Facebook has for the first time discovered disinformation campaigns linked to Iran aimed at targeting misleading political content in the US and UK, as well as more fake Russian accounts.

The world’s largest social network said on Tuesday that it had deleted 652 pages, linked to three Iranian and one Russian campaign, that had been followed by hundreds of thousands of accounts. The owners of some pages linked to Iranian organisations had also bought advertising, despite US sanctions on Tehran that prevented Facebook from selling to accounts held in the country. Some accounts were five to seven years old. 

This is the first announcement of what Facebook calls “inauthentic behaviour” traced to Iran.

The news comes a day after Microsoft said it had uncovered an effort by hackers with links to the Kremlin to target Republican-leaning political groups, triggering alarm on Capitol Hill.

Mark Zuckerberg, Facebook’s founder and chief executive, said the social network was facing “sophisticated” and “well funded” adversaries. He added that the company’s investment in fighting such manipulation was beginning to pay off. 

“The shift we’ve made from reactive to proactive detection will make Facebook safer for everyone over time,” he said. Mr Zuckerberg added that several similar investigations were under way.

Facebook also said on Tuesday that it would now rate users on their trustworthiness, in a bid to halt the spread of misinformation by enlisting the help of members of the network.

The announcement came three weeks after Facebook said it had removed the first co-ordinated disinformation campaign targeting the US midterm congressional elections in November, which some American politicians identified as originating in Russia. The company did not specify there were any link with the latest fake accounts and the November vote.

In the first evidence of interference backed by Iran, Facebook said one campaign, which had created pages in 2013 primarily to propagate posts about the Middle East, had switched their focus to US and UK politics last year. Facebook said it was still investigating the content, but had discovered no “significant” advertising by the pages ahead of the Brexit referendum in 2016.

Senator Mark Warner, vice-chairman of the Senate intelligence committee, said he had been stating for months that social media manipulation was not restricted to a single troll farm in St Petersburg, referring to campaigns by the Internet Research Agency.

“We also learned today that the Iranians are now following the Kremlin’s playbook from 2016,” he said. “While I’m encouraged to see Facebook taking steps to rid their platforms of these bad actors, there’s clearly more work to be done.” 

Facebook said it had briefed the US Treasury and the state department because the Iranian accounts had been able to buy advertising. US sanctions allow companies to provide internet services to users in Iran for personal communications, but they are required to screen advertisers to ensure they are not in the country.

Twitter also said on Tuesday that it had removed 284 accounts that it believed had originated in Iran for engaging in “co-ordinated manipulation”. 

Facebook was alerted to suspicious activity by a set of pages under the name of Liberty Front Press by FireEye, a cyber security company, and then identified additional accounts and pages.

Lee Foster, manager of information operations analysis at FireEye, said the campaign aimed to promote political narratives in line with Iranian interests, including against Saudi Arabia and Israel, and in favour of Palestine.

“The activity we have uncovered is significant and demonstrates that actors beyond Russia continue to engage in online, social media-driven influence operations as a means of shaping political discourse,” he said. 

In the US, FireEye found accounts purporting to support Bernie Sanders, the US senator, and a fake organisation called Rise Against the Right. In the UK, the company discovered fabricated organisations called British Left and the British Progressive Front posting in support of Jeremy Corbyn, leader of the Labour party.

Facebook uncovered a network linked to Iranian state media, which included 74 pages, 70 Facebook accounts and 76 Instagram accounts. The accounts spent $6,000 on adverts on Facebook and Instagram, the photo-sharing app, and organised three events. 

A separate campaign that Facebook said it believed originated in Iran also engaged in cyber attacks, tried to hack into accounts and spread malicious software. A third campaign linked to Iran had more than 800,000 people following at least one of its pages, spent $6,000 on advertising and organised 25 events. 

The social network also uncovered another Russian disinformation campaign that was operated by people removed from the platform for cyber attacks before the 2016 elections. It was focused on Syria and Ukraine and did not target the US.

Facebook first investigated the activity in August 2017 and extended the probe in July this year. The company said removing campaigns early on in such investigations meant “it’s harder to understand their playbook and the extent of their network. It also limits our ability to co-ordinate with law enforcement, who often have investigations of their own.”

Get alerts on Facebook Inc when a new story is published

Copyright The Financial Times Limited 2019. All rights reserved.
Reuse this content (opens in new window)

Follow the topics in this article