Facebook Deletes 652 Fake Accounts For ‘Coordinated Inauthentic Behavior’

Facebook has removed 652 fake accounts for “coordinated inauthentic behaviour” that originated in Iran and Russia and targeted people across multiple Internet services in the Middle East, Latin America, Britain and the US.

According to Facebook, some of the fake Pages, groups and accounts originated in Iran and some in Russia. “We’re still investigating, and we have shared what we know with the US and UK governments. Since there are US sanctions involving Iran, we’ve also briefed the US Treasury and State Departments,” Nathaniel Gleicher, Head of Cybersecurity Policy at Facebook, said in a statement on Tuesday.

These sanctions allow companies to provide people Internet services for personal communications, including the government and its affiliates. “But Facebook takes steps to prevent people in Iran and other sanctioned countries from using our ad tools,” said Gleicher. Facebook also removed Pages, groups and accounts that can be linked to sources the US government has previously identified as Russian military intelligence services.

“While these are some of the same bad actors we removed for cybersecurity attacks before the 2016 US election, this more recent activity focused on politics in Syria and Ukraine,” Facebook said. For example, these accounts are associated with Inside Syria Media Centre, which the Atlantic Council and other organisations have identified for covertly spreading pro-Russian and pro-Assad content.

“We’re working closely with US law enforcement on this investigation, and we appreciate their help. These investigations are ongoing – and given the sensitivity we aren’t sharing more information about what we removed,” Facebook added. Facebook acted on these accounts after FireEye, a global cybersecurity firm, gave it information in July about “Liberty Front Press”, a network of Facebook Pages as well as accounts on other online services.

Based on FireEye’s tip, Facebook started an investigation into “Liberty Front Press” and identified additional accounts and Pages from their network. “We are able to link this network to Iranian state media through publicly available website registration information, as well as the use of related IP addresses and Facebook Pages sharing the same admins,” Facebook informed.

The first “Liberty Front Press” accounts were created in 2013. Some of these attempted to conceal their location, and primarily posted political content focused on the Middle East, as well as the UK, US, and Latin America. Beginning in 2017, they increased their focus on the UK and US.

Accounts and Pages linked to “Liberty Front Press” typically posed as news and civil society organizations sharing information in multiple countries without revealing their true identity, said Facebook. Facebook recently deleted 32 Pages and accounts attempting to influence the US mid-term elections.