Facebook Identifies New Influence Operations Spanning Globe
Posted August 22, 2018 1:07 a.m. EDT
Updated August 22, 2018 1:12 a.m. EDT
SAN FRANCISCO — Facebook said on Tuesday it had identified multiple new influence campaigns that were aimed at misleading people around the world, with the company finding and removing 652 fake accounts, pages and groups that were trying to sow misinformation.
The activity originated in Iran and Russia, Facebook said. Unlike past influence operations on the social network, which largely targeted Americans, the fake accounts, pages and groups were this time also aimed at people in Latin America, Britain and the Middle East, the company said.
Some of the activity was still focused on Americans, but the campaigns were not specifically intended to disrupt the midterm elections in the United States, said FireEye, a cybersecurity firm that worked with Facebook on investigating the fake pages and accounts. The operations “extend well beyond U.S. audiences and U.S. politics,” FireEye said in a preliminary report.
The global scale of what was uncovered far exceeded that of an influence operation that Facebook revealed last month, in which the company said it detected and removed 32 pages and fake accounts that had engaged in divisive social issues before the midterms.
But the aims of the latest campaigns appeared to be similar to those of past operations on the social network: to distribute false news that might cause confusion among people, and to alter people’s thinking to become more partisan or pro-government on various issues.
“We believe these pages, groups and accounts were part of two sets of campaigns,” Mark Zuckerberg, Facebook’s chief executive, said in a conference call late Tuesday about the activities. “One from Iran, with ties to state owned media. The other came from a set of people the U.S. government and others have linked to Russia.”
The revelations highlight how Facebook’s use as a vessel for disinformation is spreading. After the 2016 U.S. presidential election, the company revealed that its site was used to amplify divisive messages to voters on issues, including race, gun control and the environment. The Internet Research Agency, a Kremlin-linked group, was at the center of an indictment this year that alleged interference in the 2016 presidential election.
The influence operation that Facebook disclosed last month included one page that was joined by nearly 140,000 people, who believed they were fighting racism in the United States, while another set up dozens of events aimed at stirring up opposition among left-wing activists. Facebook did not definitively link last month’s campaign to Russia, but it said some of the tools and techniques used by the accounts were similar to those used by the Internet Research Agency.
Now, those same social media influence tactics that were used in 2016 and last month appear to have been adopted by operatives in other countries as well.
Renee DiResta, director of research at New Knowledge, an organization that studies disinformation campaigns, said Iran’s involvement “reinforces that this is an ongoing information war, that our social ecosystem is vulnerable to manipulation by a variety of adversaries.” In a statement, Sen. Mark Warner, D-Va., said, “There’s no way the problem of social media manipulation is limited to a single troll farm in St. Petersburg, and that fact is now beyond a doubt.” He added, “Iranians are now following the Kremlin’s playbook from 2016.”
Sen. Richard Burr, R-N.C. and chairman of the Senate Intelligence Committee, said he planned to ask technology company executives more about the matter Sept. 5 at a hearing in Washington to discuss social media and disinformation. Sheryl Sandberg, Facebook’s chief operating officer, and Jack Dorsey, Twitter’s chief executive, as well as others, are expected to appear at the hearing.
“Addressing this threat requires technology companies, law enforcement, Congress, and the intelligence community working together,” Burr said.
Facebook’s announcement Tuesday was followed by one by Twitter, which said that it had also removed accounts from its social media service that had ties to Iran.
“We have suspended 284 accounts from Twitter for engaging in coordinated manipulation,” Twitter said in a tweet. “Based on our existing analysis, it appears many of these accounts originated from Iran.”
YouTube said it deleted one channel tied to Iran, that of Liberty Front Press, for violating its community guidelines, but did not offer more detail.
The new influence campaigns on Facebook follow a report from Microsoft earlier on Tuesday, in which it said it found and seized websites that were recently created by hackers linked to a Russian military intelligence unit. The fake websites were part of an effort to attack conservative think tanks in the United States.
On Capitol Hill, lawmakers have been grappling with mounting evidence from social media and U.S. intelligence that sanctions and other deterrence measures have failed to curb Russia’s activity. They signaled on Tuesday that they intended to move forward with developing punishing new sanctions in the coming weeks. It was unclear if they could enact any such legislation before November, but their deliberations in a series of hearings were meant to send a signal to Moscow to desist. Facebook said on Tuesday that it had identified some of the new influence operations last month after a tip from FireEye about a network of Facebook pages called “Liberty Front Press.”
After Facebook investigated those pages, it said it linked them back to Iranian state media using their website registration information and Internet Protocol addresses. Some of the pages were created in 2013, the company said, and they posted political content focused on the Middle East, Latin America, Britain and the United States.
Other fake pages also had a far more international bent than the earlier batches uncovered by the social media company. The pages believed to have originated in Iran were written in several languages, including English, Arabic and Farsi. They carried a number of pro-Iranian themes, as well as language attacking Israel and promoting Palestinians. Some included anti-Trump language and were tied to relations between the United States and Iran, including references to the Iranian nuclear weapons deal.
Newer accounts, created in 2016 and later, had additional goals, including spreading malware and stealing passwords, Facebook said. The accounts that originated in Russia focused on activity in Ukraine and Syria. They did not appear to target the United States. In Syria, the accounts promoted a pro-Russian agenda and that of Syria’s president, Bashar Assad.
“For example, they are associated with Inside Syria Media Center, which the Atlantic Council and other organizations have identified for covertly spreading pro-Russian and pro-Assad content,” Facebook said in a blog post.
The company added that accounts linked to Iran had spent more than $12,000 for ads on Facebook and its photo-sharing site Instagram, using U.S. and Australian currency. The earliest ad ran in July 2012, while the most recent one ran this month. Facebook said at least some of those ads had been caught because of its new rules requiring that political ads be labeled as such. Facebook did not comment on the content of the ads, or say who they were targeting.
In the conference call, Zuckerberg said Facebook was working with government agencies and private companies to proactively find malicious actors using the platform. He said the company had several investigations underway by a team dedicated to finding influence operations. He did not reveal the number or scope of the investigations, but said that given the amount of important elections happening worldwide, Facebook was looking at disinformation as a global problem.