BANNER: (Source: @DFRLab)

Facebook removed 783 assets — pages, groups, and accounts — that the company assessed to be associated with an Iran-based network for “coordinated inauthentic behavior.” The network targeted users in more than a dozen countries and posted content in at least eight different languages.

All but 97 pages were previously removed by a mixture of automated systems, spam detectors, or varied platform integrity team. Before the takedown, Facebook shared the remaining 97 active pages with @DFRLab.

Of note, Twitter also took down a number of related accounts, on which @DFRLab will provide subsequent analysis.

The Facebook takedown included pages masquerading as local news outlets, blogs, and social movement pages. It remains unclear using exclusively open sources whether the pages were tied to a single actor or network; however, each of the pages promoted or amplified views in line with Iranian government’s international stances. The pages posted content with strong bias for the government in Tehran and against the “West” and regional neighbors, such as Saudi Arabia and Israel.

The nature of the pages removed by Facebook indicated an organized influence operation. The operation was noteworthy, however, that more than 30 percent of the removed assets were active for five or more years, indicating that Iranian entities have been engaged in social media influence campaigns since as early as 2010.

The 97 pages were created between 2010 and 2018, and at least 38 pages were active for more than five years. In total, the pages amassed nearly 2.5 million followers, of which 1.95 million were not duplicated. The majority of the pages were publishing in Arabic, followed by English, French, and Hebrew. A few pages also posted in Persian and Spanish.

Not all pages in the network had similar levels of engagement. While some amassed more than 250,000 followers, the vast majority of pages (66 out of 97) had fewer than 10,000 followers. The pages with most engagement, according to CrowdTangle, received upwards of 15 million Facebook engagements (likes, shares, comments, video views) in the past year alone.

At least one of these pages had similar versions previously removed by Facebook, according to one of its posts. In the span of approximately one year since its creation, the third version of the same page, which was removed by Facebook in this most recent round, had amassed almost 30,000 followers.

Seventeen of the 97 pages contained information about the location of the page management. This information can be found in the “Page Info” section of a page, and according to Facebook’s online Help Center, “country locations where pages are managed are determined by a person’s information and activity on Facebook products, including the stated location on their Facebook profile, and device and connection information.”

All 17 of the pages containing information about manager location had managers from Iran. Canada, Saudi Arabia, and Syria were other common locations of page managers.

The location of the page managers was a good indicator of how pages of a political and social nature were being run by actors outside the region. The engagement on these pages varied, and some achieved a high amount of engagement and followers.

The pages acted as an amplification mechanism for Iran’s wider geopolitical stances. The map below marks countries with the highest number followers of the removed pages. The majority of the pages garnered followers from Iran. The network also garnered substantial audiences in Israel, Yemen, and the United States.

Five of the removed pages were social movement pages focused on the Israel-Palestine conflict and posed as Palestinian-run campaigns: two posted in French, two in English, and one in Spanish. The overall content shared by each page focused on the ongoing Palestine-Israel conflict and had a strong bias in favor of Palestine.

One of the removed pages published in Spanish and had 10,000 followers. The page’s background image called on its followers to boycott notable Western brands from the United States, France, Israel, and elsewhere.

The two pages in French posted mostly anti-Israel memes.

The network featured five pages in Hebrew, most of which posted images, memes, and political cartoons. One of the pages, @Polcartoons, curated cartoons from various Israeli news outlets that lampooned Prime Minister Benjamin Netanyahu and conservative Israeli political sentiment.

The rest of the pages posted content from the website tel-avivtimes.com, which is registered in Paris, France, and includes some anti-Semitic content.

For instance, an article from tel-avivtimes.com shared by one of the removed pages had the headline (translated from Hebrew) “Why are evangelical Christians so supportive of Israel? Second Tuesday the Jews will be killed.” The tel-avivtimes.com article was fairly nonsensical, claiming in part that Grace Halsell, the late American journalist who wrote extensively on the Israeli-Palestine conflict, said God ordains that 9 million Jews will be killed in a coming war.

Another article on the website conveyed an anti-Israel message by purportedly showing how Europe is against Israel as a Jewish state. The article headline, translated from Hebrew, is “That is why the Europeans want to destroy Israel as a Jewish state.”

Nine of the removed pages featured content related to Saudi Arabia. The page with the highest number of followers was @No2al.saud. According to the page information, it was operated by managers in Iran, Syria, and Turkey.

The page posted content related to the ongoing tensions between Saudi Arabia and Iran. Two of the pages, @thesauditimes and @no2al.saud, posted photoshopped images or memes.

Meanwhile, one of the pages, @PuppetofIsrael referred to some of the Middle East leaders as “terrorists.”

One of the removed pages — @alalsadrr1 — promoted Moqtada al-Sadr, an influential Shi’a cleric and militia leader from Iraq and leader of the Mahdi Army. According to the Wilson Center, in the mid-2000’s, the Mahdi Army received weapons and training from the Islamic Revolutionary Guard Corps and Lebanese Hezbollah agents. In May 2018, The Atlantic reported that the “controversial” leader and his followers had committed brutal atrocities in Iraq, fought the U.S. military in Sadr City and Basra, and were known for corruption.

Apart from Shi’a group amplification, one page in the network, @StopMEK, was promoting views against the People’s Mujahedin of Iran (MEK), the largest and most active political opposition group against the Islamic Republic of Iran Leadership.

The content on the page drew narratives showing parallels between the Islamic State of Iraq and Syria (ISIS) and the MEK.

Apart from images and memes, the @StopMEK page shared a link to an archived report on how the United States was monitoring the MEK’s movement in Iran in the mid-1990’s. The file was embedded as a QR code on one of the page’s images.

Other than posting content about the ongoing Iranian interests across the Middle East, some pages targeted an English-speaking audience, particularly in the United States. One page, @BarackObama.IR, predominantly posted content for an English and North American audience. According to the page information, it was managed by individuals working out of Iran, Canada, and the United Kingdom.

The page posted polarizing content as well as conspiracy theories related to the 9/11 terrorist attack. One of the most widely viewed videos posted on the page in the past year allegedly showed U.S. soldiers mocking Iraqi children. The video was viewed more than 1.5 million times. Another video, which got nearly 900,000 views, argued that 9/11 was an “inside job” executed by the U.S. Government.

The page had 142,000 followers and enjoyed relatively high engagement, getting on average 24,000 interactions every month.

In late 2017, one of the posts on the page received a very high number of shares suggesting that the post was an outlier and could have been promoted or may have garnered inauthentic engagement. The relevant post recounted a story of two policemen trying to arrest somebody and featured the caption, “White Supremacy is being able to Resist Arrest, fight Police, reach for their GUNS. Don’t get punch or kick And no one fears for their life.” The syntax and verbiage demonstrate a high likelihood that a non-native speaker wrote the post.

The network taken down by Facebook was an influence campaign. The pages in the network built their audience by sharing more visual messages, pushed pro-Iranian messages aggressively, and attempted to push audiences in countries Iran sought to influence.

One notable component of this take down was the apparent industry collaboration cited by Facebook and Twitter.

@DFRLab’s research confirms that the main objective of the network was to amplify and spread pro-Iranian messaging on issues important to Iran, including Israeli statehood and the Israeli-Palestinian conflict, U.S. foreign policy, Saudi Arabia’s war in Yemen, and the conflict in Syria.

The tactics and messaging used by this network closely resembles previous Iran-linked influence pages taken down by Facebook in 2018. Taken with Facebook’s own attribution, this suggests that the pages were indeed part of an information operation supporting the Iranian regime.

Follow along for more in-depth analysis from our #DigitalSherlocks.

DISCLOSURE: @DFRLab announced that we are partnering with Facebook to expand our #ElectionWatch program to identify, expose, and explain disinformation during elections around the world. The effort is part of a broader initiative to provide independent and credible research about the role of social media in elections, as well as democracy more generally.

For more information click here.