SAN FRANCISCO/WASHINGTON, August 22 (Reuters)
Facebook Inc , Twitter Inc and Alphabet Inc collectively removed hundreds of accounts tied to an alleged Iranian propaganda operation on Tuesday, while Facebook took down a second campaign it said was linked to Russia.
Facebook Chief Executive Mark Zuckerberg said the accounts identified on his company's platform were part of two separate campaigns, the first from Iran with some ties to state-owned media, the second linked to sources that Washington has previously named as Russian military intelligence services.
"Such claims are ridiculous and are part and parcel of U.S. public calls for regime change in Iran, and are an abuse of social media platforms," said Alireza Miryousefi, spokesman for the Iranian mission to the United Nations.
The Kremlin rejected Facebook's accusations. Spokesman Dmitry Peskov told reporters that Moscow did not understand the basis for such statements and that they looked like "carbon copies" of previous allegations that Moscow has denied.
Global social media companies are seeking to guard against political interference on their platforms amid rising concerns about foreign attempts to disrupt the U.S. midterm elections in November.
The United States earlier this year indicted 13 Russians on charges they attempted to meddle in U.S. politics, but the alleged Iranian activity, exposed by cybersecurity firm FireEye Inc, suggests the problem may be more widespread.
"It really shows it's not just Russia that engages in this type of activity," Lee Foster, an information operations analyst with FireEye, told Reuters.
FireEye said the Iranian campaign used a network of fake news websites and fraudulent social media personas spread across Facebook, Instagram, Twitter, Google Plus and YouTube, to push narratives in line with Tehran's interests.
The activity was aimed at users in the United States, Britain, Latin America and the Middle East up to and through this month, FireEye said. It included "anti-Saudi, anti-Israeli, and pro-Palestinian themes," as well as advocacy of policies favorable to Iran, such as the U.S.-Iran nuclear deal.
FireEye said the Iranian activity did not appear "dedicated" to influencing the upcoming election, though some of the posts aimed at U.S. users did adopt "left-leaning identities" and took stances against U.S. President Donald Trump.
That activity "could suggest a more active attempt to influence domestic U.S. political discourse" is forthcoming, Foster said, but "we just haven't seen that yet."
"DISTINCT CAMPAIGNS"
Facebook said the Russia-linked accounts it removed were engaged in "inauthentic behavior" related to politics in Syria and Ukraine. It said that activity did not appear to be linked to the Iranian campaign.
"These were distinct campaigns and we have not identified any link or coordination between them. However, they used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing," the company said in a statement.
Facebook last month removed 32 pages and accounts tied to another misinformation campaign without describing its origins, but that U.S. lawmakers said likely had Russian involvement.
Microsoft said this week that hackers linked to the Russian government sought to steal email login credentials from U.S. politicians and think tanks, allegations the Russian Foreign Ministry described as a "witch-hunt."
FireEye said the U.S.-focused Iranian activity ramped up just months after Trump took office, with websites and social media accounts posting memes and articles, some of which were apparently copied from legitimate U.S. and Iranian news outlets.
In some cases, the domains for the fake websites like "US Journal" and "Liberty Free Press" were registered years before the 2016 election, in 2014 and 2013, but most remained inactive until last year, FireEye said.
Arabic-language, Middle East-focused websites appear to be part of the same campaign, the company added.
The technology companies variously said they linked the accounts to Iran based on user phone numbers, email addresses, website registration records and the timing of account activity matching Iranian business hours.
FireEye expressed "moderate confidence" about the Iranian origins but said it has not been able to tie the accounts to a specific organization or individuals.
Hundreds of thousands of people followed one or more of the Facebook pages implicated in the campaign, Facebook said.
It shared examples of removed posts, including a cartoon depicting an Israeli soldier executing a Palestinian and a fake movie poster showing Trump embracing North Korean leader Kim Jong Un.
Postings cited by FireEye expressed praise for U.S. politicians and other Twitter users who criticized the Trump administration's decision in May to abandon the Iranian nuclear pact, under which Iran had agreed to curb its nuclear weapons program in exchange for the loosening of sanctions.
Some Twitter and Facebook accounts were designed to appear as if they belonged to real people in the United States, Britain and Canada, according to FireEye. The accounts used a combination of different hashtags to engage in U.S. culture, including "#lockhimup," "#impeachtrump" and "notmypresident."
Twitter, which called the effort "coordinated manipulation," said it removed 284 accounts.
Facebook said it removed 254 pages and 392 accounts across its flagship platform as well as its Instagram service.
The accounts spent about $12,000 to advertise through Facebook and Instagram. Facebook said it had notified the U.S. Treasury and State departments of the purchases, which may violate sanctions.
Alphabet, parent company of Google and YouTube, did not respond to a request to comment.
