Twitter, Facebook Delete ‘Iran-Linked’ Accounts Without Looking at Firm’s Report

"Earlier this month, we removed more than 2,800 inauthentic accounts originating in Iran," Twitter Site Integrity chief Yoel Roth tweeted on Tuesday. "These are the accounts that FireEye, a private security firm, reported on today. We were not provided with this report or its findings."

FireEye, for its part, wrote on Tuesday that the firm had recently "investigated a network of English-language social media accounts that engaged in inauthentic behavior and misrepresentation and that we assess with low confidence was organized in support of Iranian political interests."

​Facebook cybersecurity head Nathaniel Gleicher wrote on the company's blog Tuesday that Facebook disabled 51 accounts, 36 pages, seven groups and three Instagram accounts "based on a tip shared by FireEye."

So what's this "inauthentic behavior?" According to FireEye, the accounts, most of which were created between April 2018 and March 2019, posed "as everyday Americans that were used to promote content from inauthentic news sites," although it noted the accounts had since shifted their persona and were now "aligned with progressive political movements in the US."

FireEye says many of the accounts impersonated individuals, including Republican political candidates running for office in the 2018 midterm elections, as well as journalists, by copying their photos and posts. The cybersecurity firm shared images of the impersonations and real pages side-by-side, showing very close mimicry.

However, FireEye's justification for believing the pages were part of an Iranian operation is where their case quickly falls apart.

"Narratives promoted by these and other accounts in the network included anti-Saudi, anti-Israeli, and pro-Palestinian themes," the company wrote. "Accounts expressed support for the Joint Comprehensive Plan of Action (JCPOA), commonly known as the Iran nuclear deal; opposition to the Trump administration's designation of Iran's Islamic Revolutionary Guard Corps (IRGC) as a Foreign Terrorist Organization; antipathy toward the Ministerial to Promote a Future of Peace and Security in the Middle East (a U.S.-led conference that focused on Iranian influence in the Middle East more commonly known as the February 2019 Warsaw Summit); and condemnation of US President Trump's veto of a resolution passed by Congress to end US involvement in the Yemen conflict."

Furthermore, some of the accounts had in 2010 claimed to be Iranian or Iranian-American, and "while most of the accounts in the network had their interface languages set to English, we observed that one account had its interface language set to Persian."

In other words, FireEye told Twitter that some shady impersonation accounts were likely operated from Iran and part of a concerted disinformation campaign, based on the idea that only such a network of operatives could or would share opinions Tehran might agree with, and that some of the accounts either tweeted in Persian at one point or set their account language to Persian.

This revelation would be shocking, if it weren't already known to be par for the course for Twitter and FireEye.

Sputnik has previously reported on FireEye's shady origins: founded in 2004 with money from the CIA's venture capital arm, In-Q-Tel, the US spy agency doubled down on its alliance with the company in 2009, saying they had a "strategic partnership" and calling it a "critical addition to our strategic investment portfolio for security technologies."

Further, Twitter and Facebook have leaned on FireEye's findings with regards to "attempted influence campaigns" on their platforms by, among other countries, Iran, and deleted thousands of accounts in successive purges of their platforms on the firm's recommendations.

Indeed, at the beginning of its statement, FireEye notes its first such report in August 2018 on "what we assessed to be an Iranian influence operation." However, despite the confident language utilized by Twitter, Facebook, FireEye and related institutions like the Digital Forensics Lab operated by the hawkish, defense industry-funded think tank The Atlantic Council, it was never solidly proven that the network uncovered was from Iran.

At the time of the August report, TechCrunch noted that "the Iranian networks were not alleged to be necessarily the product of state-backed operations, but of course the implication is there and not at all unreasonable."

Twitter reported at that time, "Based on our existing analysis, it appears many of these accounts originated from Iran." Subsequent reports on account takedowns have replicated this caution, although this time around, none of Roth's tweet thread statement shows a hint of uncertainty.

Pretty remarkable, considering FireEye itself admitted it had "low confidence" in its findings, which Twitter had no need to look at before using them as basis for bannings.

The social media giant has had no problem enforcing a specific political agenda in the interests of promoting a narrative of elaborate disinformation conspiracies against established liberal truths. Last month, the company shut down over 5,000 accounts it accused of being part of a network dedicated to discrediting the Russiagate narrative by calling into question the veracity of special counsel Robert Mueller's report, Sputnik reported. However, Twitter made no such accusations of foreign direction in that case.

However, last month Google did go after HispanTV, an Iranian-owned Spanish-language news outlet, blocking access to its YouTube and Gmail accounts.

"We don't expect anything [less] from [US President Donald] Trump and his administration than to behave in this way. And the international community has come to learn and accept this kind of outrageous behavior [against Iran]," Massoud Shadjareh, the founder of the Islamic Human Rights Commission, told Sputnik on April 24, noting that social media platforms and technology companies like Google are supposed to represent freedom of expression.