WASHINGTON — Starting in April 2018, a group of anonymous people created fake American social media accounts to pose as journalists, plant letters to newspapers and impersonate Republican candidates for Congress — all in an apparent effort to promote Iranian interests.
Was this the work of an Iranian intelligence service? A third country? A band of pranksters?
It's not completely clear who was behind the campaign, according to reports released Tuesday by Facebook and a leading cybersecurity company, FireEye.
But what it shows, the companies say, is that the tech-fueled media environment which makes the United States a global beacon for free expression has also opened American consumers to exploitation and manipulation. And there is yet no good answer for what to do about it.
"This demonstrates that actors who engage in this type of influence activity leverage all manner of different tactics and techniques that stretch across a wide variety of media and platforms," Lee Foster, who leads FireEye's intelligence team, said. "This is a societywide issue that we really have to come to terms with and figure out a way to effectively tackle."
"We risk the U.S. information space effectively becoming a free-for-all for foreign interference," he added.
The FBI declined to comment, pointing NBC News to a statement by Director Christopher Wray, who told Congress on May 7, "On the counterintelligence side, we're facing a uniquely challenging time in terms of foreign investment, foreign influence; China, Russia, North Korea, Iran. I could go on and on there."
Based on a tip from FireEye, Facebook said Tuesday it removed 51 Facebook accounts, 36 pages, seven groups and three Instagram accounts involved in what it called "coordinated inauthentic behavior that originated in Iran."
"The individuals behind this activity — which also took place on other internet platforms and websites — misled people about who they were and what they were doing," Nathaniel Gleicher, head of Facebook's cybersecurity policy, said in a blog post.
"They purported to be located in the US and Europe, used fake accounts to run Pages and Groups, and impersonated legitimate news organizations in the Middle East. The individuals behind this activity also represented themselves as journalists or other personas and tried to contact policymakers, reporters, academics, Iranian dissidents and other public figures. A number of these account owners also attempted to contact Instagram accounts, some of which later posted content associated with this activity."
The Facebook action encompassed accounts that were different from but related to the ones FireEye identified, including accounts that were aimed at countries aside from the U.S. and the United Kingdom. Facebook takes down accounts engaged in deception, not because of who they are or what they say, company officials say. Facebook said it would prove the operation originated in Iran, but was not prepared to attribute it to specific people or the government.
The focus of the Facebook campaign was not so much to build followers, but to create fake personas that could be used to reach out to real people, Gleicher said.
The disclosures come on the heels of a report by FireEye last year that identified an Iranian influence operation making use of fake news sites and social media accounts aimed at audiences around the world. The tactics included impersonating Americans of all political stripes.
Last month, Citizen Lab, a research group at the University of Toronto, uncovered what it said was a separate pro-Iranian influence operation that used social media to spread bogus articles online and attack Iranian adversaries.
FireEye identified a network of English-language social media accounts "that engaged in inauthentic behavior and misrepresentation and that we assess with low confidence was organized in support of Iranian political interests," the company said Tuesday in a report obtained by NBC News.
"In addition to utilizing fake American personas that espoused both progressive and conservative political stances, some accounts impersonated real American individuals, including a handful of Republican political candidates that ran for House of Representatives seats in 2018."
Most of the Twitter accounts in the network appear to have been suspended on or around May 9, the report says.
According to a Twitter spokesperson, "We removed this network of 2,800 inauthentic accounts originating in Iran at the beginning of May. FireEye, a private cybersecurity firm, has issued a report and chosen not to share information or insights with Twitter prior to publication which is outside standard, responsible industry norms. Responsible disclosure should include notification and information sharing to protect against informing bad actors. Going public without these elements harms the credibility of the security research community, whose insights we support and appreciate.
"Our investigations into these accounts are ongoing. As we continue to investigate potential wider networks and actors, we typically avoid making any declarative public statements until we can be sure that we have reached the end of our analyses. As standard, once we have completed our review, we disclose the full account sets and content to our archive of information operations to enable public and academic research."
Fake personas in the network had material published in the U.S. and Israeli media outlets, lobbied journalists to cover specific topics, and appear to have orchestrated audio and video interviews with unsuspecting Americans and British citizens about various political issues, FireEye reported.
Many of the accounts tweeted the same messages, which is one way FireEye assessed they were linked.
"While we have not at this time tied these accounts to the broader influence operation we identified last year, they promoted material in line with Iranian political interests in a manner similar to accounts that we have previously assessed to be of Iranian origin," the company said in a report obtained by NBC News. "Most of the accounts in the network appear to have been suspended on or around the evening of May 9, 2019."
The fake personas expressed support for the Iran nuclear deal, denounced the Trump administration's designation of Iran's Islamic Revolutionary Guard Corps as a foreign terrorist organization, and criticized a U.S.-led conference in Warsaw that focused on Iranian influence in the Middle East.
They also blasted Trump's veto of a resolution passed by Congress to end U.S. involvement in the Yemen conflict.
There were some indicators that the network was operated by Iranians, FireEye said. For example, one account in the network, @AlexRyanNY, created in 2010, had only two visible tweets prior to 2017 — one of which, from 2011, was in Persian.
In 2017, @AlexRyanNY claimed in a tweet to be "an Iranian who supported Hillary."
Additionally, while most of the accounts in the network had their interface languages set to English, one account had its interface language set to Persian, FireEye found.
Last year, one of the accounts impersonated Marla Livengood, a Republican candidate for California's 9th Congressional District, using a photograph of Livengood and a campaign banner for its profile and background pictures.
The account began tweeting about generic news but then segued into promoting material more closely aligned with Iranian interests, FireEye said. For example, the account, along with others in the network, commemorated the United Nations' International Day of the Girl Child with a photograph of emaciated children in Yemen, and called attention to the killing of Saudi journalist Jamal Khashoggi. Those are two stories that tend to be bad for Iran's mortal enemy, Saudi Arabia.
"We were not aware of it," Scott Winn, who helped run the Livengood campaign, saod.
"This seems to be kind of an ongoing problem in campaigns … we have people that are looking at what happened in the 2016 election and trying to duplicate that on a local level."
Another fake account impersonated Jineea Butler, a Republican candidate for New York's 13th Congressional District, using a photograph of Butler for its profile picture and incorporating her campaign slogans into its background picture, as well as claiming in its Twitter bio to be a "US House candidate, NY-13" and linking to Butler's website, jineeabutlerforcongress.com.
The network also impersonated regular Americans. One fake persona was "Ed Sullivan," who sent letters that were published in the New York Daily News and other newspapers, including one letter headlined, "Don't shrug off Khashoggi's murder."
U.S. intelligence agencies have the capacity to determine whether this was an Iranian influence campaign, experts say. FireEye said it would continue to pursue that question.
"If it is of Iranian origin or supported by Iranian state actors," the report concludes, "it would demonstrate that Iranian influence tactics extend well beyond the use of inauthentic news sites and fake social media personas, to also include the impersonation of real individuals on social media and the leveraging of legitimate Western news outlets to disseminate favorable messaging."