August 2, 2019
Nathaniel Gleicher, who heads Cybersecurity Policy for Facebook and Instagram, reported on the company’s blog this week that his group had discovered “multiple pages, groups, and accounts” that had been targeted for what he called “coordinated inauthentic behavior .”
The materials immediately were removed from the sites.
According to Gleicher, “We found two separate operations: one of which originated in United Arab Emirates and Egypt, and another in Saudi Arabia. The two campaigns we removed were unconnected, but both created networks of accounts to mislead others about who they were and what they were doing. We have shared information about our findings with law enforcement, industry partners and policymakers.”
He noted that, “In each of these cases, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.
Specifically, the people behind this network used compromised and fake accounts—the majority of which already had been detected and disabled by Facebook’s automated systems—to run pages, disseminate their content, comment within groups and artificially increase engagement.
They also impersonated public figures and managed pages—some of which changed names and admins— posing as local news organizations in targeted countries and promoting content about UAE.
“Although the people behind this activity attempted to conceal their identities,” Gleicher said, “our investigation found links to two marketing firms— New Waves in Egypt, and Newave in the UAE.”
Similarly, to coordinate inauthentic behavior , individuals in Saudi Arabia posed as locals in countries targeted by the campaign often using fake accounts—and created fictitious personas to run pages and groups, disseminate their content, increase engagement and drive people to an off-platform domain.
They managed Pages that masqueraded as local news organizations. The Page admins and account owners typically posted in Arabic about regional news and political issues, including topics like the Crown Prince Mohammad bin Salman, his economic and social reform plan “Vision 2030;” and successes of the Saudi Armed Forces, particularly during the conflict in Yemen.
They also frequently shared criticism of neighboring countries including Iran, Qatar and Turkey, and called into question the credibility of Al-Jazeera news network and Amnesty International. Although the people behind this activity attempted to conceal their identities, our review found links to individuals associated with the government of Saudi Arabia.
To combat the operations that originated in the UAE and in Egypt, Facebook and Instagram disabled 259 Facebook accounts, 102 pages, 5 groups, 4 events, and 17 Instagram accounts. More than 13.7 million accounts followed one or more of these pages; about 9,000 accounts had jointed at least one of these groups and around 65,000 accounts had followed at least one of these Instagram accounts.
To combat illegal effort by the Saudi Arabia government, the company removed 217 Facebook accounts, 144 pages, 5 groups, and 31 Instagram accounts. About 1.4 million accounts followed one or more of these Pages, about 26,000 accounts joined at least one of these Groups, and around 145,000 people followed one or more of these Instagram accounts.
Gleicher stated, “We identified these accounts through ongoing investigations into suspected coordinated inauthentic behavior in the region. Our investigation benefited from public reporting by Bellingcat, an open source research organization.”
Research contact: @facebook