Facebook announced it took down a slew of accounts, pages and groups in March as part of its campaign against disinformation. The social media giant revealed in its “Coordinated Inauthentic Behavior” report that these accounts are involved in “deceptive campaigns around the world — whether they are foreign or domestic.”
Facebook’s report said that 14 networks from 11 different countries were removed. Among the countries listed as the origin of these operations are Albania and Iran. Those they targeted were “primarily people outside of their countries” - for example, people from Israel. The efforts, Facebook, said, “Focused on domestic audiences in their respective countries.”
One of the operations revealed in Israel centered around the March 23 election and the battle for the Israeli Arab vote, including information about the Joint List. This is very much in line with Haaretz’s recent report about disinformation efforts focused on the local Arab community.
However, the Iranian and Albanian networks specifically reveal an interesting covert war taking place online - one involving Iranians and not just the Islamic Republic and Israel.
The Iranian network did indeed target Israelis. According to Facebook, this is an old network that they had already taken down which tried to push disinformation about Israel to Israelis as part of a wider influence campaign.
“The threat actor behind it attempted to recreate their presence after we disrupted their operation targeting Israel in October 2020. Late last year and in early 2021, they began creating pages and accounts, some of which were detected and disabled by our automated systems,” Facebook said.
The materials reveal that this network "used fake accounts... to post content and create fictitious personas posing as locals in Israel, including left leaning activists. "This also included accounts focused on disinformation about Israel's anti-Netanyahu protests, specifically a page pretending to be the so-called Black Flag movement (one of a number of protest movements involved in the anti-Netanyahu demonstrations)".
- Cyberattacks on Israel: The state’s stupidity is putting officials at risk
- Iranian cyberattack claims new victim – and Israeli hackers vow revenge
- Iranian spy ship targeted by limpet mine in Red sea, Iranian news agency confirms
Facebook noted that this group also maintained a presence on Instagram. Activists in Israel also noted that this fake account purporting to be related to the Black Flag movement was also active on Twitter. It was recently taken down after a post comparing Netanyahu to Hitler was flagged as breaking the social network’s community guidelines.
However, the Facebook report also mentions another network, seemingly unrelated to Iran. The network in Albania was one of the largest revealed in the report - including over 120 accounts, over 60 pages and closed groups, as well as almost 150 Instagram accounts. Though based in Albania, the report notes that it “targeted global audiences including Iran.” Facebook’s investigation revealed the network was linked to a group of Iranian expat dissidents known as MEK active against the Islamic Republic.
Designated as a terrorist group by the U.S. from 1997 to 2012, the Mujahedeen Khalq - or the People's Mujahedin of Iran - was originally founded by leftist university students as an Islamist-Marxist group in 1965.
According to Reuters, the MEK led a guerrilla campaign against the U.S.-backed Shah of Iran during the 1970s, including attacks on American targets. It has since renounced violence and set up a base in Albania where they conduct conferences and reportedly military training, aiming to overthrow the regime.
It’s not the first time MEK have been found to use disinformation to fight the Iranian regime: An investigation by The Intercept found that a supposed anti-regime Iranian activist who had written for Forbes and other outlets was in fact a persona invented by the MEK.
Writing for Haaretz, Jonathan Harounoff noted in 2019 that “the group’s sophisticated cyber operations and social media presence also provoked discussions over the true extent and breadth of the MEK’s support, both abroad and in Iran.”
Facebook conducted a “deep dive” into the network group and found it was “a long-running operation from Albania… run by what appears to be a tightly organized troll farm linked” to MEK.
“The people behind this activity relied on a combination of authentic and fake accounts to post MEK-related content,” the report said, adding that the “network almost exclusively posted about events in, or related to, Iran. It routinely praised the activity of MEK and its leaders and criticized the Iranian government.”
The revelation confirms reports that suggest that the group is investing heavily in its online activities. For example, Facebook found that this network also used so-called deep fakes to create seemingly real people based in Iran.
However, the accounts were exposed as fake and based in Europe. In one of the posts, the group claims to reveal, for example, a secret project conducted by Iran’s Revolutionary Guards. The take down shows that alongside the cyber and information wars between Iran and Israel there is also another inter-Iranian battle taking place, with secular dissidents like MEK waging digital war against the ayatollah regime.