Facebook Removes Fake Iranian Government-Connected Accounts

In late Octo­ber, Face­book announced that it had removed a net­work of Iran­ian gov­ern­ment-con­nect­ed accounts on Face­book, and Insta­gram said to have tar­get­ed main­ly the US and Israel. Accord­ing to the announce­ment:

Octo­ber 27, 2020 Today we removed three sep­a­rate net­works for vio­lat­ing our pol­i­cy against coor­di­nat­ed inau­then­tic behav­ior (CIB). Two of these net­works tar­get­ed the Unit­ed States, among oth­er coun­tries, and one net­work orig­i­nat­ed in and tar­get­ed domes­tic audi­ences in Myan­mar. In each case, the peo­ple behind this activ­i­ty coor­di­nat­ed with one anoth­er and used fake accounts as a cen­tral part of their oper­a­tions to mis­lead peo­ple about who they are and what they are doing, and that was the basis for our action. When we inves­ti­gate and remove these oper­a­tions, we focus on behav­ior rather than con­tent, no mat­ter who’s behind them, what they post, or whether they’re for­eign or domestic.

Accord­ing to its Octo­ber 2020 Coor­di­nat­ed Inau­then­tic Behav­ior Report, the inves­ti­ga­tion was based on the FBI’s infor­ma­tion, and the net­work was found to have links to anoth­er Iran­ian gov­ern­ment net­work removed in April. The first fake account was part of a US elec­tion-relat­ed influ­ence oper­a­tion car­ried out pri­mar­i­ly via email, which attempt­ed to seed false claims and unsub­stan­ti­at­ed threats. This led to the expo­sure of addi­tion­al dor­mant accounts and pages con­nect­ed to Israel, Afghanistan, Sau­di Ara­bia, and oth­ers. The announce­ment explains:

This oper­a­tion used fake accounts — some of which had been already detect­ed and removed by our auto­mat­ed sys­tem. Some of these accounts tried to con­tact oth­ers, includ­ing an Afghanistan-focused media out­let, to spread their infor­ma­tion. They focused on Sau­di Arabia’s activ­i­ties in the Mid­dle East and claims about an alleged mas­sacre at Euro­vi­sion, an inter­na­tion­al song con­test host­ed by Israel in 2019…Although the peo­ple behind this activ­i­ty attempt­ed to con­ceal their iden­ti­ty and coor­di­na­tion, our inves­ti­ga­tion found lim­it­ed links to the CIB net­work we removed in April 2020 and con­nec­tions to indi­vid­u­als asso­ci­at­ed with the Iran­ian government.

The Glob­al Influ­ence Oper­a­tions Report (GIOR) pre­vi­ous­ly report­ed on var­i­ous cyber­at­tacks con­nect­ed to Iran, so far, main­ly in the con­text of the US Pres­i­den­tial elections:

• A report on cyber-attacks detect­ed by Microsoft tar­get­ing the per­son­al accounts of peo­ple asso­ci­at­ed with the Don­ald Trump Pres­i­den­tial campaign.

• A report on crim­i­nal charges raised against Iran­ian hack­ers, includ­ing the van­dal­ism of US websites.

• A report on the lat­est DHS Home­land Threat Assess­ment failed to iden­ti­fy Iran­ian efforts direct­ed at the elections.

• A report that nation­al secu­ri­ty offi­cials had accused Iran of try­ing to inter­fere with the upcom­ing US elec­tions by send­ing vot­ers fake emails intend­ed to look like they had been sent by the Proud Boys, a far-right, pro-Trump group.

• A report that the US Depart­ment of Jus­tice had seized 92 inter­net domains said to be used by Iran’s Rev­o­lu­tion­ary Guard as part of a glob­al dis­in­for­ma­tion campaign.