Facebook Inc., Twitter Inc. and Alphabet Inc. collectively removed hundreds of accounts tied to an alleged Iranian propaganda operation on Tuesday, while Facebook took down a second campaign it said was linked to Russia.

Facebook CEO Mark Zuckerberg said the accounts identified on his company’s platform were part of two separate campaigns, the first from Iran with some ties to state-owned media, the second linked to sources which Washington has previously named as Russian military intelligence services.

Officials in Iran, where it is a holiday to mark the Muslim Eid al-Adha festival, were not immediately available to comment. Moscow has repeatedly denied using hacking or fake social media accounts to influence foreign elections. The Russian embassy in Washington did not immediately respond to a request for comment.

The move by Facebook and others is the latest attempt by global social media giants to guard against political interference on their platforms. It comes as concerns are rising about foreign attempts to disrupt the U.S. midterm elections in November.

The United States earlier this year indicted 13 Russians for alleged attempts to meddle in U.S. politics, but the latest alleged Iranian activity, exposed by cybersecurity firm FireEye Inc. suggests the problem may be more widespread.

“It really shows it’s not just Russia that engages in this type of activity,” Lee Foster, an information operations analyst with FireEye, told Reuters.

FireEye said the Iranian campaign used a network of fake news websites and fraudulent social media personas spread across Facebook, Instagram, Twitter, Google Plus and YouTube, to push narratives in line with Tehran’s interests.

The Iranian mission to the United Nations did not respond to a request for comment.

The activity was aimed at users in the United States, Britain, Latin America and Middle East up through this month, FireEye said, and included “anti-Saudi, anti-Israeli, and pro-Palestinian themes” as well as advocacy of policies favorable to Iran such as the U.S.-Iran nuclear deal.

FireEye said the Iranian activity did not appear “dedicated” to influencing the upcoming election, though some of the posts aimed at U.S. users did adopt “left-leaning identities” and took stances against President Donald Trump.

That activity “could suggest a more active attempt to influence domestic U.S. political discourse” is forthcoming, Foster said, but “we just haven’t seen that yet.”

‘DISTINCT CAMPAIGNS’

Facebook said the Russia-linked accounts it removed were engaged in “inauthentic behavior” related to politics in Syria and Ukraine. It said that activity did not appear to be linked to the Iranian campaign.

“These were distinct campaigns and we have not identified any link or coordination between them. However, they used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing,” the company said in a statement.

Facebook last month removed 32 pages and accounts tied to another misinformation campaign without describing its origins, but which U.S. lawmakers said likely had Russian involvement.

Microsoft said this week that hackers linked to the Russian government sought to steal email login credentials from U.S. politicians and think tanks, allegations the Russian foreign ministry described as a “witch-hunt.”

FireEye said the U.S.-focused Iranian activity ramped up last year, just months after Trump took office, with websites and social media accounts posting memes and articles, some of which were apparently copied from legitimate U.S. and Iranian news outlets.

In some cases, the domains for the fake websites like “US Journal” and “Liberty Free Press” were originally registered years before the 2016 election, in 2014 and 2013, but most remained inactive until last year, FireEye said.

Arabic-language, Middle East-focused websites appear to be part of the same campaign, the company added.

The technology companies variously said they linked the accounts to Iran based on user phone numbers, email addresses, website registration records and the timing of account activity matching Iranian business hours.

FireEye expressed “moderate confidence” about the Iranian origins, but said it has not been able to tie the accounts back to a specific organization or individuals.

Hundreds of thousands of people followed one or more of the Facebook pages implicated in the campaign, Facebook said.

It shared examples of removed posts, including a cartoon depicting an Israeli soldier executing a Palestinian and a fake movie poster showing President Trump embracing North Korean leader Kim Jong-un.

Postings cited by FireEye expressed praise for U.S. politicians and other Twitter users who criticized the Trump administration’s decision in May to abandon the Iranian nuclear pact, under which Iran had agreed to curb its nuclear weapons program in exchange for loosening of sanctions.

Some Twitter and Facebook accounts were designed to appear as if they were real people in the U.S., Britain and Canada, according to FireEye. The accounts used a combination of different hashtags to engage in U.S. culture, including “#lockhimup,” “#impeachtrump” and “notmypresident.”

Twitter, which called the effort “coordinated manipulation,” said it removed 284 accounts.

Facebook said it removed 254 pages and 392 accounts across its flagship platform as well as its Instagram service. Some of the accounts had events and groups associated with them.

The accounts spent about $12,000 to advertise through Facebook and Instagram using a variety of currencies, Facebook said. The company said it had notified the U.S. Treasury and State departments of the purchases, which may potentially violate sanctions.

Alphabet, which includes Google and YouTube, did not respond to a request to comment.

Def Con, one of the world’s largest security conventions, served as a laboratory for breaking into voting machines on Friday, extending its efforts to identify potential security flaws in technology that may be used in the November U.S. elections.

Hackers will continue to probe the systems over the weekend in a bid to discover new vulnerabilities, which could be turned over to voting machine makers to fix.

The three-day Las Vegas-based “Voting Village” also aimed to expose security issues in digital poll books and memory-card readers.

“We see a lot of value in doing things like this. We think it’s important,” said Jeanette Manfra, assistant secretary of cybersecurity and communications at the U.S. Department of Homeland Security, in an interview.

“The idea is, when we find things here, how do we connect them with the actual vendors and make sure that we are closing this loop back to a coordinated vulnerability disclosure process.”

Def Con held its first voting village last year after U.S. intelligence agencies concluded the Russian government used hacking in its attempt to support Donald Trump’s 2016 candidacy for president. Moscow has denied the allegations.

Organizers have returned ahead of the November elections, in which Democrats hope to take control of the U.S. House of Representatives. Trump’s national security team last week warned that Russia had launched “pervasive” efforts to interfere in the elections.

“These vulnerabilities that will be identified over the course of the next three days would, in an actual election, cause mass chaos,” said Jake Braun, one of the village’s organizers. “They need to be identified and addressed, regardless of the environment in which they are found.”

Participants will have a chance to hack into more than five types of voting machines from manufacturers including Elections Systems & Software and Dominion Voting.

Last year a Danish researcher figured out how to take control of a touchscreen voting system used through 2014 in a remote hack that organizers said could work from up to 1,000 feet away.

A group representing U.S. secretaries of state lauded the goal of bolstering election security, but warned that the findings might be skewed.

“It utilizes a pseudo environment which in no way replicates state election systems, networks or physical security,” the National Association of Secretaries of State said in a statement.

Verified Voting, an advocacy group that helped organise the hacking village, said that some of the voting machine models being tested are still used to tally votes across the United States.

One system, the Dominion Premier/Diebold AccuVote TSx system, is used in 20 states and 23,784 precincts, according to Verified Voting.

Southeast Asian nations hope to strike a joint agreement on cybersecurity in coming days with Russia, accused by the United States of meddling in its elections, after a series of high-profile hacks in the region.

The draft of a document seen by Reuters discusses formalising an agreement with Russia. It is set to be issued by foreign ministers of the 10-member Association of Southeast Asian Nations (ASEAN) at the close of meetings underway with other global lawmakers in Singapore.

“We welcome the further strengthening [of] our cooperation in cybersecurity with Russia through the issuance of the statement of ASEAN and Russian foreign ministers on cooperation in the field of cybersecurity,” the draft document said, adding the title would be updated depending on negotiations. It is due to be published on Saturday.

The host of the ASEAN meeting, Singapore, recently suffered its worst ever cyberattack when hackers stole the personal information of about 1.5 million people, including Prime Minister Lee Hsien Loong, from a government health database. Earlier this year, Malaysia said it had foiled an attempted cyber heist on its central bank.

Neither country has identified the hackers and neither suggested the involvement of Russia.

U.S. intelligence agencies have said a Russian propaganda arm tried to tamper with the 2016 presidential election by posting and buying ads on Facebook. Moscow has denied involvement.

Facebook said on Tuesday it had identified a new co-ordinated political influence campaign to mislead its users and sow dissension among voters ahead of November’s U.S. congressional elections.

Russia last year appointed a dedicated Ambassador to ASEAN based in Jakarta.

Senior officials from ASEAN and Russia met in March in Jakarta for wide-ranging talks on co-operation in political, security and economic fields among others.

]]> 7558