Facebook removed over 900 pages in Iran and Indonesia for 'inauthentic behavior' (update)

They were repurposing Iranian state media.

Facebook announced today that it has removed pages, groups and accounts that were apparently engaging in "coordinated inauthentic behavior" tied to Iran and Indonesia. According to Facebook, there were 783 Iranian instances of operating under a false or concealed identity, and were repurposing Iranian state media content as if it was their own. They appeared to be targeting audiences in the Middle East and South Asia, and seem to be part of a network created to spread misleading news. According to Facebook, some of this activity dates back to 2010.

Of the accounts taken down, 262 pages, 356 accounts and 3 groups were from Facebook, and 162 accounts were from Instagram. At least one of the Pages had around 2 million followers, around 1,600 accounts joined at least one of the groups and at least one of Instagram accounts has more than 254,000 followers. The accounts apparently spent less than $30,000 for advertising, though Facebook has not completed review of this yet. Facebook also found that around eight events were hosted, with the first scheduled for May 2014, and the most recent was May 2018. Facebook can't confirm if the events actually took place. Additionally, Facebook says that it has not found any WhatsApp activity related to these accounts.

The accounts had localized content for countries such as Afghanistan, Albania, Algeria, Bahrain, Egypt, France, Germany, India, Indonesia, Iran, Iraq, Israel, Libya, Mexico, Morocco, Pakistan, Qatar, Saudi Arabia, Serbia, South Africa, Spain, Sudan, Syria, Tunisia, the US and Yemen. According to Facebook, the account owners often misrepresented themselves as locals.

"The removal is not related to the nature of the content or who is saying it," said Nathaniel Gleicher, Facebook's head of cybersecurity policy, on a call to the press. He said that the reason Facebook took them down is because they represented themselves to be independent news outlets, when they weren't. "We can see that they are controlled by operators from Iran." Facebook wouldn't specify if the accounts were run by the Iranian government specifically, as there isn't enough evidence to do so, but the implication seems to be that those running the fake accounts were spreading information that was sympathetic to the Iranian state.

Some of the commentary were repurposed Iranian state media on topics relating to Israel-Palestine relations as well as conflicts in the Syria and Yemen that mentioned the roles of other countries like the US, Saudi Arabia and Russia.

Gleicher said that Facebook used sources from its own internal investigation last August as well as information shared from industry partners like Twitter in order to track these accounts down. It also shared the information they found back to Twitter. Gleicher said that the information was also shared to the US Congress as well as the law enforcement groups in those aforementioned countries.

It was a similar story in Indonesia, where Facebook removed 207 Facebook Pages, 800 Facebook accounts, 546 Facebook Groups and 208 Instagram accounts. According to the company, the Pages, accounts and groups were linked to the Saracen Group -- often referred to as a fake news syndicate in Indonesia -- and were removed for "inauthentic behavior," not the actual content they were posting.

"In this case, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action," Gleicher said in a separate statement.

Update: February 1st, 4:35am: This article has been updated to include details of Facebook's separate enforcement in Indonesia.