMNews that masqueraded as a news entity. The Page admins and account owners typically posted about political issues including topics like race relations in the US, criticism of US and Israel’s policy on Iran, the Black Lives Matter movement, African-American culture and the Iranian foreign policy.
- Presence on Facebook and Instagram: 4 Facebook accounts, 3 Pages and 7 accounts on Instagram.
- Followers: About 45 accounts followed one or more of these Pages and around 7,300 people followed one or more of these Instagram accounts.
- Advertising: Less than $2 in spending for ads on Facebook paid for in US dollars.
We identified this activity as part of our internal investigation into suspected coordinated inauthentic behavior, which was linked to some of the networks we removed in August 2018 and May 2019.
Below is a sample of the content posted by some of these Pages:
Finally, we removed 50 Instagram accounts and one account on Facebook that originated in Russia and focused primarily on the US. This campaign showed some links to the Internet Research Agency (IRA) and had the hallmarks of a well-resourced operation that took consistent operational security steps to conceal their identity and location. As we’ve seen before, this appears to have made it difficult for many of these accounts to build the following among authentic communities. The people behind this activity used fake accounts — some of which were previously detected and disabled by our automated systems as inauthentic and engaged in spam. These accounts followed, liked and occasionally commented on others’ posts to increase engagement on their own content. They primarily reused content shared across internet services by others, including screenshots of social media posts by news organizations and public figures. A small portion of these accounts also repurposed and modified old memes originally posted by the IRA. The people behind this operation often posted on both sides of political issues including topics like US elections, environmental issues, racial tensions, LGBTQ issues, political candidates, confederate ideas, conservatism and liberalism. They also maintained accounts presenting themselves as local in some swing states, and posed as either conservatives or progressives.
- Presence on Facebook and Instagram: 50 Instagram accounts and 1 account on Facebook.
- Followers: About 246,000 accounts followed one or more of these Instagram accounts (about 60% of which were in the US).
We detected this activity as part of our ongoing review of suspected coordinated inauthentic behavior ahead of US elections. We’ve shared information with our industry partners, policy makers and law enforcement and will continue working with others to find and remove this behavior.
Below is a sample of the content posted by some of these accounts:
