Iran’s New Facebook Trolls Are Using Russia’s Playbook
Credit to Author: Issie Lapowsky| Date: Fri, 26 Oct 2018 20:05:26 +0000
On Friday, Facebook shut down another network of 82 accounts, pages, and groups that have been posing as US and UK citizens since 2016. The network, which Facebook says originated in Iran, has spread memes, articles, and other posts about political topics including race relations, the upcoming midterm election in the US, and the recent confirmation hearings for Supreme Court Justice Brett Kavanaugh. It also hosted seven events.
What distinguishes this latest group, which Facebooks says it discovered a week ago, from the Iranian propaganda network that tech giants shut down this past summer are the striking similarities between its campaign and the one the Russians mounted before the 2016 election. Rather than focusing on the Iranian regime's agenda at home, the new network focused squarely on American and British politics. As it turns out, that may be a more successful strategy: While the network discovered this summer had just around 200,000 followers on Facebook and Instagram, this latest batch had more than one million.
"This content appeared consistent with what we’ve seen in other major operations," Facebook's head of cybersecurity policy, Nathaniel Gleicher, said on a call with reporters Friday. "It was targeting broad division. It was sowing discord and targeting socially divisive issues."
In August, Facebook, Twitter, and Google suspended an expansive web of phony social media accounts and websites linked to the Islamic Republic of Iran Broadcasting, a state-owned news network. Those pages and accounts, which were first spotted by the cybersecurity firm FireEye, posed as ordinary citizens as well as journalists and news organizations that advocated for policies explicitly favoring Iran. This latest batch took a different tack. While there was some anti-Saudi and anti-Israeli content sprinkled throughout, the accounts and pages mostly pretended to be American liberals, and they posted divisive content about American politics, according to the Atlantic Council's Digital Forensics Research Lab, which is working with Facebook to dissect the operation. Unlike this summer's batch, Facebook says it has no indication yet that the most recent network is linked to the Iranian government.
"This looks like an Iranian operation which learned from earlier Russian ones," says Ben Nimmo, a senior fellow at the DFRLab.
According to DFRLab director Graham Brookie, his team had less than 24 hours notice to piece through the content. They published some preliminary findings shortly after Facebook's announcement.
The most staggering difference between the two Iranian campaigns is how much engagement the most recent one received on Facebook and Instagram. According to DFRLab, one page, titled "I Need Justice Now," amassed more than 13 million video views on Facebook. Another, titled "No Racism No War," received more than 10 million views. DFRLab's researchers note, however, that some of the engagement on these posts appears to have been artificially amplified because it so far exceeds the number of followers the accounts had.
Gleicher says Facebook did find links between this network and the one it had shut down in August. He says Facebook researchers manually combed the accounts for signs of inauthentic coordinated activity. Despite those links, however, it seems the accounts taken down Friday were far more recent. Their earliest post was in June 2016, but Gleicher says “the majority of the activity is over the last year.”
The Iranian pages homed in on national news events in the US like the Kavanaugh hearings. One cartoon posted to the page "No Racism No War" showed Kavanaugh griping about his life being “destroyed by unproven allegations without a trial.” Behind him, Trayvon Martin, sitting with other victims of police brutality, says, “That’s rough, bro.” The pages also shared articles from mainstream news sources. In September, the "I Need Justice" page shared a Daily Beast article with the headline “Stormy Daniels: Trump’s Penis Looks like Toad from Mario Kart.”
Like the Russian pages, this set shared highly divisive content that primarily skewed negative. "Zionism is terrorism," read one post on the Instagram account @know_the_realities. But there were a few odd exceptions. DFRLab released a slew of posts from the "No Racism No War" page that just encouraged Americans to vote.
This is not the first parallel researchers have found between the Iranian and Russian operations. In August, Jonathan Albright, director of the Digital Forensics Initiative at the Tow Center for Digital Journalism, discovered another unusual link: On a page called "Music Extension," which promotes a Chrome extension connected to Russia's Internet Research Agency, Facebook's Related Pages section recommended "The British Left," one of the phony Iranian pages taken down this summer. The "Music Extension" page was still live on Friday.
"There are either network-based connections or advertising-based connections that somehow link those pages," Albright says. "It wouldn't randomly suggest a British propaganda page on a music page. They have nothing in common."
Albright took a screenshot of the related page recommendation and shared it on Twitter in August. Since then, Facebook has not answered WIRED's repeated requests for comment on why that referral might have occurred. But the company says it has not found any connections between the Iranian and Russian accounts.
Whether that recommendation is an algorithmic quirk or some sign of a deeper link between the Russian and Iranian campaigns is unclear. Given the diplomatic ties between the two nations and the mounting signs that they're following the same playbook, knowing the answer to that question seems more critical than ever.