Facebook, Twitter battle Iranian social network disinformation campaign

In a statement Facebook said it had removed "652 pages, groups and accounts for coordinated inauthentic behavior that originated in Iran and targeted people across multiple internet services."

August 23, 2018 02:37
3 minute read.
A picture illustration shows a Facebook logo reflected in a person's eye

A picture illustration shows a Facebook logo reflected in a person's eye. (photo credit: REUTERS/DADO RUVIC/ILLUSTRATION/FILE PHOTO)


Dear Reader,
As you can imagine, more people are reading The Jerusalem Post than ever before. Nevertheless, traditional business models are no longer sustainable and high-quality publications, like ours, are being forced to look for new ways to keep going. Unlike many other news organizations, we have not put up a paywall. We want to keep our journalism open and accessible and be able to keep providing you with news and analysis from the frontlines of Israel, the Middle East and the Jewish World.

As one of our loyal readers, we ask you to be our partner.

For $5 a month you will receive access to the following:

  • A user experience almost completely free of ads
  • Access to our Premium Section
  • Content from the award-winning Jerusalem Report and our monthly magazine to learn Hebrew - Ivrit
  • A brand new ePaper featuring the daily newspaper as it appears in print in Israel

Help us grow and continue telling Israel’s story to the world.

Thank you,

Ronit Hasin-Hochman, CEO, Jerusalem Post Group
Yaakov Katz, Editor-in-Chief


WASHINGTON – Facebook, Twitter and Alphabet have identified and removed hundreds of “inauthentic” accounts and profiles originating in Iran, several of which conducted “traditional cybersecurity attacks” on subjects in the United States, Britain, Latin America and the Middle East, the social media giants said on Tuesday.

In a statement Facebook said it had removed “652 pages, groups and accounts for coordinated inauthentic behavior that originated in Iran and targeted people across multiple internet services.”

“We are able to link this network to Iranian state media through publicly available website registration information, as well as the use of related IP addresses and Facebook Pages sharing the same admins,” the organization said, identifying several mislabeled accounts traced back to Press TV, Iran’s state-run news channel. “Since there are US sanctions involving Iran, we’ve also briefed the US Treasury and State Departments.”

Twitter, which called the effort “coordinated manipulation,” said it removed 284 accounts.
Iran unveils a new fighter jet, August 21, 2018 (Reuters)

The accounts spent about $12,000 to advertise through Facebook and Instagram using a variety of currencies, Facebook said. The company said it had notified the US Treasury and State departments of the purchases, which may potentially violate sanctions.
The same investigation – which was prompted by a tip from a separate cybersecurity firm, called FireEye – identified additional Russian accounts taking part in a disinformation campaign to sow discord in the US.

Facebook said the Russia-linked accounts it removed were engaged in “inauthentic behavior” related to politics in Syria and Ukraine. It said that activity did not appear to be linked to the Iranian campaign.

Microsoft said this week that hackers linked to the Russian government sought to steal email login credentials from US politicians and think tanks, allegations the Russian foreign ministry described as a “witch-hunt.”

FireEye said in a statement that Iran’s activity did not appear specifically targeted toward the 2018 midterm elections. But it characterized Iran’s influence campaign as a sophisticated operation using new forms of media as “a means of shaping political discourse.”

FireEye expressed “moderate confidence” about the Iranian origins, but said it has not been able to tie the accounts back to a specific organization or individuals.

Hundreds of thousands of people followed one or more of the Facebook pages implicated in the campaign, Facebook said.
It shared examples of removed posts, including a cartoon depicting an Israeli soldier executing a Palestinian and a fake movie poster showing US President Trump embracing North Korean leader Kim Jong Un.

“Broadly speaking, the intent behind this activity appears to be to promote Iranian political interests, including anti-Saudi, anti-Israeli, and pro-Palestinian themes, as well as to promote support for specific US policies favorable to Iran, such as the US-Iran nuclear deal (JCPOA),” the cybersecurity firm said. “In the context of the US-focused activity, this also includes significant anti-Trump messaging and the alignment of social media personas with an American liberal identity.”

The accounts used a combination of different hashtags to engage in US culture, including “#lockhimup,” “#impeachtrump” and “#notmypresident.”

Facebook CEO Mark Zuckerberg said the accounts identified on his company’s platform were part of two separate campaigns, the first from Iran with some ties to state-owned media, the second linked to sources which Washington has previously named as Russian military intelligence services.

In Israel this week, US National Security Advisor John Bolton warned that Iran, Russia, China and North Korea were all trying to influence the 2018 midterm elections through cyber campaigns.

The United States earlier this year indicted 13 Russians for alleged attempts to meddle in US politics.

Reuters contributed to this report.

Related Content

Jun 17, 2019; Toronto, Ontario, Canada; A general view of the scene of a shooting incident.
June 18, 2019
Gunshots fired at Raptors Championship Parade in Toronto


Cookie Settings