These are the liberal memes Iran used to target Americans on Facebook

Jessica Guynn | USA TODAY

Show Caption Hide Caption Analyst: Fake Facebook posts are new hacker phase An analyst following developments with Facebook says fake accounts that the social media giant removed from its site this week show the creators of these accounts are branching out to focus on world events, not just U.S. affairs. (Aug. 22)

SAN FRANCISCO – They were the kind of social media posts that regularly get shared in liberal circles, but they were coming from sham accounts originating in Iran, the most recently uncovered attempt by a foreign adversary to sway U.S. voters.

One meme on Facebook from a page called the Progressive Front showed former first lady Michelle Obama holding a doctored sign that read "An Immigrant Took My Job," a swipe at Slovenia-born Melania Trump. A tweet from the account Liberty Front Press urged people to watch a video of a parent and child reunited after being separated at the border "and be reminded of why we fight every day against the monstrous and evil policies of the Trump regime." YouTube channels featured videos such as "Everything You Need to Know about Impeachment."

The fake pages, tweets and videos were all part of a covert disinformation campaign by Iran that operated in the USA and other countries, major U.S. tech companies said. Facebook, Google and Twitter disclosed last week they were shuttering hundreds of accounts and channels linked to the campaign.

The revelation, the biggest of its kind since Facebook disclosed the extent of Russian manipulation on the social network during the 2016 presidential election, highlighted the growing scale and frequency of disinformation operations threatening the United States, experts on these shadowy networks said.

Iran has denied any involvement.

"Everyone has seen that you can manipulate Americans using false personas online," said Ben Nimmo with the Atlantic Council's Digital Forensic Research Lab, which has been working with Facebook on election integrity. "All you need is an internet connection and the ability to speak English."

This is the first time Iran was nabbed conducting an influence campaign on social media in the USA, experts on disinformation said. It used tactics similar to Russian operatives' during and after the 2016 presidential election.

People with ties to Iranian state media set up social media accounts with fake names to target liberal groups, such as supporters of Sen. Bernie Sanders, I-Vt., in the USA or Scottish separatists in the U.K., a USA TODAY review of the social media posts showed. They then tapped into resentment on such heated topics as the conflict between Israel and the Palestinians, immigration and Britain's vote to leave the European Union, pushing pro-Iranian messages alongside anti-Trump messages or posts backing Jeremy Corbyn, leader of Britain’s opposition Labour Party.

In Europe, more than 20,000 Facebook users followed a page “Free Scotland 2014” supporting Scottish secession that turned out to be a fake page from Iran. One Facebook post from "The British Left" spoofed the film "The Notebook" as The Nukebook, showing North Korean leader Kim Jong Un and President Donald Trump staring into each other's eyes in the rain. It was also a fake.

Social media posts were linked to articles posted on Iranian-run websites that were made to look like media outlets or nongovernmental organizations.

The objective: to hijack the political conversation to promote anti-Israeli, anti-Saudi and pro-Palestinian themes and Tehran's interests around the globe, including U.S. policies favorable to Iran such as a nuclear deal, which Trump scrapped in May, that had lifted sanctions.

"Such claims are ridiculous and are part and parcel of U.S. public calls for regime change in Iran and are an abuse of social media platforms," Alireza Miryousefi, spokesman for the Iranian mission to the United Nations, told Reuters this week.

About 155,000 Facebook users followed at least one of the accounts affiliated with Liberty Front Press, according to Facebook. A review of posts and videos affiliated with the Iranian accounts on Facebook, Twitter and Reddit suggest the influence operation did not gain much traction in the USA, and many posts garnered few likes.

Security company FireEye, which reported suspicious accounts operated under the name Liberty Front Press to Facebook, Google and Twitter two months ago, said Iran's tactics appeared to have been far more focused on advancing its own foreign policy interests than on influencing U.S. elections. If left in place, it's possible the fake accounts and pages could have been used to sway politics, said Lee Foster, manager of FireEye's information operations analysis team.

