Lawmakers fear US foes using ‘Kremlin’s playbook’ for social media

Tech companies have made aggressive investments to prevent misuse of their products in the two years since, with Twitter telling Congress in July that it was flagging 9.9 million accounts a week for suspicious activity. The company, Facebook, and Google all reported finding accounts linked to Russia’s Internet Research Agency, a Kremlin-linked digital propaganda group.

In the actions announced Tuesday, Facebook shut down 652 pages, accounts and groups linked to Iran and Russia, while San Francisco-based Twitter suspended 284 accounts that appeared to have originated in Iran. Some of the campaigns had been under investigation for months, Facebook Chief Executive Officer Mark Zuckerberg said, as the company balanced its desire to remove them immediately against efforts to understand the operations better so as to improve Facebook’s safeguards.

[Related: Former Facebook security chief: ‘It’s too late to protect the 2018 elections’]

“This is further evidence that foreign adversaries are actively using social media to divide Americans and undermine our democratic institutions,” said Sen. Mark Warner, the vice chairman of the Senate Intelligence Committee, which is holding a Sept. 5 hearing on social media manipulation. “The Iranians are now following the Kremlin’s playbook from 2016.”

Next month’s hearing will allow lawmakers to hear from Facebook, YouTube owner Google and Twitter what additional measures are needed to address disinformation campaigns that Warner and Intelligence Chairman Richard Burr say fall into a void between constitutionally-guaranteed freedom of speech and the government’s regulatory authority.

Such discussions aren’t designed to re-litigate the 2016 presidential election, Burr said at an August hearing on the matter. Rather, “they’re about the integrity of our society. How do you keep the good while getting rid of the bad? That’s the fundamental question in front of this committee and the American people.”

The Iranian and Russian campaigns that Facebook disclosed Tuesday appeared to be distinct from each other, the company said, though “they used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing.”

After a tip from cybsecurity firm FireEye about a social media network known as “Liberty Front Press,” Facebook used website registration information and IP addresses to track a link to Iranian state media that was posting political content primarily related to the Middle East, the U.K., the U.S., and Latin America, said Nathaniel Gleicher, head of the Menlo Park, Calif.-based company’s cybersecurity policy.

Some of the network’s accounts were disguised as news and civil society organizations, spreading information without revealing their true identity or attempting to hack other users’ accounts and spreading malware, Facebook said. The company has shared its findings with the U.S. and U.K. governments, Gleicher said on a conference call.

The pages linked to Russia involved some of the same groups that the U.S. government has previously identified as military intelligence operations, but they were targeting Syrian and Ukrainian politics rather than American elections, Facebook said. One was the Inside Syria Media Center, which has been identified as a spreader of content supporting Russia and Syrian dictator Bashar Assad.

Building defenses against such misinformation campaigns has been difficult, but “we’re starting to see it pay off,” Zuckerberg said. “Our adversaries are sophisticated and well-funded, and we have to constantly keep improving to stay ahead.”

Facebook declined to share further information about the posts since a criminal investigation is ongoing. “We’re working closely with U.S. law enforcement,” Gleichert said.

Twitter is cooperating with law enforcement as well. “Our goal is to assist investigations into these activities and where possible, we will provide the public with transparency and context on our efforts,” the company said in a tweet.