In some cases the Iranian campaign used the fake accounts to distribute anti-Israeli and pro-Palestinian messages. | Kirill Kudryavtsev/AFP/Getty Images cybersecurity Iran-linked campaign impersonated GOP midterm candidates online

Facebook and Twitter said Tuesday that they have pulled down a network of accounts spreading disinformation that originated in Iran, including some accounts that impersonated 2018 Republican congressional candidates.

Acting on a tip from cybersecurity company FireEye, Facebook said it removed 51 bogus Facebook accounts, 36 pages followed by 21,000 users, seven groups joined by 1,900 users and three Instagram accounts followed by 2,600 people. Twitter said it removed 2,800 accounts.


The revelations from the cybersecurity firm and Facebook's actions serve as a reminder that other governments and foreign adversaries are taking a page from the Russian playbook that disrupted the 2016 presidential election.

It appears that at least in some cases the Iranian campaign used the fake accounts to distribute anti-Israeli and pro-Palestinian messages.

"In addition to utilizing fake American personas that espoused both progressive and conservative political stances, some accounts impersonated real American individuals, including a handful of Republican political candidates that ran for House of Representatives seats in 2018," FireEye wrote in a blog post.

Morning Cybersecurity A daily briefing on politics and cybersecurity — weekday mornings, in your inbox. Email Sign Up By signing up you agree to receive email newsletters or alerts from POLITICO. You can unsubscribe at any time. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Among the candidates impersonated on Twitter were Marla Livengood, who lost in the 9th district of California to Rep. Jerry McNerney (D-Calif.), and Jineea Butler, a 2018 candidate who lost her race for New York’s 13th district to Rep. Adriano Espaillat (D-N.Y.).

The Iranian campaign also succeeded in tricking U.S. and Israeli publications into publishing fake letters to the editor and blogs, according to the report.

"Personas in this network have also had material published in U.S. and Israeli media outlets, attempted to lobby journalists to cover specific topics, and appear to have orchestrated audio and video interviews with U.S. and UK-based individuals on political issues," the firm said.

While FireEye said the accounts promoted Iranian interests, it didn't tie them to a group it blamed for another disinformation campaign last year.

Facebook was more explicit in its statement about the disinformation campaign.

"We conducted an internal investigation into suspected Iran-linked coordinated inauthentic behavior and identified this activity," the company said in a blog post. "We’ve shared our analysis with law enforcement, policymakers and industry partners."

Twitter, however, voiced displeasure with FireEye, while noting it was still investigating.

FireEye "has issued a report and chosen not to share information or insights with Twitter prior to publication, which is outside standard, responsible industry norms," a company spokesperson said. "Responsible disclosure should include notification and information sharing to protect against informing bad actors. Going public without these elements harms the credibility of the security research community, whose insights we support and appreciate."

But one of the affected campaigns feels like Twitter should have done more to remove the fake accounts.

"A strident opponent of nuclear weapons in Iran, Marla is shocked that Twitter was either unwilling, disinterested or too inept to protect users from obvious false information," Scott Winn, a consultant for the Livengood campaign, said in a statement to POLITICO. "Twitter users deserve better."

Martin Matishak contributed to this report.

