By Nathaniel Gleicher, Head of Cybersecurity Policy

Today we removed 51 Facebook accounts, 36 Pages, seven Groups and three Instagram accounts involved in coordinated inauthentic behavior that originated in Iran. The individuals behind this activity — which also took place on other internet platforms and websites — misled people about who they were and what they were doing. They purported to be located in the US and Europe, used fake accounts to run Pages and Groups, and impersonated legitimate news organizations in the Middle East. The individuals behind this activity also represented themselves as journalists or other personas and tried to contact policymakers, reporters, academics, Iranian dissidents and other public figures. A number of these account owners also attempted to contact authentic Instagram accounts, some of which later posted content associated with this activity.

The Page admins and account owners typically posted content in English or Arabic without a focus on a particular country, although some Pages focused on the US or UK. The posts from these Pages and accounts discussed topics like public figures and politics in the US and UK, US secessionist movements, Islam, Arab minorities in Iran and the influence of Saudi Arabia in the Middle East.

• Presence on Facebook and Instagram: 51 Facebook accounts, 36 Pages, seven Groups and three accounts on Instagram.
• Followers: About 21,000 accounts followed one or more of these Pages, about 1,900 accounts joined one or more of these Groups and around 2,600 people followed one or more of these Instagram accounts.

Based on a tip shared by FireEye, a US cybersecurity firm, we conducted an internal investigation into suspected Iran-linked coordinated inauthentic behavior and identified this activity. We’ve shared our analysis with law enforcement, policymakers and industry partners.

We’re constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. As is always the case with these takedowns, we’re removing these Pages, Groups and accounts based on their behavior, not the content they posted. In this case, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.

To ensure that we stay ahead in rooting out abuse, we’re investing heavily in building better technology, hiring more people and working more closely with law enforcement, security experts and other technology companies.

Below is a sample of the content posted by some of these Pages: