Just weeks after Israeli-based fake social media accounts were deleted, pro-Iran accounts were also taken down in a purge on the never-ending war on fake news.

On Tuesday, prominent internet security firm FireEye revealed the details behind their investigation into a network of fake anti-Trump, pro-Iran social media accounts that in some cases impersonated real Americans.

But while eliminating fake news is vital, lost in the outrage over Russia’s interference in U.S.’ elections and lost in the outrage over fake Iranian accounts, is the fact that the United States plays the same game.

The FireEye Report

“In addition to utilizing fake American personas that espoused both progressive and conservative political stances, some accounts impersonated a handful of Republican political candidates that ran for House of Representatives seats in 2018. Personas in this network have also had material published in U.S. and Israeli media outlets, attempted to lobby journalists to cover specific topics, and appear to have orchestrated audio and video interviews with U.S. and UK-based individuals on political issues,” FireEye wrote in their report released on Tuesday.

In response, social media giants Facebook and Twitter deleted thousands of fraudulent accounts associated with anti-Trump and pro-Iran campaigns.

Facebook also announced on Tuesday that based on a tip from FireEye, it had removed 51 accounts, 36 pages, and seven groups from its social media platform as well as three accounts from the company’s Instagram service.

Earlier in May, Twitter removed 2,800 fake accounts originating from Iran, as Yoel Roth, head of Twitter’s site integrity announced in a tweet.

Extensive Fake Social Media Networks

In addition to posing as American politicians, FireEye discovered fake identities acting as American journalists who managed to convince several American mainstream media outlets to publish guest columns, blog posts and letters to the editor.

FireEye spotted two accounts impersonating Republican politicians Marla Livengood and Jineea Butler. Those accounts spread pro-Iran messages as well as general information about U.S politics by copying from the lawmakers’ real account.

FireEye reported:

For example, the account @livengood_marla impersonated Marla Livengood, a 2018 candidate for California’s 9^th Congressional District, using a photograph of Livengood and a campaign banner for its profile and background pictures. The account began tweeting on Sept. 24, 2018, with its first tweet plagiarizing one from Livengood’s official account earlier that month:

Figure 2: Tweet by suspect account @livengood_marla, dated Sept. 24, 2018 (left); tweet by Livengood’s verified account, dated Sept. 1, 2018 (right) (Photo: FireEye)

Scott Winn, one of the leaders of Livengood’s campaign, told NBC News. “We were not aware of it. This seems to be kind of an ongoing problem in campaigns … We have people that are looking at what happened in the 2016 election and trying to duplicate that on a local level.”

The FireEye report also listed a number of individuals it identified as having published fake letters or columns in various U.S. news outlets.

FireEye stated:

We have thus far identified at least five suspicious personas that have had letters or other content published by legitimate news outlets. We surmise that additional personas exist, based on other investigatory leads.

“John Turner”: The John Turner persona has been active since at least 2015. Turner has claimed to be based, variously, in New York, NY, Seattle, WA, and Washington, DC. Turner described himself as a journalist in his Twitter profile, though has also claimed both to work at the Seattle Times and to be a student at Villanova University, claiming to be attending between 2015 and 2020. In addition to letters published in various news outlets, John Turner maintained a blog on The Times of Israel site in 2017 and 2018 and has written articles for Natural News Blogs. At least one of Turner’s letters was promoted in a tweet by another account in the network.

“Ed Sullivan”: The Ed Sullivan persona, which has on at least one occasion used the same headshot as that of John Turner, has had letters published in the Galveston County, Texas-based The Daily News, the New York Daily News, and the Los Angeles Times, including some letters identical in text to those authored by the “Jeremy Watte” persona (see below) published in the Texas-based outlet The Baytown Sun. Ed Sullivan has claimed his location to be, variously, Galveston and Newport News (Virginia).

“Mathew Obrien”: The Mathew Obrien persona, whose name has also been spelled “Matthew Obrien” and “Mathew O’Brien”, claimed in his Twitter bio to be a Newsday correspondent. The persona has had letters published in Galveston County’s The Daily News and the Athens, Texas-based Athens Daily Review; in those letters, his claimed locations were Galveston and Athens, respectively, while the persona’s Twitter account, @MathewObrien1, listed a location of New York, NY. At least one of Obrien’s letters was promoted in a tweet by another account in the network.

“Jeremy Watte”: Letters signed by the Jeremy Watte persona have been published in The Baytown Sunand the Seattle Times, where he claimed to be based in Baytown and Seattle, respectively. The texts of at least two letters signed by Jeremy Watte are identical to that in letters published in other newspapers under the name Ed Sullivan. At least one of his letters was promoted in a tweet by another account in the network.

“Isabelle Kingsly”: The Isabelle Kingsly persona claimed on her Twitter profile (@IsabelleKingsly) to be an “Iranian-American” based in Seattle, WA. Letters signed by Kingsly have appeared in The Baytown Sunand the Newport News Virginia local paper The Daily Press; in those letters, Kingsly’s location is listed as Galveston and Newport News, respectively. The @IsabelleKingsly Twitter account’s profile picture and other posted pictures were appropriated from a social media account of what appears to be a real individual with the same first name of Isabelle. At least one of Kingsly’s letters was promoted in a tweet by another account in the network.

What’s unknown is if the Iranian government was at all involved in the fake account scheme. The FireEye report did not mention who was the mastermind behind the fake social media network impersonating American journalists and politicians.

Who is FireEye?

The current CEO of FireEye is Kevin Mandia. According to Mandia’s bio on FireEye’s website, “Kevin joined FireEye as Senior Vice President and Chief Operating Officer in December 2013, when FireEye acquired Mandiant, the company he founded in 2004. Before Mandiant, Kevin was the Director of Computer Forensics at Foundstone (acquired by McAfee Corporation) from 2000 to 2003, and the Director of Information Security for Sytex (later acquired by Lockheed Martin) from 1998 to 2000.”

In a 2014 blog post, FireEye addressed rumors that the CIA was involved with the founding of FireEye – rumors which FireEye claimed are not true. FireEye was founded by Ashar Aziz in 2004 with venture capital provided by Sequoia Capital.

FireEye went on:

FireEye does not share or receive any content with any intelligence agencies that is not available to our entire customer base. We make available to all our customers FireEye Dynamic Threat Intelligence, a cloud-based solution that efficiently shares auto-generated threat intelligence to protect all our customers once a threat has been identified in one organization.

FireEye was never a CIA company and we’ve never provided unique intelligence to any government agencies. Our position as a global security company is to be independent of any government agencies and solely focused on protecting our customers around the world.

Five years later on May 1, 2019, the Associated Press reported that FireEye had entered into a  five-year contract with the United States Army Cyber Command (ARCCYBER) “to keep pace with today’s adversaries and evolving cyber threats.”

“Under the Cyberspace Operations Support task order, FireEye will provide professional services to assist with cyber threat intelligence operations, defensive cyber operations (DCO), cyberspace incident response, and cyberspace exercise support and training,” the Associated Press report said.

Facebook and Twitter Prone to Fake Accounts

Between January and March of this year, Facebook deleted 2.2 billion fake accounts, a new high for the company, according to the company’s third Community Standards Enforcement report. In comparison, Facebook deleted 1.2 billion fake accounts in the previous quarter.

Fake account statistics from Facebook’s report:

• • We estimated for every 10,000 times people viewed content on Facebook, 11 to 14 views contained content that violated our adult nudity and sexual activity policy.
  • We estimated for every 10,000 times people viewed content on Facebook, 25 views contained content that violated our violence and graphic content policy.
  • For fake accounts, we estimated that 5% of monthly active accounts are fake.

In May and June of 2018, Twitter deleted 70 million phony accounts, as the Washington Post reported.

In 2018, Juan Guzman, a researcher at UCL, told BBC that Twitter had neglected their bot problem for years.

“Until recently, Twitter did not think bots were a problem on its platform and did not lead a strong bot-detection effort.”

“It was only after Brexit and the 2016 election, where these bots became a liability and Twitter, as well as Facebook began taking them seriously.”

Facebook Removed Fake Israeli Accounts As Well

A few weeks ago, Facebook deleted hundreds of fraudulent Instagram and Facebook pages created by an Israeli company targeting elections in various African countries. Altogether, Facebook deleted 265 Facebook and Instagram accounts, Facebook Pages, Groups and events.

According to a statement from Facebook, about 2.8 million accounts followed one or more of these Pages, about 5,500 accounts joined at least one of these Groups and around 920 people followed one or more of these Instagram accounts.

Facebook also stated that the Israeli company Archimedes Group faked identities of local figures and organizations and posted allegedly leaked information about politicians. The main targets of the Archimedes Groups were countries in Africa such as Tunisia, Togo, Angola, Senegal, and Nigeria. But Archimedes group also operated in Latin America and Asia, according to Facebook’s press release.

Caption: Mali: Justice Survey on a Mysterious Gold Mine from Airbus to Mali Airbus group is quoted in a judicial investigation for scam on a Malian gold mine in balance sheet deposit, whose shareholders have been ruined. The investment project of the aerospace giant in this mine, LED by a close to Malian power, seemed intended to clear occult funds to facilitate the obtaining of military markets in the country. This is a very embarrassing new business…. (Photo: Facebook)

Social media platforms have a major role in driving people to read misleading information. A study conducted by NYU and Stanford in 2017 found that more than 40 percent of visits to 65 hoax news website start from social media.

