Cybersecurity firm reveals alleged Iranian effort to influence UK and US audiences

IranianFacebook, Twitter, and Google’s parent company Alphabet, have collectively removed hundreds of accounts tied to an alleged Iranian propaganda operation, while Facebook took down a second campaign it said was linked to Russia.

Mark Zuckerberg, Facebook’s chief executive, said the accounts identified on his company’s platform were part of two separate campaigns, the first from Iran with some ties to state-owned media, the second linked to sources which Washington has previously named as Russian military intelligence services.

The move by Facebook and others is the latest attempt by global social media giants to guard against political interference on their platforms. It comes as concerns are rising about attempts to disrupt the US midterm elections in November.

The United States earlier this year indicted 13 Russians for alleged attempts to meddle in US politics, but the latest alleged Iranian activity, revealed by cybersecurity firm FireEye, suggests the problem may be more widespread.

FireEye said the Iranian campaign used a network of fake news websites and fraudulent social media personas spread across Facebook, Instagram, Twitter, Google Plus and YouTube, to push narratives in line with Tehran’s interests.

“FireEye has identified a suspected influence operation that appears to originate from Iran aimed at audiences in the US, UK, Latin America, and the Middle East,” it said in a statement.

“This operation is leveraging a network of inauthentic news sites and clusters of associated accounts across multiple social media platforms to promote political narratives in line with Iranian interests.

“These narratives include anti-Saudi, anti-Israeli, and pro-Palestinian themes, as well as support for specific US policies favorable to Iran, such as the U.S.-Iran nuclear deal.

“The activity we have uncovered is significant, and demonstrates that actors beyond Russia continue to engage in and experiment with online, social media-driven influence operations to shape political discourse.”

Lee Foster, an information operations analyst with FireEye, told Reuters: “It really shows it’s not just Russia that engages in this type of activity,”

FireEye said the Iranian activity did not appear “dedicated” to influencing the upcoming US election, though some of the posts aimed at US users did adopt “left-leaning identities” and took stances against President Donald Trump. That activity “could suggest a more active attempt to influence domestic US political discourse” is forthcoming, Foster said, but “we just haven’t seen that yet.”

Facebook said the Russia-linked accounts it removed were engaged in “inauthentic behavior” related to politics in Syria and Ukraine. It said that activity did not appear to be linked to the Iranian campaign.

“These were distinct campaigns and we have not identified any link or coordination between them. However, they used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing,” the company said in a statement.

Twitter, which called the effort “coordinated manipulation,” said it removed 284 accounts.

Microsoft said this week that hackers linked to the Russian government sought to steal email login credentials from US politicians and think tanks, allegations the Russian foreign ministry described as a “witch-hunt.”