Facebook and Twitter Take Down a U.S. Propaganda Operation Targeting Russia, China, Iran

Twitter, Facebook, and Instagram have taken down a series of accounts that appeared to be running a Russian-language, pro-U.S. influence operation, according to researchers from the Stanford Internet Observatory (SIO) and Graphika, a private research company. The campaign lasted for almost five years, according to the researchers.

The tactics used closely mirror those that the Russian government deployed in the United States during the 2016 election; this time, however, the memes, petitions, fake news, AI-altered profile photos, propaganda, and hashtags deployed were pro-U.S., anti-Russia, and seemingly designed to undermine Russia, China, Iran, and other authoritarian countries, according to the study.

The news highlights an obvious fact but one that rarely receives substantial analysis: that U.S. leaning social media influence campaigns are, ultimately, very similar to those run by adversarial countries. 

“These findings unveil what we believe are the first major covert pro-America and Western operations identified and suspended by Twitter and Meta,” Renée DiResta, research manager at the Stanford Internet Observatory told Motherboard in an email. The report also shows that U.S.-based tech giants are willing to take action on propaganda even when it seems to align with the broader interests of the U.S. government.

According to the researchers, the “joint investigation found an interconnected web of accounts on Twitter, Facebook, Instagram, and five other social media platforms that used deceptive tactics to promote pro-Western narratives in the Middle East and Central Asia.” 

The accounts seemed to promote the views, values, and goals of the United States while attacking the interests of Russia, China, Iran, and other countries. “The content included messages that criticized the Russian government for the death of civilians and its ‘imperial ambitions’ after its invasion of Ukraine,” the report said.

Some of the accounts linked to the influence campaigns were posting as early as 2012, but the bulk of the influence campaigns seem to have run from the summer of 2019 until 2022. The Twitter dataset covered  299,566 tweets by 146 accounts and the Meta dataset included 39 Facebook profiles, 16 pages, two groups, and 26 Instagram accounts. After taking down the relevant accounts, Meta and Twitter provided a set of the activity to both sets of researchers, according to the report.

In the campaign focused on influencing Russia and other countries in Central-Asia, the operators posed as fake media personalities linked to fake news accounts. The accounts would copy and paste the same news stories and posts across several accounts and ask users for engagement by asking them to comment on what they’d just read. In some cases, the articles and information posted wasn't "fake news," per se, but, according to the researchers, it was often posted in a coordinated way that is banned by the social media platforms.

According to the researchers, the fake news stories were often copy and pasted from legitimate outlets like Meduza.io and the BBC Russia Service. The posters would make minor changes to the stories in an attempt to pass them off as original, but the translations were often poor. “In one case, the outlet posted a Russian-language article about Russian disinformation in China that was almost certainly translated from the English-language version of a Ukrainian article published nine days earlier,” the report said.

Fake journalists and fake influencers required pictures. According to the research, the influence campaign cast a wide net and pulled pictures from dating sites. Sometimes these pictures were altered to tweak the appearance of the user. The most striking example is a photo of Puerto Rican actor Valeria Menendez whose altered face was used in the Central Asian campaign.

Some of the memes attempted to appeal to Central Asian migrants in Russia.  “Several posts covered the pressured, sometimes forced enrollment of Central Asian migrants into the Russian army in exchange for promises of Russian citizenship,” the report said. “This narrative overlapped with posts about the high casualty rate for ethnic minorities fighting for Russia in Ukraine.

The influence campaigns focused largely on Russia, including posts that criticized Russia’s use of propaganda to spread anti-Western sentiment. The posts often “depicted Russia as a nefarious actor working to undermine independent democracies,” the report said. “In January 2022, for example, the accounts covered mass protests that followed a sudden increase in fuel prices in Kazakhstan, but mainly through the lens of debunking Russian allegations of ‘foreign interference.’”

The accounts were mostly focused on Russia, but did attempt to spread influence in China, Iran, and Afghanistan as well. A few accounts used a similar mix of fake news, copy pasted posts, bad memes, and AI generated faces to needle China about the Uyghur genocide. Posts targeting Iran often focused on Hezbollah and humanitarian issues like women’s rights. “One Instagram post said that by supporting Hamas and Hezbollah, the late Qasem Soleimani had brought poverty and misery to Iran,” the report said.

Multiple Facebook and Instagram posts compared the opportunities available to Iranian women with those in the west. “Posts also noted that little has changed for women in Iran over time. Many posts highlighted domestic protests against hijab dress requirements,” the report said.

None of these campaigns fared well. The researchers found that the inauthentic accounts did not garner all that much engagement. Most of the posts and tweets the researchers reviewed received a “handful” of likes or retweets, and only 19 percent of the covert accounts identified had over 1,000 followers, the report said.

“In this specific case, what’s most striking is the low quality of posts and engagement. We found many copy-paste and spam-like posts that got little or no traction. This demonstrates the limitations of inauthentic posts and engagement on social media for building influence,” DiResta added.

“More broadly, state influence activities stem from strategic objectives. Many scholars have contributed research documenting the vast breadth of state-linked operations run directly by government entities, as well as by mercenaries and contractors worldwide. Governments appear to believe that they serve a purpose; while this manifestation of influence operation activity is a modern update for the social media age, front media and personas have a long and storied history,” she added.

Meta and Twitter have not published their own detailed findings on the operation. In its report, the Stanford Internet Observatory said that Meta said the “country of origin” was the U.S., while Twitter said the activity’s “presumptive countries of origin” were the U.S. and Great Britain.

A Twitter spokesperson told Motherboard that “presumptive country of origin is determined through an analysis of the most frequently seen technical indicators of geolocation.”

Facebook reiterated to Motherboard its stance that this campaign originated in the U.S. The company added this is the first foreign-focused, pro-U.S. network it has taken action on. Facebook has taken down other U.S-based networks, such as one the company linked to Rally Forge, a U.S. marketing firm that was working with Turning Point USA and Inclusive Conservation Group. 

Facebook said it provided data on the campaign to researchers so they can also study its activity across YouTube. YouTube did not immediately respond to a request for comment.

Update: This piece has been updated to include a response from Twitter.

Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.