Facebook has removed as many as 652 fake accounts for “coordinated inauthentic behaviour” targeting people across multiple Internet services in the Middle East, Latin America, Britain and the US. According to Facebook, these pages, groups and accounts originated in Iran and Russia.

“Today, we removed more than 650 Pages, groups, and accounts for coordinated inauthentic behavior on Facebook and Instagram. These were networks of accounts that were misleading people about who they were and what they were doing,” CEO Mark Zuckerberg said in a Facebook post.

Advertisement

He said Facebook believed these pages, groups and fake accounts were part of two separate sets of campaigns.

READ | Govt tells WhatsApp to comply with Indian law

“We’re still investigating, and we have shared what we know with the US and UK governments. Since there are US sanctions involving Iran, we’ve also briefed the US Treasury and State Departments,” Nathaniel Gleicher, Head of Cybersecurity Policy at Facebook, said in a statement on Tuesday.

These sanctions, he said, allowed companies to provide people Internet services for personal communications, including the government and its affiliates.

“But Facebook takes steps to prevent people in Iran and other sanctioned countries from using our ad tools,” said Gleicher.

Facebook also removed Pages, groups and accounts that can be linked to sources the US government previously identified as Russian military intelligence services.

“While these are some of the same bad actors we removed for cybersecurity attacks before the 2016 US election, this more recent activity focused on politics in Syria and Ukraine,” Facebook said.

For example, these accounts are associated with Inside Syria Media Centre, which the Atlantic Council and other organisations have identified for covertly spreading pro-Russian and pro-Assad content.

“We’re working closely with US law enforcement on this investigation, and we appreciate their help. These investigations are ongoing – and given the sensitivity we aren’t sharing more information about what we removed,” said Gleicher.

Zuckerberg said Facebook had been investigating some of these campaigns for months, adding that this “highlights the tension we face in every investigation between removing bad actors quickly and improving our defenses over time.”

“If we remove them too early, it’s harder to understand their playbook and the extent of their network. It can also make it harder for law enforcement who are running their own investigations,” he posted.

Facebook acted on these accounts after FireEye, a global cybersecurity firm, tipped off the social media giant in July about “Liberty Front Press”, a network of Facebook Pages as well as accounts on other online services.

Based on the tip, Facebook started an investigation into “Liberty Front Press” and identified additional accounts and Pages from their network.

“We are able to link this network to Iranian state media through publicly available website registration information, as well as the use of related IP addresses and Facebook Pages sharing the same admins,” said Facebook.

The first “Liberty Front Press” accounts were created in 2013. Some of these attempted to conceal their location, and primarily posted political content focused on the Middle East, as well as the UK, US, and Latin America.

They increased their focus on the UK and the US from 2017.

Accounts and Pages linked to “Liberty Front Press” typically posed as news and civil society organisations sharing information in multiple countries without revealing their true identity, said Facebook.

Thanking FireEye its work, Gleicher said the company had published an initial analysis and would release a full report of its findings soon.

Facebook recently deleted 32 Pages and accounts attempting to influence the US mid-term elections.