Facebook, Twitter remove accounts associated with Iran-linked misinformation campaign

Facebook, Twitter remove accounts associated with Iran-linked misinformation campaign
© iStock

Facebook and Twitter said Tuesday that they are working to kneecap an escalating Iran-linked online campaign that had been spreading misinformation in the U.S. since months before the 2018 midterms.

In a blog post, Facebook said it removed 51 Facebook accounts, 36 Pages, seven Groups and three Instagram accounts that originated in Iran and have engaged in "coordinated" inauthentic behavior. The pages had amassed about 21,000 followers by the time they were taken down. 

Facebook said the individuals behind the activity were pretending to be located in the U.S. and Europe, and at various points misrepresented themselves as journalists or news outlets in order to gain influence and amplify their messages bolstering Iran's political agenda.   


Twitter said it removed the network of 2,800 inauthentic accounts originating in Iran at the beginning of May. 

"Our investigations into these accounts are ongoing," a Twitter spokesperson told The Hill. "As we continue to investigate potential wider networks and actors, we typically avoid making any declarative public statements until we can be sure that we have reached the end of our analyses." 

Both of the company's announcements came on the heels of a report from top cybersecurity firm FireEye, which on Wednesday published its report on an Iran-linked misinformation campaign it had identified on Facebook and Twitter.  

FireEye has been investigating a network of English-language social media accounts working to promote messages supporting "Iranian political interests" — mostly anti-Israeli, pro-Palestinian and anti-Saudi sentiments. FireEye found that some of the accounts were impersonating real Americans, including some Republican political candidates who ran for the House in 2018, while others represented themselves as journalists. According to the FireEye report, some of the accounts successfully had letters to the editor and articles published in newspapers such as The New York Daily News.  

According to FireEye, most of the accounts they'd been tracking over the past year were suspended around May 9.

The firm said it had identified an inauthentic social media network "engaged in inauthentic behavior and misrepresentation and that we assess with low confidence was organized in support of Iranian political interests."

"In addition to utilizing fake American personas that espoused both progressive and conservative political stances, some accounts impersonated real American individuals, including a handful of Republican political candidates that ran for House of Representatives seats in 2018," the group wrote.

FireEye last year released a separate report on Iranian misinformation campaigns sweeping across top social media platforms; Tuesday's report follows up on what it has noticed since then. 

Facebook said the accounts it removed included those identified by FireEye as well as some they found through their own investigation.

"Based on a tip shared by FireEye, a US cybersecurity firm, we conducted an internal investigation into suspected Iran-linked coordinated inauthentic behavior and identified this activity," Facebook's head of cybersecurity policy, Nathaniel Gleicher, said in a blog post. 

The apparently falsified personas often represented themselves as journalists and activists, and at some points reached out to policymakers, reporters, academics, Iranian dissidents and others, according to Facebook and FireEye. 

FireEye said U.S. and Israeli newspapers in some instances published letters and articles submitted by personas identified as false in the misinformation network. 

On Twitter, FireEye found that Iran-linked accounts were posing as Marla Livengood, a Republican candidate for California’s 9th Congressional District in 2018, and Jineea Butler, a Republican candidate for New York’s 13th Congressional District last year. Those accounts promoted messages that align with Iran's political interests alongside more general messages about U.S. politics, sometimes copied from the candidates' real accounts. Those fake accounts were suspended this month. 

"We were not aware of it," Scott Winn, one of the leaders of Livengood's campaign, told NBC News. "This seems to be kind of an ongoing problem in campaigns … We have people that are looking at what happened in the 2016 election and trying to duplicate that on a local level." 

The firm said it cannot identify whether the network is linked to the Iranian government. 

"If it is of Iranian origin or supported by Iranian state actors, it would demonstrate that Iranian influence tactics extend well beyond the use of inauthentic news sites and fake social media personas, to also include the impersonation of real individuals on social media and the leveraging of legitimate Western news outlets to disseminate favorable messaging," the report says. 

Twitter in its statement criticized FireEye for failing to "share information or insights with Twitter" on its findings before it published a report.

"FireEye, a private cybersecurity firm, has issued a report and chosen not to share information or insights with Twitter prior to publication which is outside standard, responsible industry norms," Twitter said. "Responsible disclosure should include notification and information sharing to protect against informing bad actors. Going public without these elements harms the credibility of the security research community, whose insights we support and appreciate." 

--Updated at 5:10 p.m.