In the wake of influence-campaign takedowns by Facebook and Twitter, Google has issued a report detailing its own efforts to root out foreign influence operatives allegedly tied to an Iranian state-run media broadcaster.
The news comes as President Donald Trump appeared to tweet in opposition to the efforts of the tech behemoths to disrupt such campaigns.
As part of the influence operation allegedly tied to the Iranian government, Google disabled 39 YouTube channels that had 13,466 total US views on relevant videos; six blogs on Blogger and 13 Google+ accounts, according to Kent Walker, senior vice president of global affairs. He also said that Google uses IP blocking and other methods to prevent Iranian entities from opening advertising accounts, and noted that the breadcrumbs appear to lead back to state-sponsored media in Iran.
“Our technical research has identified evidence that these actors are associated with the IRIB, the Islamic Republic of Iran Broadcasting,” Walker said in a posting yesterday. “Technical data associated with these actors is strongly linked to the official IRIB IP address space. Domain ownership information about these actors is strongly linked to IRIB account information. Account metadata and subscriber information associated with these actors is strongly linked to the corresponding information associated with the IRIB, indicating common ownership and control. These facts, taken together with other technical signals and analysis, indicate that this effort was carried out as part of the overall operations of the IRIB organization, since at least January 2017.”
Facebook and Twitter said earlier this week that they also sanitized their sites of a set of fake accounts, respectively taking down 640 and 284 accounts, respectively. All of the actions were tied to the same wide-ranging pattern of propaganda operations uncovered by FireEye, which the security firm said make use of a complex and deep network of coordinated disinformation pages linked across multiple social-media and web networks worldwide. The firm concluded that the efforts are an alleged attempt to sway public opinion towards pro-Iran stances on various issues, such as the nuclear deal.
“Google’s efforts to track and terminate deceptive campaigns of influence run by inauthentic nation-state actors is a step in the right direction,” said Rick Moy, CMO at Acalvio, told Threatpost. “Deception is one of the most effective and pernicious cyber-threats facing Americans and democracy today. This coordinated action with other security organizations should be welcomed. While some may characterize this as censorship, the evidence presented in the reports is transparent and open to vetting and analysis by the broader community.”
A President Opposed
And indeed, while the takedown actions have been mostly lauded by the security community, the U.S. president has signaled his opposition to the efforts. He tweeted today that “Social Media Giants are silencing millions of people. Can’t do this even if it means we must continue to hear Fake News like CNN, whose ratings have suffered gravely. People have to figure out what is real, and what is not, without censorship!”
Social Media Giants are silencing millions of people. Can’t do this even if it means we must continue to hear Fake News like CNN, whose ratings have suffered gravely. People have to figure out what is real, and what is not, without censorship!
It’s a sentiment that at least one researcher said should be taken seriously.
“We must be careful that private actions done outside of the appropriate legal framework can result in exactly the opposite results that those actions were trying to protect against,” said Joseph Kucic, chief security officer at Cavirin, told Threatpost. He added that while any action taken to prevent any inference with the U.S. political process is appreciated, parameters should be put around the process.
“There should be a governmental process implemented, similar to a FISA court, where appropriate oversight is in place prior to private companies taken actions against perceived bad actors (individuals and/or companies),” he said. “Otherwise, bad actors will purposely target individuals that they want to damage and cause these positive actions to become tools to be used against innocent people. Example: What if Russia or China accessed those Iran assets then launched those social media attacks? When we are detailing with nation-state actors, they are well known for camouflaging their intentions.”
Even so, Walker said that influence campaigns are an ongoing scourge, noting that Google has detected and blocked attempts by state-sponsored actors in various countries to target political campaigns, journalists, activists, and academics located around the world for many months now. For example, last year it sinkholed actors linked to the Internet Research Agency (IRA), which is allegedly a Russian intelligence outfit involved with 2016 election-meddling, and since then has detected and removed 42 related YouTube channels that had 58 English-language political disinformation videos, as well as an account associated with one blog on Blogger.
He also detailed some of the other efforts Google is making on a regular basis to thwart the phishing attempts that often go along with propaganda efforts. For instance, the Google “Protect Your Election” program has “significantly decreased the volume of phishing emails that get through to our users,” Walker said, through the use of automated protections and security keys; he also highlighted specialized warnings for Gmail users for messages that make it through the filters but still seem suspicious.