Tech Giants Target Accounts Linked to Iran
Google, Twitter and Facebook remove videos and posts aimed a promoting Iranian propaganda
Google is terminating YouTube channels and removing blogs and Google+ accounts linked to Iran. PHOTO: SOPHIA KEMBOWSKI/ZUMA PRESS
America’s biggest tech companies are zeroing in on Iran, scrubbing their online networks of fake accounts, videos and social-media posts by the rising cyber adversary aimed at spreading misinformation.
Alphabet Inc.’s GOOGL +0.66% Google on Thursday said it had terminated dozens of YouTube channels found to be pushing misinformation on behalf of Iran’s state broadcasting arm. The announcement marked the latest in a flurry this week from major online businesses detailing efforts to curtail foreign abuse on their networks, many involving Tehran.
Until now, Silicon Valley’s efforts have been focused almost exclusively on Russia, as revelations over the past year about Moscow’s influence operations targeting U.S. politics put pressure on social-media giants to detect and remove Kremlin-sponsored campaigns.
Iran’s tactics are different, cybersecurity experts said, focusing on advancing its foreign policy interests in ways not as extreme as Russia’s efforts to disrupt U.S. elections. Iran’s moves have expanded as the toll of international sanctions against the nation rose and tensions between Washington and Tehran increased.
Tech companies are also under renewed pressure as a number of top executives are slated to testify before Congress in early September about how their internet platforms were hijacked by foreign actors and what they are doing to prevent future abuses.
Google’s investigators uncovered evidence that the accounts it took down are connected with the Islamic Republic of Iran Broadcasting, which has been under U.S. sanctions since 2013, and date back to at least January 2017.
Related Video
How Russian Trolls Collected Americans' Personal Information
The Kremlin-backed Internet Research Agency, a.k.a. the Troll Factory, used fake social media accounts before and after the 2016 U.S. election to collect sensitive personal information on Americans, a Wall Street Journal investigation has found. Shelby Holliday explains how the Russian schemes worked.
The company said it had terminated 39 video channels on YouTube, six blogs on its Blogger platform and 13 accounts on the Google+ social-networking hub that it said were linked to the IRIB. The YouTube channels had collectively accumulated 13,466 U.S. views of the relevant videos, Google said.
“Actors engaged in this type of influence operation violate our policies, and we swiftly remove such content from our services and terminate these actors’ accounts,” Kent Walker, the company’s senior vice president of global affairs, said in a blog post announcing the actions.
Alireza Miryousefi, a spokesman for the Iranian mission at the United Nations, said the account terminations are part of a broader effort by American social media companies “to placate their critics in Washington with allegations against countries many in the U.S. government considers foes.” He said the allegation that Iran was behind a coordinated campaign was a “nonsensical accusation.”
A Google spokeswoman declined to comment on why the actions against the Iranian accounts occurred now, or whether there had been pressure from the U.S. government to act.
When Clint Watts, a research fellow with the Foreign Policy Research Institute, first began studying Russian influence operations about five years ago, there was already evidence of this type of activity by Iran’s state media, he said. But Iran’s efforts haven’t received as much attention as Russia’s because they don’t appear to have focused on influencing U.S. elections.
Painted into a corner politically and economically by sanctions, Iran has long sought to push its interests and needle its enemies through the internet. Security researchers have linked Iran to sophisticated spear-phishing attacks (which use fake emails to induce the recipient to reveal confidential information such as passwords), destructive malware and the infiltration of critical computer systems associated with its regional and global adversaries, primarily the U.S., Israel and Saudi Arabia.
Discovery of the alleged Iranian peddling of misinformation coincides with rising tensions between Washington and Tehran. The Trump administration withdrew from the Iranian nuclear deal in May, a multilateral pact that freed Iran from international sanctions in exchange for curbs on its nuclear weapons program.
Mr. Trump’s decision fueled speculation among many cybersecurity experts that Iran may seek to retaliate with increased cyberattacks.
Google said it had briefed the Senate Intelligence Committee and law-enforcement officials about its investigation. The accounts linked to the IRIB “disguised their connection” to Iran’s covert influence operation, Google said.
Google also said it had removed 42 YouTube channels connected to the Russian troll farm known as the Internet Research Agency since it began monitoring that threat last year. Those channels had produced 58 English-language political videos that accumulated fewer than 1,800 views in the U.S., Google said.
The Iranian effort was discovered by the security company FireEye Inc., which reported a handful of suspicious accounts operated under the name Liberty Front Press to Google,Facebook Inc. and Twitter Inc. about two months ago.
The FireEye research reflected how companies that made their names investigating data breaches and providing traditional cybersecurity services have found a new business in spotting foreign-backed deception on social media platforms.
The fake accounts promoted “particular narratives and angles in line with Iranian national interests,” such as pro-Palestinian and anti-Israeli stories, said Lee Foster, a manager with FireEye’s analysis group. The effort linked to articles posted on Iranian-run websites designed to look like independent media outlets or nongovernmental organizations run out of the U.S., Chile or the U.K., FireEye said.
Google’s move came days after Facebook said it had taken down 652 pages and accounts and Twitter suspended 284 accounts they said were part of Iranian influence efforts. At the time, YouTube said it had removed one account believed to be tied to Iranian state media.
Also this week, Microsoft Corp. said it had seized six spoofed internet domains set up by the same Russian hacking group linked to the 2016 election cyberattacks on the Democratic Party. Russian hackers appeared to be broadening their targeting ahead of the U.S. midterm elections in November to include well-connected conservative groups, Microsoft said.
Google executives have appeared before congressional committees this year, alongside officials from Facebook and Twitter, and are due before the Senate Intelligence Committee on Sept. 5. But on Thursday, Sen. Richard Burr (R., N.C.), who heads that committee, said he had rejected Google’s offer to send Mr. Walker, apparently in an effort to force a more-senior executive to appear before lawmakers.
Google’s YouTube is one of the world’s largest social-media communities, with more than 1.8 billion monthly users, compared with 2.2 billion on Facebook and 335 million on Twitter.