An investigation by FireEye, a cybersecurity firm, revealed that Russia and Iran have been spreading fake news on Facebook and Instagram.
The identified narratives included anti-Israel and pro-Palestinian themes, as well as support for specific U.S. policies favorable to Iran, such as the U.S.-Iran nuclear deal (JCPOA).
In response to the investigation Facebook and Instagram removed more pages, groups and accounts for coordinated inauthentic behavior this week.
The probe concluded the activity originated in Iran and Russia and was aimed at audiences in the U.S., U.K., Latin America and the Middle East.
In an online press release FireEye claimed:
“This operation is leveraging a network of inauthentic news sites and clusters of associated accounts across multiple social media platforms to promote political narratives in line with Iranian interests… The activity we have uncovered is significant, and demonstrates that actors beyond Russia continue to engage in and experiment with online, social media-driven influence operations to shape political discourse.”
Facebook says it removed 652 pages, groups and accounts across multiple Internet services in the Middle East, Latin America, U.K. and U.S.
According to Facebook, the bad actor on these sites is Liberty Front Press.
“We are able to link this network to Iranian state media through publicly available website registration information, as well as the use of related IP addresses and Facebook Pages sharing the same admins. For example, one part of the network, “Quest 4 Truth,” claims to be an independent Iranian media organization, but is in fact linked to Press TV, an English-language news network affiliated with Iranian state media. The first “Liberty Front Press” accounts we’ve found were created in 2013. Some of them attempted to conceal their location, and they primarily posted political content focused on the Middle East, as well as the UK, US, and Latin America. Beginning in 2017, they increased their focus on the UK and US. Accounts and Pages linked to “Liberty Front Press” typically posed as news and civil society organizations sharing information in multiple countries without revealing their true identity.”
Liberty Front Press and its network operated 74 Pages, 70 accounts, and 3 groups on Facebook, as well as 76 accounts on Instagram. The sites had about 155,000 Facebook followers and 48,000 accounts were tracking Instagram posts.
These are some examples of the Liberty Front Press Posts.
Some of the Liberty Front Press accounts were created as early at 2011, but Facebook says it wasn’t aware of them until last year.
Chad Greene, Director of Security for Facebook, said the company struggles over when to shut down sites exhibiting inauthentic behavior. “Do we immediately shut down a campaign in order to prevent harm? Or do we spend time investigating the extent of the attack and who’s behind it so we can prevent them from doing bad things again in the future?” he wrote on Facebook’s Newsroom page.
He said Facebook sometimes takes down sites quickly and sometimes they wait. There doesn’t appear to be a hard policy that directs those decisions.
Facebook says some of the bad actors in this action were also removed for cybersecurity attacks before the 2016 U.S. election.
