Facebook on Wednesday announced the removal of three networks of accounts it had determined were operating on behalf of foreign governments, including a number of pages that the company tied to Russian intelligence services.
Researchers found a network of 78 accounts, 11 Pages, 29 groups and four Instagram pages that often posted about news such as Russia’s involvement in Syria and the downing of the Malaysian airliner MH17 and also had links to Russian military intelligence services, the company said. Sometimes, the account holders misrepresented themselves as citizen journalists, and contacted policymakers, reporters and other known figures in the region who could help amplify their content, Facebook said in a blog post.
The other networks originated in Iran, where operators also impersonated journalists, and Vietnam and Myanmar, where the Burmese telecommunications company MyTel, which is indirectly owned by the Burmese and Vietnamese militaries, engaged in “coordinated inauthentic behavior.”
These takedowns are only the latest example of Facebook and other social media companies reacting to stop users from misrepresenting themselves only to amplify government propaganda. While Facebook normally is careful to avoid attributing such behavior to specific entities, in this case the company identified military services as the parties responsible.
The disclosures also include details about how some accounts directly messaged other, legitimate users in an attempt to boost their own credibility. Fancy Bear, a Russian hacking group associated with the GRU military intelligence service, in 2016 used private messages to promise reporters access to documents that had been stolen from officials at the World Anti-Doping Agency.
“Here again, we have a campaign using direct messaging to reach users,” Camille Francois, the chief innovation officer at the social media mapping company Graphika, wrote in a tweet on Wednesday. “This type of direct outreach has been used in previous operations to target journalists, activists and politicians alike. It’s an important and understudied vulnerability.”
The GRU was behind much of the effort, according to Graphika’s analysis. The intelligence agency authored long articles on blogging platforms which often criticized lawmakers who argued for stronger relationships with the West. Then, after cloaking the identity of the author, they would post the article on Facebook and try to create divisive material.
Facebook identified one group in Lithuania organized by a Russian operation called “Just the truth,” which posted memes critical of the North Atlantic Treaty Organization. In another case, the GRU deemed Pavel Filip, the former prime minister of Moldova, a “Puppet of the West,” and accused the U.S. Peace Corps of trying to interfere in the small country.
Researchers from the security firm FireEye and the Atlantic Council’s Digital Forensic Research Lab also had analyzed the activity.
The Iranian activity detailed by Facebook is an extension of prior efforts in which members of the campaign in 2018 impersonated political candidates running for office in the U.S. House of Representatives, according to a new FireEye analysis. The six Facebook accounts and five Instagram profiles removed Wednesday were primarily focused on American politics, depicting U.S. elections, immigration policy, Iranian relations and public figures, like the former White House official John Bolton, through a critical lens.
