Facebook shuts down ‘coordinated inauthentic behavior’ from Egypt, Saudi Arabia, UAE

“We’re taking down these pages, groups and accounts based on their behavior, not the content they posted,” Facebook’s head of cybersecurity policy said.

In the latest sign that fake accounts remain a popular tool for amplifying political messages on Facebook, the social media company says it has disrupted information campaigns emanating from Egypt, Saudi Arabia, and the United Arab Emirates.

The hundreds of disabled accounts, groups and pages were involved in two unrelated operations, one originating in Egypt and the UAE, and the other in Saudi Arabia. The campaigns — which Facebook labeled as “coordinated inauthentic behavior” also included accounts on Instagram, which Facebook owns.

Both campaigns used phony pages to post news in support of a political agenda, and both focused on countries in the Middle East and North Africa, Facebook said. The company linked the latter campaign, which supported Saudi Crown Prince Mohammad bin Salman, to the Saudi government.

“We’re taking down these pages, groups and accounts based on their behavior, not the content they posted,” Nathaniel Gleicher, Facebook’s head of cybersecurity policy, wrote in a blog post. “In each of these cases, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.”

The Egypt-UAE operation saw operatives pose as public figures and local news organizations and promote content on the UAE, according to Facebook. The campaign used Facebook posts to allege that Qatar and Turkey support terrorism. The UAE, Egypt, and other regional countries have had a long-running diplomatic dispute with Qatar.

The company removed 259 Facebook accounts and 102 Facebook pages related to that campaign. Its investigators traced the activity to two marketing firms with similar names — Newave in the UAE, and New Waves in Egypt.

Facebook shut down a similar number of accounts and pages involved in the Saudi operation, which featured content on the economic plans of Crown Prince bin Salman, the young Saudi leader whom U.S. intelligence officials say ordered the killing of Saudi journalist Jamal Khashoggi. The information campaign also criticized Saudi rivals Iran, Qatar, and Turkey.

Both campaigns seemed to yield bang for the back. The UAE-Egypt campaign spent $167,000 on Facebook ads, and had more than 13.7 million accounts followed one or more of those Facebook pages. The Saudi campaign spent $108,000 on Facebook and Instagram ads,  and saw about 1.4 million accounts follow one or more of the Facebook pages.

Gleicher said Facebook had shared the data with law enforcement, policymakers, and other companies.

Thursday’s takedown is the latest front in Facebook’s war on propaganda. In January, Facebook removed 783 pages, groups and accounts tied to Iran.

In response to the abuse of its platform, Facebook has ramped up the number of employees working on its safety and security team to 30,000, up from lower than 7,000 from just a few years ago.

In the first quarter of 2019, the company disabled a record 2.2 billion fake accounts.

Exclusive: Senator calls on Commerce to tighten proposed rules on exporting surveillance, hacking tech to problematic nations

Ron Wyden, D-Ore., fears the regulations have a major loophole and don't cover enough repressive governments’ agencies.

Researchers catch Yemeni hackers spying on Middle East military phones

Facebook says it will step up efforts to stop coordinated campaigns that cause harm

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure