Facebook brings banhammer down on over 650 pro-Iranian 'fake news' accounts

Tipped off by researchers from infosec outfit FireEye, Facebook has gone on another "fake news" killing spree, pulling more than 650 "inauthentic" pages pushing Iranian interests.

The social network's head of cybersecurity policy, Nathaniel Gleicher, blogged that Facebook got the tip in July that a network called "Liberty Front Press" was operating a network of Facebook pages and accounts to push a pro-Iranian agenda.

Though it could have moved earlier, Facebook said it would have made it harder to understand the operators' "playbook and the extent of their network", and limited the company's ability to assist law enforcement.

FireEye's report said the operation targeted audiences in the US, UK, Latin America, and the Middle East. Summarising the report, the company said the narratives "include anti-Saudi, anti-Israeli, and pro-Palestinian themes, as well as support for specific US policies favorable to Iran, such as the US-Iran nuclear deal (JCPOA)".

FireEye's map of Liberty Front Press connections. Click to enlarge

FireEye said: "We assess with moderate confidence that this activity originates from Iranian actors based on a combination of indicators, including site registration data and the linking of social media accounts to Iranian phone numbers, as well as the promotion of content consistent with Iranian political interests."

Examples of the registrant information include association between Liberty Front Press and "Instituto Manquehue" with Tehran-based websites and the Iranian site gahvare.com. The company identified "multiple Twitter accounts" linked to those sites, and more using phone numbers carrying the +98 Iranian country code.

Bernie Sanders was an inadvertent beneficiary – some of the fake personas (such as Twitter's @berniecratss) posed as supporters – and there were heavy promotions for the Iranian holiday Quds Day (in support of Palestine, and opposing Israel).

Facebook said there were 74 pages on its platform associated with 70 accounts, three Facebook groups, and 76 Instagram accounts. Around 155,000 other accounts followed "at least one of these pages", 2,300 accounts joined at least one of the groups, and the Instagram accounts had more than 48,000 following accounts.

US and Australian currency was used to buy $6,000-plus worth of Facebook and Instagram accounts, running from January 2015 to this month, and while some were blocked under Facebook's "political ads transparency" push, the social network said it's still reviewing content from these accounts.

While inauthentic content operations are, at least in the popular mind, associated with right-wing content, it's not the case in the Liberty Front Press/Instituto Manquehue operation.

The operators' US-focused activity "includes significant anti-Trump messaging and the alignment of social media personas with an American liberal identity", FireEye said. "However, it is important to note that the activity does not appear to have been specifically designed to influence the 2018 US midterm elections, as it extends well beyond US audiences and US politics."

The operation used the tried-and-true technique of raiding other peoples' sources for their profile pics, including student and employee biographies "on various websites".

Yet another supposedly independent media outlet, US Journal (usjournal.net) hosted similar content, shared around using a Facebook profile for "Amanda Kor" (https://www.facebook.com/amanda.kor.7) and various social media accounts under its own name.

Facebook's post added that in an unrelated action, the company has also pulled groups and accounts associated with Russian military intelligence, mostly pushing activity focused on Syrian and Ukrainian politics. ®