Three Years of Facebook Takedowns of Iran-Sponsored Fake News Pages

A recent report by Facebook declared Iran responsible for the second-largest amount of organized disinformation across its platforms. In May the social media giant published a digest of all the “coordinated inauthentic behavior” (CIB) its teams had uncovered on Facebook, WhatsApp and Instagram between 2017 and 2020, in which it stated that 23 separate influence networks emanating from Iran had been dismantled in four years out of a total of 150 worldwide. This was second only to Russia, with 27, and the total included nine outfits linked directly to the state-owned Islamic Republic of Iran Broadcasting (IRIB).

By itself, the uncovering of 23 covert Facebook campaigns over three years might not seem all that serious. But thousands of Iran-linked accounts, seen and followed by millions of users, have been implicated in the takedowns, masquerading as everything from Arab journalists to African Covid-19 news outlets to US neo-fascist group the Proud Boys. The networks varied in both their aims and levels of sophistication, but many appear to have shared a loose common goal: furthering the foreign policy and ideological objectives of the Islamic Republic of Iran.

In its report, Facebook noted that global state-sponsored CIB tactics had changed down the years, with a gradual shift away from large-scale, noisy campaigns to smaller, “retail” operations – targeting specific groups of people with niche content – and intensified attempts to co-opt real people into online operations.

Last year the Islamic Republic made headlines for global propaganda operations under the banner of the now-defunct International Union of Virtual Media, whose websites were seized by the FBI late last year. But what other Iran-linked operations have been disrupted by Facebook, and who did they target? IranWire took a look at some of the less widely-reported takedowns detailed in Facebook’s archives.

Fake Activist News Platforms

In August 2018, Facebook pulled 652 pages, groups and accounts on its platforms for CIB that originated in Iran and targeted people across multiple internet services in the Middle East, Latin America, the UK and the US.

The company began investigating after receiving a tip from American cybersecurity firm FireEye claiming that false content was being disseminated by more than 600 accounts, most of which originated in Iran.

During investigations, Facebook unearthed a constellation of pages dressed to look like news outlets of a generally activist bent, targeting would-be readers and supporters across the globe. One, called Liberty Front Press, had a presence on Facebook going back to 2013; another, called Quest 4 Truth, purported to be an independent Iranian media organization but was in fact linked to PressTV: the English-language arm of the IRIB.

Accounts in the Liberty Front Press network captured by FireEye before the 2018 takedown.

Liberty Front Press accounts and pages typically posed as news and civil society groups sharing information in multiple countries without revealing their true identity. Many of the posts sought to undermine political leaders in the West and Israel and the operators spent at least $6,000 on Facebook ads to amplify their content.

“The British Left” and Scottish Independence

Accounts in the Iran-sponsored Liberty Front Press network also piggybacked on topical issues in countries of interest. Inexplicably this included republicanism and the referendum on Scottish independence in the United Kingdom, which took place in September 2014.

One of the blocked accounts was called The British Left. Framed as an activist group supporting Jeremy Corbyn, the then-leader of the Labour Party, as well as Scottish independence, The British Left later was found to have no ties at all to The United Kingdom and had originated in Iran. It even dishonestly used the names of real British journalists on its webpages, falsely claiming the Irish journalist Una Mulally was its editor-in-chief.

Sample posts targeting British audiences by Facebook pages linked to Iran.

While the British Left focused its efforts on Scottish independence and later threw its weight behind the UK exiting the European Union, its main page also occasionally zeroed in on other, unrelated geopolitical subjects, including the relationship between then-US President Donald Trump and North Korean leader Kim Jong-Un.

Elsewhere, in August 2017, Facebook was alerted to another 168 Pages and 140 accounts on Facebook sharing content about Middle East politics in Arabic and Farsi, and content about politics in the UK and US in English, which had also paid $6,000 for advertising since July 2012. The latter included an account called Free Scotland 2014, which posted content that appeared to aim to sow political discord in the UK. In 2019 the company also dismantled yet another account targeting readers in the UK called Republicanism for Great Britain.

