Removing Coordinated Inauthentic Behavior From Iran

By Nathaniel Gleicher, Facebook Head of Cybersecurity Policy

February 1, 2019

This morning we removed 783 Pages, groups and accounts for engaging in coordinated inauthentic behavior tied to Iran. There were multiple sets of activity, each localized for a specific country or region, including Afghanistan, Albania, Algeria, Bahrain, Egypt, France, Germany, India, Indonesia, Iran, Iraq, Israel, Libya, Mexico, Morocco, Pakistan, Qatar, Saudi Arabia, Serbia, South Africa, Spain, Sudan, Syria, Tunisia, US, and Yemen. The Page administrators and account owners typically represented themselves as locals, often using fake accounts, and posted news stories on current events. This included commentary that repurposed Iranian state media’s reporting on topics like Israel-Palestine relations and the conflicts in Syria and Yemen, including the role of the US, Saudi Arabia, and Russia. Some of the activity dates back to 2010. Although the people behind this activity attempted to conceal their identities, our manual review linked these accounts to Iran.

• Presence on Facebook and Instagram: 262 Pages, 356 accounts, and 3 groups on Facebook, as well as 162 accounts on Instagram.
• Followers: About 2 million accounts followed at least one of these Pages, about 1,600 accounts joined at least one of these groups, and more than 254,000 accounts followed at least one of these Instagram accounts.
• Advertising: Less than $30,000 in spending for ads on Facebook and Instagram paid for primarily in US dollars, UK pounds, Canadian dollars, and euros. We have not completed our review of the organic content coming from these accounts.
• Events: 8 events hosted. The first was scheduled for May 2014, and the most recent was scheduled for May 2018. Up to 210 people expressed interest in at least one of these events. We cannot confirm whether any of these events actually occurred.

We identified some of these accounts through our continued investigation into Iranian coordinated inauthentic behavior we found and removed last year. Our investigation was aided by open source reporting and information provided to us by our industry peers. We have shared information about our investigation with US law enforcement, the US Congress, and policymakers in impacted countries.