A study conducted by the Massachusets Institute of Technology (MIT) in 2018 discovered that fake news spreads faster than real news on Twitter. The MIT researchers also found that humans were behind the spread of fake news rather than bots. The study found that fake news was 70% more likely to be re-tweeted than real news.

“False news reached more people than the truth; the top 1% of false news cascades diffused to between 1000 and 100,000 people, whereas the truth rarely diffused to more than 1000 people. Falsehood also diffused faster than the truth. The degree of novelty and the emotional reactions of recipients may be responsible for the differences observed,” the report stated.

The Perils of Bias in Fake News Detection

However, as tech and security firms work more closely with the U.S. government, as FireEye is doing with ARCCYBER, and considering Facebook, Twitter and Google are American companies there is a clear potential for an American bias to factor into bot and fake news detection.

In a late 2017 hearing before the Senate Intelligence Committee, the issue of an American bias was raised.

An exchange between Senator Tom Cotton of Arkansas and Sean Edgett, the general counsel of Twitter was highlighted in an article by The Atlantic. Cotton pressed Edgett as two why Twitter had cut off the CIA’s access to a Twitter analytics service while it still allowed the Russian media outlet RT access.

The exchange as reported by The Atlantic:

“Do you see an equivalency between the Central Intelligence Agency and the Russian intelligence services?” Cotton asked.

“We’re not offering our service for surveillance to any government,” Edgett responded.

“So you will apply the same policy to our intelligence community that you’d apply to an adversary’s intelligence services?” Cotton asked again.

Cotton then turned to WikiLeaks, which the Intelligence Committee has designated as a nonstate hostile intelligence agency, asking why it had been operating “uninhibited” on Twitter.

“Is it bias to side with America over our adversaries?,” Cotton demanded.

“We’re trying to be unbiased around the world,” Edgett said. “We’re obviously an American company and care deeply about the issues we’re talking about today, but as it relates to WikiLeaks or other accounts like it, we make sure they are in compliance with our policies just like every other account.”

“As a global company, we have to apply our policies consistently,” Edgett replied.

When the largest tech and social media companies in the world are American owned, what does that mean for the supposedly unbiased process of bot detection? Is it possible that Facebook and Twitter will have a higher propensity to detect fake social media accounts of non-American actors or companies?

US Creates Fake Social Media Accounts Too

Facebook, did in fact, ban an American company in late 2018 for creating fake social media accounts around the Alabama Senate election. The New York Times broke the story when it obtained an internal memo from the American firm New Knowledge which detailed how it “experimented with many of the tactics now understood to have influenced the 2016 elections.”

“We’ve recently removed five accounts run by multiple individuals for engaging in coordinated inauthentic behavior on Facebook around the Alabama special election, and our investigation is ongoing,” a Facebook spokesperson told Business Insider. “We take a strong stand against people or organizations that create networks of accounts to mislead others about who they are or what they’re doing.”

New Knowledge CEO Jonathon Morgan was banned from Facebook for the activities, but he claimed the Alabama project was done to conduct research and understand how disinformation campaigns work.

“The research project was intended to help us understand how these kind of campaigns operated,” Morgan told the New York Times. “We thought it was useful to work in the context of a real election but design it to have almost no impact.”

The United States government itself has a long and well-documented history of engaging in propaganda and the spreading of fake news – from the decades-long CIA program known as Operation Mockingbird to more modern endeavors.

In 2014, The Associated Press reported that during the Obama administration the U.S. created and funded a Cuban social media network intended to undermine Cuba’s communist government.

ZunZuneo was a U.S.-funded microblogging platform similar to Twitter that targeted Cubans. (Photo: USAID via WikiMedia Commons)

“The U.S. government masterminded the creation of a “Cuban Twitter” — a communications network designed to undermine the communist government in Cuba, built with secret shell companies and financed through foreign banks,” wrote The Associated Press.

In fact, a 2018-2019 budget report for the U.S. Office of Cuba Broadcasting explicitly stated that its plans included using “native” and “non-branded” Cuban Facebook accounts to spread government-created content without informing Cuban Facebook users, as Miami New Times reported.

The budget report stated:

In FY 2018, OCB is establishing on island digital teams to create non-branded local Facebook accounts to disseminate information. Native pages increase the chances of appearing on Cuban Facebook users’ newsfeeds. The same strategy will be replicated on other preferred social media networks.

Back in 2011, the Guardian reported that “the US military is developing software that will let it secretly manipulate social media sites by using fake online personas to influence internet conversations and spread pro-American propaganda.”

“A Californian corporation has been awarded a contract with United States Central Command (Centcom), which oversees US armed operations in the Middle East and Central Asia, to develop what is described as an ‘online persona management service’ that will allow one US serviceman or woman to control up to 10 separate identities based all over the world,” The Guardian wrote.

Fake news, fake social media accounts, fake journalists are not new. Propaganda and control of information has always been and will always be a central tenet of foreign policy and warfare.