Facebook Shuts Down Coordinated Inauthentic Behavior From Iran

facebook cyber security

By Pooya Stone

Social media giant Facebook announced Monday on its blog that it had shut down accounts belonging to Iran and Russia-backed disinformation campaigns and that the company will do more to protect accounts of elected officials and political candidates.

Facebook on Monday announced it had removed four separate networks of interconnected accounts, groups, and pages engaged in “coordinated inauthentic behavior” across Facebook and Instagram. This included nearly 200 accounts with more than 250,000 followers around the world.

These account networks intentionally spread divisive content aimed at the United States, Latin America, and parts of North Africa. Facebook said three of the networks originated in Iran.

Facebook also said: “Today, we removed 93 Facebook accounts, 17 Pages and four Instagram accounts for violating our policy against coordinated inauthentic behavior. This activity originated in Iran and focused primarily on the US, and some on French-speaking audiences in North Africa.”

The individuals behind this activity used compromised and fake accounts — some of which had already been disabled by our automated systems — to masquerade as locals, manage their Pages, join Groups and drive people to off-platform domains connected to our previous investigation into the Iran-linked “Liberty Front Press” and its removal in August 2018.

“The Page admins and account owners typically posted about local political news and geopolitics including topics like public figures in the US, politics in the US and Israel, support of Palestine and conflict in Yemen.”

The head of Facebook’s Cybersecurity policy continued: “We also removed 38 Facebook accounts, 6 Pages, 4 Groups and 10 Instagram accounts that originated in Iran and focused on countries in Latin America, including Venezuela, Brazil, Argentina, Bolivia, Peru, Ecuador, and Mexico. The Page administrators and account owners typically represented themselves as locals, used fake accounts to post in Groups and manage Pages posing as news organizations, as well as directed traffic to off-platform domains. They frequently repurposed Iranian state media stories on topics like Hezbollah, the conflict between Iran and Saudi Arabia, tensions between Israel and Palestine and Iran and the US, the war in Yemen, as well as posted content tailored for a particular country including domestic news, geopolitics, and public figures.

  • Presence on Facebook and Instagram: 38 Facebook accounts, 6 Pages, 4 Groups and 10 accounts on Instagram.
  • Followers: About 13,500 accounts followed one or more of these pages, about 4,200 accounts joined at least one of these Groups and around 60,000 people followed one or more of these Instagram accounts.

We found this activity as part of our internal investigations into suspected coordinated inauthentic behavior linked to one of the Iran-linked networks we removed in August 2018.”