Facebook says it busted a troll farm run by the Mujahideen-e-Khalq (MEK)—a dissident Iranian group that lobbies for the overthrow of Iran’s revolutionary government—that used artificial intelligence-generated fake faces to populate sham accounts.
The social media company linked the troll farm, based alongside the MEK’s headquarters in Albania, to 300 different assets on Facebook’s platform, including pages, groups, and accounts engaged in coordinated inauthentic behavior.
The MEK, which began as a Marxist revolutionary organization, opposed Iran’s monarchy in the 1970s and fought alongside the Islamic Revolutionary Guard Corps (IRGC) to overthrow the shah of Iran. After the revolution, the IRGC cracked down on the MEK and the group sought refuge in Saddam Hussein’s Iraq. The U.S. designated the group as a terrorist organization in 1997, but the Obama administration removed the designation in 2012.
ADVERTISEMENT
Since then, the group has spent millions of dollars cultivating allies in the U.S. and advocating for regime change in Iran. It’s also spent big on speaking fees for high-profile Democratic and Republican heavyweights it considers allies, including Rudy Giuliani, former Vermont governor and DNC chair Howard Dean, and former Trump national security adviser John Bolton.
The group is known for its strict control of members. A 2005 study by Human Rights Watch based on interviews with MEK dissidents included testimonies about “abuses ranging from detention and persecution of ordinary members wishing to leave the organization, to lengthy solitary confinements, severe beatings, and torture of dissident members.”
In a 2009 study, RAND researchers alleged that the group displayed a number of “cult characteristics,” including “intense ideological exploitation and isolation,” “sexual control,” “emotional isolation,” and other such tactics.
While the U.S. has accounted for much of the MEK’s lobbying focus, the troll farm it ran was apparently focused more on Iranian and diaspora audiences. Facebook says the majority of posts by the troll farm were in Farsi with a smaller number in Arabic and English.
In terms of content, the troll farm pushed traditional MEK messages that criticized Iran’s clerical regime and praised the MEK itself. The trolls also tried to push its audience towards websites that served as fronts for the MEK without disclosing their association with it. The effort, however, was mostly a failure, as the operations “achieved little to no audience visibility,” garnering few followers on its various accounts, groups, and pages, according to Facebook.
MEK trolls used a few different tactics to populate their Facebook properties with identities that would seem authentic. In some cases, the trolls used photos of famous poets as avatars. In a smaller number of cases, the trolls used AI-generated fake faces of people who didn’t exist.
The operation posted content on a schedule that aligned with Albania’s time zone and bore “hallmarks of a so-called troll farm—a physical location where a collective of operators share computers and phones to jointly manage a pool of fake accounts as part of an influence operation,” according to a report on the operation released by Facebook.
Reports of MEK-run troll operations on other social media platforms surfaced long before the recent takedown by Facebook. In 2019, The Intercept reported that Heshmat Alavi, a pro-MEK Twitter account with over 80,000 followers, was run by a team of four MEK social media trolls, according to an MEK defector interviewed by the news outlet. Twitter briefly suspended the Alavi account after The Intercept’s reporting but subsequently reinstated it.
Facebook announced its identification and enforcement against the MEK’s troll farm as part of its monthly announcement of coordinated inauthentic behavior operations on its platforms. The latest report included an announcement of takedowns from 11 different countries, ranging from Mexico to Egypt, Spain, and others.
The company also announced the takedown of a small Iranian-run network aimed at sowing discord within Israeli politics. Facebook says it identified 29 Facebook accounts, two pages, and 10 Instagram accounts involved in an effort to masquerade as left-wing Israelis critical of Prime Minister Benjamin Netanyahu’s government.
In a press conference, Facebook’s head of security policy Nathaniel Gleicher said the scale of the latest monthly takedown of coordinated inauthentic behavior was a reflection of the company’s investments in detection and enforcement—making such operations more difficult for adversaries to pursue in the future.
In a statement released after Facebook’s announcement, the MEK denied any affiliation with the accounts and called the company’s report “absolutely false.”
