Facebook has removed more than 700 pages, accounts and social network groups controlled from Iran. For the first time, one of the axes of the operation was targeting Spain. The plot operated in more than 20 countries – Mexico, among them – and had 1.9 million followers on Facebook and 250,000 on Instagram. It's the third time since August that Facebook acts against Iranians.
The social network has suppressed the pages for lying about their identity and being controlled by actors from another country: "We do it for deception, not for content," revealed by Facebook's cybersecurity chief, Nathaniel Gleicher, in a call international media, among which was EL PAÍS. "They were accounts designed to look local and they used the languages of each country," added Gleicher.
The content was linked to the conflict between Israel and Palestine, Syria, Yemen and the role of the United States in the world
Its goal was misinformation, "but without addressing anyone or any community in particular," said Gleicher. Its intention was to spread pieces or points of view of the Iranian public media. The issues were mainly linked to the conflict between Israel and Palestine, Syria, Yemen and the role of the United States in the world. The objective of the accounts was to manipulate the public discourse in each of the countries. Facebook says it has enough evidence to attribute the origin of the fake accounts to Iran, but they do not confirm whether the Iranian government is behind.
Facebook has shared the name of 97 of the pages with the Digital Forensic Laboratory (DFRLab) of the Atlantic Council to analyze their behavior. Of these, only one published content in Spanish, according to the DFRLab: Palestine will be free (@palestina.sp). His main concern was the conflict between Israel and Palestine. "Except for those 97, the rest of the pages had been eliminated by a mixture of automated systems, spam detectors or the integrity team," according to the DFRLab report.
The director of DFRLab, Graham Brookie, has defined the deleted network as "sophisticated, involved with audiences closely designed in several languages and with a substantial scope". In previous analyzes of Iranian operations of the DFRLab, the objective was less profound: "Present content to a selected audience, and not infiltrate it," according to Brookie.
The plot invested $ 27,000 in ads to promote their publications. In total, Facebook has eliminated 260 pages, 350 accounts, two groups and 160 Instagram accounts. They also tried to create physical events in some of the countries but, according to Gleicher, they never managed to gather enough participants and it was not their main objective. Along with Spain, the affected countries are, among others, France, Germany, Indonesia, Israel, Mexico, Morocco, Saudi Arabia, Serbia, Tunisia and the United States.
The real impact of the operation is difficult to calculate. Facebook has not given details of the exact number of pages intended to operate in Spain, but seen the total figures can not go much beyond a dozen. "Mathematics are easy to do," explained Gleicher. "But it is difficult to measure its impact and we do not do it only because of the number of pages deleted, sometimes we communicate the deletion of hundreds of accounts and others only eight," he explained.
In August and October, Facebook has already announced the elimination of hundreds of accounts of Iranian origin. In those two actions there could be some affected Spanish account: "This is not the first time that we have taken action against content that emanates from Iran, we have seen other campaigns that affected the European Union and where there were citizens from different countries that followed it. Here what we see is a particular subset centered on Spain, "said Gleicher.
The collaboration with Twitter
The discovery of these accounts proceeds, on the one hand, from continuing to pay attention to the Iranian plot discovered in August, and on the other hand, the collaboration with other platforms to share information and find more false accounts, according to Gleicher.
Graham Brookie, DFRLab, has highlighted the specific collaboration with Twitter: "The most notable of this action is the sector collaboration between Facebook and Twitter. Misinformation does not occur in a clean and well-defined place, "he said. Twitter, on the other hand, has eliminated thousands of accounts based in Bangladesh, Russia, Iran and Venezuela.
Facebook had acted in the past against accounts and pages in Spanish. It was in June 2018, when he suppressed the accounts of a group of actors operating from Mexico and all of Latin America: "Their objective was to cause unrest in the real world," according to Gleicher.
This attention on Iranian disinformation activity on Facebook coincides this week with a new annual report of the European Network and Information Security Agency (ENISA), which aims to increase the actions of hackers Iranians: "The new sanctions imposed on Iran are likely to encourage the country to intensify cyber threat activities sponsored by the state," the agency said.
In November, an investigation by Reuters revealed more than 70 Iranian websites dedicated to promoting its agenda around the world. Many of their accounts in social networks had already been deleted by Facebook, Twitter and Google in operations like the one announced now. It is likely that the turn came to the core of Spanish accounts. One of the disinformation websites analyzed by Reuters, AWSNews, has a channel in Spanish.