By Nathaniel Gleicher, Head of Cybersecurity Policy
Today we removed 2,632 Pages, Groups and accounts that engaged in coordinated inauthentic behavior on Facebook and Instagram. The operations we found were connected to Iran, Russia, Macedonia and Kosovo. We didn’t find any links between these sets of activities, but they used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing.
We are constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. We’re taking down these Pages and accounts based on their behavior, not the content they posted. In each case, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.
While we are making progress rooting out this abuse, as we’ve said before, it’s an ongoing challenge because the people responsible are determined and well-funded. We constantly have to improve to stay ahead. That means building better technology, hiring more people and working more closely with law enforcement, security experts and other companies. Their collaboration was critical to these investigations.
We’ll update this post with more details when we have them, or if the facts change.
What We’ve Found So Far
Today we removed 513 Pages, Groups and accounts for engaging in coordinated inauthentic behavior as part of multiple networks tied to Iran. They operated in Egypt, India, Indonesia, Israel, Italy, Kazakhstan or broadly across the Middle East and North Africa. The Page administrators and account owners represented themselves as locals and made-up media entities, often using fake accounts — and they impersonated real political groups and media organizations. They posted news stories on current events and frequently repurposed and amplified content from Iranian state media about topics including sanctions against Iran; tensions between India and Pakistan; conflicts in Syria and Yemen; terrorism; tensions between Israel and Palestine; Islamic religious issues; Indian politics; and the recent crisis in Venezuela. Although the people behind this activity attempted to conceal their identities, our review linked these accounts to Iran. [Updated on March 27, 2019 at 6:02AM PT to delete a reference to ‘Kashmir’ that was incorrectly included in the initial list of countries and regions targeted by the Iranian network.]
- Presence on Facebook and Instagram: 158 Pages, 263 Facebook accounts, 35 Groups and 57 Instagram accounts.
- Followers: About 1.4 million accounts followed one or more of these Pages, about 108,000 accounts joined at least one of these Groups and around 38,000 accounts followed one or more of these Instagram accounts.
- Advertising: Around $15,000 in spending for ads on Facebook paid for in US dollars, Indonesian rupiah, Indian rupees, Pakistan rupees, Swiss francs and Canadian dollars. The first ad ran in December 2013 and the most recent ad ran in February 2019. We have not completed a review of the organic content coming from these accounts.
We identified some of these activities through our follow-on investigation into Iran-linked coordinated inauthentic behavior that we found and removed earlier this year. Our assessment benefited from open source reporting. We have shared information about our investigation with US law enforcement.
Below is a sample of the content posted by some of these Pages:
Image text: Neither, Ghaza nor Lebanon, my [soul] is for Iran
Separately, we removed 1,907 Facebook Pages, Groups and accounts for engaging in spam — and a small portion of these engaged in coordinated inauthentic behavior — linked to Russia. The individuals behind these activities used fake accounts primarily to operate Groups and Pages posting spam content. Additionally, a small number of these posted content related to Ukrainian news and politics, including the ongoing conflict in the eastern part of Ukraine; local and regional politics; Ukrainian patriotism; refugee issues; Ukrainian military; the situation in Crimea; and corruption.
- Presence on Facebook and Instagram: 86 Pages, 64 Facebook accounts and 1,757 Groups, largely engaging in spam activity.
- Followers: About 50,000 accounts followed one or more of these Pages and around 1.7 million accounts joined one or more of these Groups.
- Advertising: No ad spend was found associated with these accounts.
We have shared information about our investigation with relevant law enforcement and policymakers.
Below is a sample of the content posted by some of these Pages:
Image Text: Earn from any spot in the world.
Finally, we removed 212 Facebook Pages, Groups and accounts for engaging in coordinated inauthentic behavior that originated in Macedonia and Kosovo. The individuals behind this activity operated fake accounts to administer Pages sharing general, non-country specific content like astrology, celebrities and beauty tips. They also ran small number of Pages purporting to represent political communities in Australia, the United Kingdom and the United States — and posted about religious and political topics like nationalism, Islam, and political figures. Even though they tried to misrepresent themselves, we found that these Pages, Groups and accounts were linked to a network of individuals operating in Macedonia and Kosovo.
- Presence on Facebook and Instagram: 40 Pages and 172 Facebook accounts.
- Followers: About 685,000 accounts followed one or more of these Pages.
- Advertising: Around $5,800 in spending for ads on Facebook paid for in US dollars, euros, pounds and Philippine pesos. The first ad ran in October 2013 and the most recent ad ran in March 2019. We have not completed a review of the organic content coming from these accounts.
Our investigation benefited from open source reporting, including from the press in Australia. We have shared information about our investigation with relevant law enforcement and policymakers.
Below is a sample of the content posted by some of these Pages:
