Meta Takes Down Over 200 Covert Influence Operations Since 2017

Meta has taken down over 200 covert influence operations on its platforms since 2017, it revealed in a new report.

The social media conglomerate, which owns Facebook, Instagram and WhatsApp, said these networks were disrupted for violating its Coordinated Inauthentic Behavior (CIB) policy.

The deceptive networks originated from 68 countries and operated in at least 42 languages. Only a third solely targeted audiences outside of their own countries, with the majority focusing on people in their own borders.

The most common location for CIB networks was Russia (34), followed by Iran (29) and Mexico (13), according to the research. Russian operations targeted Ukraine most often, followed by Africa and the United States.

Russian influence operations were run by a variety of actors, such as individuals with links to the Russian military and military intelligence, marketing firms and entities associated with a sanctioned Russian financier.

Tactics ranged from writing spammy comments to running fictitious cross-platform media entities that hired real journalists to write for them.

Meta said that Iranian campaigns since 2021 focused mainly on politics in the target country, with the perpetrators linked to smaller groups, like academics or people with a background in teaching English as a foreign language.

In contrast, most CIB networks originating in Mexico focused on local audiences, often relating to local elections.

Overall, the US was the most targeted country by operations (34), followed by Ukraine (20) and the UK (16).

In September 2022, Meta revealed it closed down two significant but unconnected disinformation operations originating in China and Russia, which attempted to influence public opinion in Western countries.

In the new report, Meta also outlined its investigations into the use of spyware on its platforms in 2022. It noted that “the global surveillance-for-hire industry continues to grow and indiscriminately target people – including journalists, activists, litigants and political opposition – to collect intelligence, manipulate and compromise their devices and accounts across the internet.”

The tech giant highlighted a number of actions it had taken against spyware vendors and users. This included removing around 130 accounts on Facebook and Instagram linked to the Israeli spyware developer Candiru. This network sent malicious links between its own fake accounts to test its phishing capabilities.

In another example, 250 Facebook and Instagram accounts linked to another Israeli spyware company, Quadream, following similar testing activity.

Both Candiru and Quadream were founded by former employees of NSO Group, whose Pegasus spyware has reportedly been used to spy on politicians, journalists and human rights activists in several countries.

Meta emphasized the persistent and adaptive tactics of spyware vendors to avoid detection. For example, it found that many of the entities it removed in 2021 have tried to create new fake accounts.

The firm therefore argued for “a concerted regulatory response by democratic governments” to tackle this issue. “Because surveillance-for-hire services cast their net so wide, no single company can tackle this alone,” said Meta.