Facebook has yanked four networks of coordinating accounts that it linked to Iran, Russia and election meddling.
One of the networks that was targeting the 2020 US presidential elections appeared to be linked to the Russian troll agency known as the Internet Research Agency (IRA): the operation that concocted a slew of cardboard cutout accounts to churn out divisive blogs.
Nathaniel Gleicher, head of cybersecurity for Facebook, said in a post on Monday that the networks, made up of fake and hijacked accounts, were masquerading as local accounts so as to post political content in the run-up to the 2020 presidential election.
We’ve seen this type of inflammatory, partisan content before, in the 2016 US presidential election: posts about Israel demolishing Palestinian houses, a US Congresswoman calling President Trump racist, Black Lives Matter and other race relations hot-button topics in the US, Iranian foreign policy, and more.
Facebook said that three of the account networks originated in Iran and one in Russia. They targeted a number of different regions of the world: the US, North Africa and Latin America.
It’s not the content that Facebook is taking down, Gleicher stressed. Rather, the platform is taking action based on “inauthentic behavior.” Its policy on misrepresentation, which requires that people connect on Facebook using the name they go by in everyday life, is geared to “create a safe environment where people can trust and hold one another accountable.”
On Monday, it took down 93 Facebook accounts, 17 Pages and 4 Instagram accounts for violating its policy against coordinated inauthentic behavior (CIB). It also updated that policy on Monday. Some of its new tactics:
- Persona non grata. If, in the course of a CIB investigation, Facebook determines that a particular organization is primarily organized to conduct manipulation campaigns, it will permanently remove that organization from its platforms in its entirety.
- Foreign or Government Interference (FGI). Facebook said that it finds two types of CIB to be particularly egregious: Foreign-led efforts to manipulate public debate in another country, and operations run by a government to target its own citizens. “These can be particularly concerning when they combine deceptive techniques with the real-world power of a state,” the platform said.
Operations focused on the US and North Africa
Facebook traced the activity of the 93 accounts, et al., to Iran and said that the operation focused primarily on the US, with some activity targeting French-speaking audiences in North Africa.
Some of the accounts had already been automatically disabled. Using the compromised and fake accounts, the networks masqueraded as locals to manage their Pages, join Groups and drive people to off-platform domains connected to Facebook’s previous investigation into the Iran-linked “Liberty Front Press,” which it removed in August 2018.
The accounts had about 7,700 followers on their Facebook Pages, and around 145 people followed one or more of the Instagram accounts.
Operations focused on Latin America
On Monday, Facebook also removed an additional 38 Facebook accounts, 6 Pages, 4 Groups and 10 Instagram accounts that originated in Iran and which focused on countries in Latin America.
These Pages and accounts also posed as locals, used fake accounts to post in Groups, and managed Pages posing as news organizations. They also shuffled traffic to off-platform domains and as well as frequently repurposing Iranian state media stories, the accounts posted tailor-made content for a particular country, including domestic news, geopolitics and public figures.
About 13,500 accounts followed one or more of the Pages, about 4,200 accounts joined at least one of the Groups, and around 60,000 people followed one or more of the Instagram accounts.
Again, Facebook discovered this coordinated network through its investigation of one of the Iran-linked networks it removed in August 2018.
Fake news entity BLMNews
Facebook also took down a small network – it only had four Facebook accounts, and it was followed by just 45 people – that purported to be the “source of African-American news all around the world,” including coverage of the Black Lives Matters movement.
The Iran-based network’s main purpose was apparently to drive traffic to an off-platform site – BLMNews – that masqueraded as a news outlet. The page typically posted about political issues, including topics such as race relations in the US, criticism of US and Israel’s policy on Iran, the Black Lives Matter movement, African-American culture and Iranian foreign policy.
The BLMNews network was yet another of the CIB networks discovered in the investigation that led to the networks takedown in August 2018, as well as takedowns in May 2019.
Russia’s back with more IRA action
Facebook also removed 50 Instagram accounts and 1 Facebook account that originated in Russia and focused primarily on the US. The campaign showed some links to Russia’s IRA troll farm, with hallmarks of “a well-resourced operation that took consistent operational security steps to conceal their identity and location,” Facebook said.
Similar to IRA activity in the past, those steps made it tough for many of the accounts to build much of a following among authentic communities. The campaign included some fake accounts that had already been automatically detected and disabled because they were inauthentic and spammy.
The accounts mostly followed, liked or commented on others’ posts to increase engagement with their own content, reusing content already shared by others, such as screenshots of posts put up by news organizations and public figures. As well, a small number of the accounts dragged out and modified old memes that the IRA has posted in the past.
That recycling of past content is why the social network analysis company Graphika, which reviewed the campaign for Facebook, dubbed it IRACopyPasta.
Most of the posts weren’t directly related to elections, but instead focused on general news and political commentary (covering the political spectrum from ultra-right to uber-left), environmental issues, racial tensions, LGBTQ issues, or a host of other topics. That’s probably because the posts are being used to develop account personas and branding, Graphika says.
If the campaign really is coming from the IRA, it’s targeting the same issues and communities. From Graphika’s report, with the quoted material being borrowed from a Senate Intelligence Committee report on Russian interference in the 2016 election:
“Socially divisive issues, such as race, immigration, and Second Amendment rights,” which were the focus of the IRA’s previous campaigns, appear clearly throughout this set. The targeting, the language and content clues, and the recreation of original IRA content, all underscore the resemblance between the original IRA and IRACopyPasta.
Graphika notes a dearth of text in the posts, which could be a sign that Russia is trying to avoid linguistic glitches that marked some of its 2016 posts. Graphika says that this time around, the accounts are generally just pushing screenshots of other people’s tweets and memes without actually commenting on the posts.