The ability of fake social media pages to sway elections has been noted by many officials, including Věra Jourová, president of the European Commission, who stated after the removal of The British Left from Facebook in August 2018: “We need to do more to protect our elections and tackle the online challenges to elections head on.”

The American Herald Tribune

In November 2020, the FBI shut down self-described "genuinely independent online media outlet” the American Herald Tribune. This online “newspaper” had employed Americans to write articles in English for the best part of five years, but now both Facebook and FireEye asserted it had in fact been set up by Iranian state media.

The homepage of the American Herald Tribune on July 5, 2019 included stories on Israel benefitting from US military presence in the Middle East and alleged the US was a long-time sponsor of terrorism.

Since 2015 the American Herald Tribune published stories criticizing US foreign policy as well as outright disinformation such as a viral story claiming that Donald Trump’s father was a member of the Ku Klux Klan. It also re-posted content posted elsewhere, including blog posts by pro-Iran analysts and conspiracy theorists.

These “articles” were then re-seeded across Facebook – by a combination of bots and genuine actors – and circulated on other platforms as well. In a bid to stop the misinformation spreading further, Google also removed an array of webpages and Gmail accounts connected to the American Herald Tribune.

In January 2021, CNN reported that the American Herald Tribune had responded to the removal of its Facebook accounts by stating: "It seems that the US government and its allies do not find it suffice to control mainstream media, and is [sic], in fact, desperate to shut down any alternative media that speaks the truth".

Fake News Outlets Targeting the Middle East

In January 2019 Facebook announced it had pulled another 783 pages, groups and accounts for engaging in CIB tied to Iran. The accounts had a following of about 2 million people and were arranged in groups to target specific countries and regions, including Afghanistan, Albania, Algeria, Bahrain, Egypt, France, Germany, India, Indonesia, Iran, Iraq, Israel, Libya, Mexico, Morocco, Pakistan, Qatar, Saudi Arabia, Serbia, South Africa, Spain, Sudan, Syria, Tunisia, the US, and Yemen, going all the way back to 2020.

An Iran-linked page called Ahwaz Saudi Channel claimed in October 2018 that Saudi youth had taken to spraying anti-government graffiti on walls. The right-hand “graffiti” reads “Death to the Al Saud” – spelled wrong.

The page administrators and account owners typically represented themselves as locals while posting news stories and cartoons on current events, under organization names such as “Algeria Observatory”, “Arabic News”, “Tel Aviv Times” and “Dari News”. Fake campaign pages with names like “Voice of Arabic Liberty” and “Israel is a War Criminal” shared the same content more widely.  

Dari News cites Euronews in claiming that the Taliban rescued 600 Afghans from a snowdrift in February 2017.

“Although the people behind this activity attempted to conceal their identities, our manual review linked these accounts to Iran,” Facebook’s initial review said. “We’re taking down these Pages, groups and accounts based on their behavior, not the content they post. In this case, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.”

Posts Targeting BBC Persian

In March 2019 Facebook pounced on yet another welter of 513 Iran-linked pages, groups and accounts on Facebook and Instagram targeting audiences in Egypt, India, Indonesia, Israel, Italy, Kazakhstan and broadly across the Middle East and North Africa.

The findings were shared with US law enforcement. Since December 2013, Facebook said, these propaganda outlets had spent about $15,000 on advertising paid for in US dollars, Indonesian rupiah, Indian rupees, Pakistan rupees, Swiss francs and Canadian dollars.

A page called bbcgraphy, linked by Facebook to Iran, suggested BBC Persian was facilitating ties between the UK and Israel

Many of the accounts reposted content from Iranian state-controlled media. But worryingly Facebook also documented instances of targeting of Iranian journalists working abroad for above-board media organizations. One post in Farsi by a Facebook page called “bbcgraphy”, which bore the logo of BBC News, baselessly accused BBC Persian of facilitating “organizing and coordination between the UK and Zionist Regime”.

Related coverage:

PressTV Offline as FBI Swoops on Pro-Iran 'Disinformation' Websites

Iranian Online Network Still Peddling Coronavirus Disinformation

Iranian State Media's Disinformation about the Protests in the US

Facebook Pulls Plug on "Troll Farm" Posting Pro-Iranian Opposition Content