Removing Coordinated Inauthentic Behavior From Iran

6 years ago

By Nathaniel Gleicher, Head of Cybersecurity Policy

Today we removed multiple Pages, groups and accounts that engaged in coordinated inauthentic behavior on Facebook and Instagram. This activity was directed from Iran, in some cases repurposing Iranian state media content, and engaged in coordinated inauthentic behavior targeting people across the world, although more heavily in the Middle East and South Asia. These were interconnected and localized operations, which used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing.

We are constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. We’re taking down these Pages, groups and accounts based on their behavior, not the content they post. In this case, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.

To ensure that we stay ahead in rooting out abuse we’re investing heavily in building better technology, hiring more people and working more closely with law enforcement, security experts and other technology companies. Their collaboration was critical to this investigation.

We’ll update this post with more details when we have them or if the facts change.

January 31, 2019
What We’ve Found So Far
By Nathaniel Gleicher, Head of Cybersecurity Policy

This morning we removed 783 Pages, groups and accounts for engaging in coordinated inauthentic behavior tied to Iran. There were multiple sets of activity, each localized for a specific country or region, including Afghanistan, Albania, Algeria, Bahrain, Egypt, France, Germany, India, Indonesia, Iran, Iraq, Israel, Libya, Mexico, Morocco, Pakistan, Qatar, Saudi Arabia, Serbia, South Africa, Spain, Sudan, Syria, Tunisia, US, and Yemen. The Page administrators and account owners typically represented themselves as locals, often using fake accounts, and posted news stories on current events. This included commentary that repurposed Iranian state media’s reporting on topics like Israel-Palestine relations and the conflicts in Syria and Yemen, including the role of the US, Saudi Arabia, and Russia. Some of the activity dates back to 2010. Although the people behind this activity attempted to conceal their identities, our manual review linked these accounts to Iran.

Presence on Facebook and Instagram: 262 Pages, 356 accounts, and 3 groups on Facebook, as well as 162 accounts on Instagram.
Followers: About 2 million accounts followed at least one of these Pages, about 1,600 accounts joined at least one of these groups, and more than 254,000 accounts followed at least one of these Instagram accounts.
Advertising: Less than $30,000 in spending for ads on Facebook and Instagram paid for primarily in US dollars, UK pounds, Canadian dollars, and euros. We have not completed our review of the organic content coming from these accounts.
Events: 8 events hosted. The first was scheduled for May 2014, and the most recent was scheduled for May 2018. Up to 210 people expressed interest in at least one of these events. We cannot confirm whether any of these events actually occurred.

We identified some of these accounts through our continued investigation into Iranian coordinated inauthentic behavior we found and removed last year. Our investigation was aided by open source reporting and information provided to us by our industry peers. We have shared information about our investigation with US law enforcement, the US Congress, and policymakers in impacted countries.

Below is a sample of the content posted by some of these Pages: