Facebook has removed 652 fake accounts and pages with ties to Russia and Iran attempting to exert political influence in the US, UK, Middle East and Latin America.

The accounts and pages were divided between four separate campaigns, three of which originated in Iran, of “coordinated inauthentic behaviour”, disclosed by the social network today.

“Security is not something you ever fully solve,” said the Facebook CEO, Mark Zuckerberg, in a call with reporters on Tuesday. “We have to constantly keep improving to stay ahead.”

The first campaign involved a network of Facebook pages and accounts on other platforms under the banner “Liberty Front Press” that positioned themselves as independent but were discovered to have ties to Iranian state media. The 74 pages, 70 accounts and three groups on Facebook and 76 Instagram accounts – some dating back to 2013 – posted political content focused on the Middle East, UK, US and Latin America. The pages had about 155,000 followers in total. The same group spent more than $6,000 on Facebook and Instagram ads paid for in US dollars, the last one running in August 2018.

The cybersecurity company FireEye, which first identified the campaign and flagged the campaign to Facebook, said the intent behind the activity appeared to be to “promote Iranian political interests, including anti-Saudi, anti-Israel and pro-Palestinian themes, as well as promote support for specific US policies favorable to Iran, such as the US-Iran nuclear deal”. There was also significant anti-Trump messaging and the creation of sock puppet accounts masquerading as liberal Americans.

FireEye noted that the activity did not appear to have been specifically designed to influence the US midterm elections as the content extended beyond US audiences and politics.

The second campaign was linked to the first one and involved 12 pages and 66 accounts on Facebook and nine on Instagram. The inauthentic accounts posed as news organisations and engaged in cybersecurity attacks, including attempting to hack accounts and spread malware.

The third Iranian campaign comprised 168 pages and 140 accounts on Facebook, and 31 on Instagram. They collectively hosted 25 events and about 813,000 Facebook users followed at least one of the pages. Facebook said the campaign mostly shared content about Middle East politics in Arabic and Farsi, but also shared content about politics in the UK and US. This group of accounts spent more than $6,000 in ads paid in US dollars, Turkish lira and Indian rupees between July 2012 and April 2018.

Facebook was most vague about the fourth and final campaign, a collection of pages, groups and accounts linked to the Russian military intelligence services – with no links to the Iranian campaigns. These included some of the same bad actors removed before the 2016 US election, but the focus of their recent activity was spreading pro-Russia messaging relating to Syria and Ukraine.

“To date, we have not found activity by these accounts targeting the US,” said Nathaniel Gleicher, head of cybersecurity policy.

Facebook would not provide any more information about the nature of the Iranian and Russian content, but said that it had briefed the US and UK governments.

“These investigations are ongoing – and given the sensitivity we aren’t sharing more information about what we removed,” Gleicher said.

Today’s announcement comes less than a month after the social network deleted 32 pages and accounts attempting to influence the US midterm elections. The accounts pushed American political stances and organised events, including a protest against a Unite the Right rally in Washington.

Facebook could not conclusively attribute the campaign to Russia, but said that the accounts showed “similar activity” and connections to other accounts associated with the Kremlin-linked Internet Research Agency.

 
• Facebook
 
• fake_accounts