Anne Hubbel, editor at AdvertiseMint, company for Facebook ads

A network of accounts posted political content directed at the UK and the United States

To combat misuse, Facebook removed 652 pages, groups, and accounts. The removed violators exhibited “coordinated inauthentic behavior,” targeting internet users in the Middle East, Latin America, United Kingdom, and the United States. Facebook traced the activity back to Iran.

Cybersecurity firm FireEye gave Facebook a tip back in July about a network of Facebook pages and accounts through other online platforms under the name of Liberty Front Press. Facebook investigated the network and found it linked to Iranian state media using publicly available website registration information. The suspicious network used related IP addresses and Facebook pages with the same admins.

Liberty Front Press’ Suspicious Activities

Created in 2013, the Liberty Front Press accounts kept their location hidden, posting politically divisive content directed at the Middle East, the UK, Latin America, and the United States. The accounts acted as news or civil society organizations, neglecting to disclose their real identities while sharing instigative information. As with the Russian troll accounts that disseminated politically divisive content during the 2016 US presidential election, Facebook saw this type of behavior as misleading and violative.

In the first stage of the investigation, Facebook found that Liberty Front Press had 74 Facebook pages, 70 Facebook accounts, three Facebook groups, and 76 Instagram accounts. Approximately 155,000 accounts followed at least one of those pages, 2,300 accounts joined at least one of those groups, and more than 48,000 accounts followed at least one of the Instagram accounts. Facebook also found that, other than hosting three events, the network actively advertised on the platform. It spent more than $6,000 on Facebook and Instagram ads, paying in US and Australian dollars. The first ad ran in January 2015, the last in August 2018

The network posted content in English

In the second stage, Facebook discovered links between Liberty Front Press and a completely different set of accounts and pages, the first of which were created in 2016. As with the other accounts and pages, they acted as news organizations without disclosing their real identities. Unlike the first set of accounts and pages discovered, however, this set employed cybersecurity attacks and tried to hack users’ accounts.

During its investigation of the second set of accounts and pages, Facebook found 12 Facebook pages, 66 Facebook accounts, and 9 Instagram accounts. Approximately 15,000 accounts followed at least one of those suspicious pages, and more than 1,100 followed at least one of the Instagram accounts. Although Facebook did not find any ads and events by those accounts and pages, Facebook did find posts written in Arabic.

The network also posted content in Arabic

In the third stage of the investigation, Facebook found more accounts and pages dating as far back as 2011. The accounts and pages shared content about politics in the Middle East using Arabic and Farsi and in the UK and United States using English. Facebook first learned about this particular set last year, prompting its expansion of the investigation this summer.

From its third discovery, Facebook found 168 Facebook pages, 140 Facebook accounts, and 31 Instagram accounts. Approximately 813,000 accounts followed at least one of the pages, and more than 10,000 followed of at least one of those Instagram accounts. Additionally, the accounts hosted 25 events.

Facebook also found that the account spent more than $6,000 on Facebook and Instagram ads using US dollars, Turkish lira, and Indian rupees. The first ad ran in July 2012, and the last in April 2018.

Facebook says it screens advertisers to identify their locations and to learn whether they are on the list of sanctioned individuals by the US government.

“Based on what we learn in this investigation and from government officials, we’ll make changes to better detect people who try to evade our sanctions compliance tools and prevent them from advertising,” Nathaniel Gleicher, head of cybersecurity policy, wrote in the update.

Facebook also says investigations are still ongoing. The company has shared its findings with both the US and UK governments, as well as the US Treasury and State Departments.

“We’re working closely with US law enforcement on this investigation, and we appreciate their help,” wrote Gleicher. “These investigations are ongoing, and given the sensitivity, we aren’t sharing more information about what we removed.”

In addition to its efforts to crack down on fake pages and accounts, Facebook has removed pages, groups, and accounts with any links to Russian military intelligence services previously identified by the US government. This particular removal is not linked to the Iran-based activity Facebook uncovered in its investigations. It’s primarily focused on political behaviors in Syria and Ukraine.

Action Against Cyber Threats

In the last part of the update, Facebook emphasized that there is a lot the company has to consider when faced with a cyber threat. Some questions Facebook has to answer include

• How active is the threat?
• How sophisticated are the actors?
• How much harm is being done?
• How will the threat play into world events?

“Cyber threats don’t happen in a vacuum. Nor should investigations,” Chad Greene, director of security, shared in the update. “Really understanding the nature of a threat requires understanding how the actors communicate, how they acquire things like hosting and domain registration, and how the threat manifests across other services. To help gather this information, we often share intelligence with other companies once we have a basic grasp of what’s happening. This also lets them better protect their own users.”

Greene added that academic researchers and law enforcement are crucial players whenever Facebook encounters cyber threats. When Facebook discovers a suspicious campaign, Greene says it strives to learn all it can about the extent of the bad actors’ presence on Facebook’s services, their actions, and the actions Facebook can take to deter them.

“When we reach a point where our analysis is turning up little new information, we’ll take down a campaign, knowing that more time is unlikely to bring us more answers,” said Greene. However, Greene added that in some cases, Facebook will refrain from taking action if it feels it may tip off the violator, causing them to alter their behavior accordingly before Facebook can take legal measures.

“After all, the more we know about a threat, the better we’ll be at stopping the same actors from striking again in the future,” explained Greene.

But if Facebook suspects that there is an immediate risk, it will take action as quickly as necessary.

Written by Anna Hubbel, staff writer at AdvertiseMint, company for Facebook ads