The attacks on social media point to how vulnerable the American public is, particularly during election cycles, security researchers said.

"This is the kind of thing that I would expect most state intelligence services with advanced information warfare and propaganda capabilities to conduct, and this is just the latest one we have uncovered," said Jonathon Morgan, CEO of New Knowledge, a cybersecurity company that studies disinformation.

Russia has tried it, with some success. Facebook was a major target of a Russian disinformation campaign during and after the U.S. presidential election Hundreds of pages and accounts were discovered to have been created by the Russian-based Internet Research Agency. The organization bought thousands of ads targeting Americans, often with rubles, and created posts with divisive messages that reached 146 million Americans on Facebook and Instagram.

Last month, the social media giant took down 32 pages and accounts that reached 290,000 people. The accounts were critical of Trump, a departure from 2016, when Russian messaging sought to bolster his candidacy and undercut his Democratic rival, Hillary Clinton.

For Iran, the veiled social media campaign marked a shift in strategy – and an escalation, Morgan said. In the past, Iran used cyberattacks on U.S. government agencies, universities and private companies to promote its interests, efforts that increased as international sanctions took their toll. On social media, it spread propaganda through state-run media or on official social media accounts and largely targeted U.S. policy in the Middle East, disinformation experts said.

This new effort was joined by a common thread: People posed as members of opposition groups who are active online to try to harness their passion and energy in support of Iranian foreign policy. One fake Iranian activist page, Patriotic Palestine Front, pushed memes of Israeli aggression.

Facebook did not disclose how many times the posts were shared or liked.

Dozens of posts appeared on Reddit with links to articles from the Liberty Front Press website and popped up in subreddits such as r/esist and r/SandersForPresident.

Disinformation experts said to expect many more such efforts, particularly without a decisive response from the United States.

Though slow to recognize this kind of threat, Facebook has tried to shut down Moscow's influence operations and scrub Kremlin-sponsored campaigns from the giant social network before the midterm elections.

CEO Mark Zuckerberg hinted last week that more revelations of nation-state disinformation campaigns may come to light in coming weeks and months. "I think it's safe to say we have a number of investigations going on, and we'll update you when we know more," he said.

A report this year from the Oxford Internet Institute found disinformation campaigns on social media in 48 countries, up from 28 in 2017, despite efforts to combat the spread of false information.

Facebook's former security chief, Alex Stamos, warned last week that the U.S. government's failure to address these threats has left the United States unprepared and vulnerable for the midterms in November.

The covert information operations show that "America's adversaries believe that it is still both safe and effective to attack U.S. democracy using American technologies and the freedoms we cherish," Stamos wrote in an article published on Lawfare, a national security blog affiliated with the Brookings Institution.

The White House insisted it responded forcefully to election interference, but as the midterm elections loom, private companies have become the first line of defense against foreign adversaries and other bad actors, disinformation experts said.

Last week, Microsoft said it foiled Russian hacking attempts on politicians and think tanks. Companies such as Facebook and Twitter met Friday in San Francisco to collaborate on how to combat disinformation campaigns.

"Fortunately, the platforms have now woken up to this," Nimmo said. "But on the political level, the argument just hasn't caught up yet for all kinds of domestic reasons. Until you have the political leadership, you are not going to get concerted action. So America is in a really bad place at the moment.

"America," he said, "is now seen as a sitting duck for this kind of operation."

U.S.-Iran relationship status: It's complicated The United States and Iran have been lobbing threats, fighting proxy wars, and imposing sanctions for decades. USA Today looks at over 60 years of this back-and-forth.

More: Facebook foils political influence campaigns originating in Iran, Russia ahead of U.S. midterms

More: Google, YouTube targeted by Iran influence operation, shut down dozens of accounts

More: We read every one of the 3,517 Facebook ads bought by Russians. Here's what we found

More: Russian Facebook ads inflamed Hispanic tensions over immigration after Trump election