Fake social media accounts spread pro-Iran messages during U.S. midterms: FireEye

FILE PHOTO: A staff member removes the Iranian flag from the stage after a group picture with foreign ministers and representatives of the U.S., Iran, China, Russia, Britain, Germany, France and the European Union during Iran nuclear talks at the Vienna International Center in Vienna, Austria, July 14, 2015. REUTERS/Carlos Barria

By Christopher Bing

(Reuters) – A network of fake social media accounts impersonated political candidates and journalists to spread messages in support of Iran and against U.S. President Donald Trump around the 2018 congressional elections, cybersecurity firm FireEye said on Tuesday.

The findings show how unidentified, possibly government-backed, groups could manipulate social media platforms to promote stories and other content that can influence the opinions of American voters, the researchers said.

This particular operation was largely focused on promoting “anti-Saudi, anti-Israeli, and pro-Palestinian themes,” according to the report by FireEye.

The campaign was organized through a series of fake personas that created various social media accounts, including on Twitter and Facebook. Most of these accounts were created last year and have since been taken down, the report said.

Spokespersons for Twitter and Facebook confirmed FireEye’s finding that the fake accounts were created on their platforms.

Lee Foster, a researcher with FireEye, said he found some of the fake personas – often masquerading as American journalists – had successfully convinced several U.S. news outlets to publish letters to the editor, guest columns and blog posts.

These writings displayed both progressive and conservative views, the report said, covering topics including the Trump administration’s designation of Iran’s Islamic Revolutionary Guard Corps (IRGC) as a terrorist organization.

“We’re assessing with low confidence that this network was organized to support Iranian political interests,” said Foster. “However, we’re not at the point where we can say who was doing it or where it’s coming from. The investigation is ongoing.”

Before the 2018 midterms election, the nameless group created Twitter accounts that also impersonated both Republican and Democratic congressional candidates. It is unclear if the fake accounts had any effect on their campaigns.

The imposter Twitter accounts often plagiarized messages from the politicians’ legitimate accounts, but also mixed in posts voicing support for policies believed to be favorable to Tehran. Affected politicians included Jineea Butler, a Republican candidate for New York’s 13th District, and Marla Livengood, a Republican candidate for California’s 9th District. Both Livengood and Butler lost in the election.

Livengood’s campaign called the situation “clearly an attempt by bad actors” to hurt her campaign, and noted that Livengood was “a strident opponent of nuclear weapons in Iran.”

Butler could not be immediately reached for comment.

Twitter said in a statement that it had “removed this network of 2,800 inauthentic accounts originating in Iran at the beginning of May,” adding that its investigation was ongoing.

Facebook said it had removed 51 Facebook accounts, 36 Pages, seven Groups and three Instagram accounts connected to the influence operation. Instagram is owned by Facebook.

The activity on Facebook was less expansive than that on Twitter and it appeared to be more narrowly focused, said Facebook head of cybersecurity policy Nathaniel Gleicher. The inauthentic Facebook accounts instead often privately messaged high profile figures, including journalists, policy-makers and Iranian dissidents, to promote certain issues.

Facebook also concluded the activity had originated in Iran.

(Reporting by Christopher Bing; editing by Rosalba O’Brien and Susan Thomas)

U.S. disrupted Russian trolls on day of November election: report

FILE PHOTO: Voters fill out their ballots for the midterm election at a polling place in Madison, Wisconsin, U.S. November 6, 2018. REUTERS/Nick Oxford

WASHINGTON (Reuters) – The U.S. military disrupted the internet access of a Russian troll farm accused of trying to influence American voters on Nov. 6, 2018, the day of the congressional elections, The Washington Post reported on Tuesday.

The U.S. Cyber Command strike targeted the Internet Research Agency in the Russian port city of St. Petersburg, the Post reported, citing unidentified U.S. officials.

The group is a Kremlin-backed outfit whose employees had posed as Americans and spread disinformation online in an attempt to also influence the 2016 election, according to U.S. officials.

“They basically took the IRA (Internet Research Agency) offline,” the Post quoted one person familiar with the matter as saying. “They shut ’em down.”

The Pentagon’s cyber warfare unit, which works closely with the National Security Agency, had no comment on the report. Cyber Command’s offensive operations are highly classified and rarely made public.

The Internet Research Agency was one of three entities and 13 Russian individuals indicted by Special Counsel Robert Mueller’s office in February 2018 in an alleged criminal and espionage conspiracy to tamper in the U.S. presidential race in a bid to boost Trump and disadvantage his Democratic opponent Hillary Clinton.

Prosecutors said the agency is controlled by Russian businessman Evgeny Prigozhin, who U.S. officials have said has extensive ties to Russia’s military and political establishment.

Prigozhin, also personally charged by Mueller, has been dubbed “Putin’s cook” by Russian media because his catering business has organized banquets for Russian President Vladimir Putin.

Since those indictments, the breadth of the troll farm’s activities has come to light. A report by private experts released to the Senate Intelligence Committee said the Internet Research Agency has tried to manipulate U.S. politics for years and continues to do so today.

The report, by an Oxford University team working with analytical firm Graphika, said Russian trolls urged African-Americans to boycott the 2016 election or to follow wrong voting procedures, while also encouraging right-wing voters to be more confrontational.

Since Donald Trump was elected president, the report said, Russian trolls have put out messages urging Mexican-American and other Hispanic voters to mistrust U.S. institutions.

(Reporting by Doina Chiacu and Mark Hosenball; editing by James Dalgleish and Bernadette Baum)