By Nathaniel Gleicher, Head of Cybersecurity Policy
Today we removed 2,632 Pages, Groups and accounts that engaged in coordinated inauthentic behavior on Facebook and Instagram. The operations we found were connected to Iran, Russia, Macedonia and Kosovo. We didn’t find any links between these sets of activities, but they used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing.
We are constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. We’re taking down these Pages and accounts based on their behavior, not the content they posted. In each case, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.
While we are making progress rooting out this abuse, as we’ve said before, it’s an ongoing challenge because the people responsible are determined and well-funded. We constantly have to improve to stay ahead. That means building better technology, hiring more people and working more closely with law enforcement, security experts and other companies. Their collaboration was critical to these investigations.
We’ll update this post with more details when we have them, or if the facts change.
What We’ve Found So Far
Today we removed 513 Pages, Groups and accounts for engaging in coordinated inauthentic behavior as part of multiple networks tied to Iran. They operated in Egypt, India, Indonesia, Israel, Italy, Kashmir, Kazakhstan or broadly across the Middle East and North Africa. The Page administrators and account owners represented themselves as locals and made-up media entities, often using fake accounts – and they impersonated real political groups and media organizations. They posted news stories on current events and frequently repurposed and amplified content from Iranian state media about topics including sanctions against Iran; tensions between India and Pakistan; conflicts in Syria and Yemen; terrorism; tensions between Israel and Palestine; Islamic religious issues; Indian politics; and the recent crisis in Venezuela. Although the people behind this activity attempted to conceal their identities, our review linked these accounts to Iran.
Presence on Facebook and Instagram: 158 Pages, 263 Facebook accounts, 35 Groups and 57 Instagram accounts. Followers: About 1.4 million accounts followed one or more of these Pages, about 108,000 accounts joined at least one of these Groups and around 38,000 accounts followed one or more of these Instagram accounts. Advertising: Around $15,000 in spending for ads on Facebook paid for in US dollars, Indonesian rupiah, Indian rupees, Pakistan rupees, Swiss francs and Canadian dollars. The first ad ran in December 2013 and the most recent ad ran in February 2019. We have not completed a review of the organic content coming from these accounts.We identified some of these activities through our follow-on investigation into Iran-linked coordinated inauthentic behavior that we found and removed earlier this year. Our assessment benefited from open source reporting. We have shared information about our investigation with US law enforcement.
Below is a sample of the content posted by some of these Pages:
Caption: Palestine’s flag was fluttered at annual British Trade Union conference.
Headline: Iran is able to hinder hostile tactics
Image Text: Organizing and coordination between the UK and Zionist Regime on BBC Persian. According to information provided on the website of the British Parliament, Jenny Tonge, a member of the House of Lords of the British Parliament, has asked the Ministry of Defense why London has been using the Zionist Air Force to participate in the Cobra exercise, scheduled for this summer. A senior official in the United Kingdom recently said that the two sides are working closely together to confront Iran and Hezbollah in response to a question on military cooperation between London and Tel Aviv.
Caption: Amed News, lets cry blood, we will not forget you ever, Tehran, Mashahd, Shahin Najafi, Restart, Wednesday without suppression, White Wednesday, Human Echo, Celebrity
Image text: Neither, Ghaza nor Lebanon, my [soul] is for Iran
Caption: Viral: Iran’s fast boat threaten US aircraft carrier – For the real Muslims, don’t forget to give comment allahu akbar and click share
Headline: Venezuela praises rejection of the United States to Trump’s interference
Separately, we removed 1,907 Facebook Pages, Groups and accounts for engaging in spam – and a small portion of these engaged in coordinated inauthentic behavior – linked to Russia. The individuals behind these activities used fake accounts primarily to operate Groups and Pages posting spam content. Additionally, a small number of these posted content related to Ukrainian news and politics, including the ongoing conflict in the eastern part of Ukraine; local and regional politics; Ukrainian patriotism; refugee issues; Ukrainian military; the situation in Crimea; and corruption.
Presence on Facebook and Instagram: 86 Pages, 64 Facebook accounts and 1,757 Groups, largely engaging in spam activity. Followers: About 50,000 accounts followed one or more of these Pages and around 1.7 million accounts joined one or more of these Groups. Advertising: No ad spend was found associated with these accounts.We have shared information about our investigation with relevant law enforcement and policymakers.
Below is a sample of the content posted by some of these Pages:
Caption: Urgent! We are looking for candidates for the role of an information manager. FOR WOMEN! Work is remote and in your spare time, career opportunities. If you want to earn, you are from 18 to 60 y.o., you have average computer skills and internet access, then leave +++ in the comments or reach out in pm.
Caption: Just in! Average earnings project on monitoring from top-admin! Register here: [link]. Serious earnings with impressive turnover! It is your key for financial success! I can’t help but admire the way the platform works! Everything is fast, clear, with no delays, always on time! Pure pleasure! This project rocks! Worldwide exchange! Pays back! My deposit is 45,000 RUB….
Image Text: Earn from any spot in the world.
Headline: The number of children with autism is rising in Azerbaijan, but there are no specialists on this issue
Finally, we removed 212 Facebook Pages, Groups and accounts for engaging in coordinated inauthentic behavior that originated in Macedonia and Kosovo. The individuals behind this activity operated fake accounts to administer Pages sharing general, non-country specific content like astrology, celebrities and beauty tips. They also ran small number of Pages purporting to represent political communities in Australia, the United Kingdom and the United States – and posted about religious and political topics like nationalism, Islam, and political figures. Even though they tried to misrepresent themselves, we found that these Pages, Groups and accounts were linked to a network of individuals operating in Macedonia and Kosovo.
Our investigation benefited from open source reporting, including from the press in Australia. We have shared information about our investigation with relevant law enforcement and policymakers.
Below is a sample of the content posted by some of these Pages:
