What is FireEye?

Kevin Reed

In back-to-back announcements last week, the social media platforms Facebook, Instagram, Twitter, YouTube, Blogger and Google+ reported that they had removed hundreds of user accounts, pages, channels and posts on the grounds of “coordinated inauthentic behavior” and “spreading divisive content and misinformation.” The social media companies further justified their censorship measures with assertions that the closed accounts were linked to a political influence campaign of the Iranian government.

On August 21, Twitter posted the following on its Twitter Safety account: “Working with our industry peers today, we have suspended 284 accounts from Twitter for engaging in coordinated manipulation. Based on our existing analysis, it appears many of these accounts originated from Iran.”

On the same day, the head of Facebook cybersecurity policy, Nathaniel Gliecher, published a blog post titled, “What We Have Found So Far.” He wrote, “We've removed 652 pages, groups and accounts for coordinated inauthentic behavior that originated in Iran and targeted people across multiple internet services in the Middle East, Latin America, UK and US.”

Two days later, Google SVP of Global Affairs Kent Walker published a blog entry titled, “An update on state-sponsored activity,” writing, “We identified and terminated a number of accounts linked to the IRIB (Islamic Republic of Iran Broadcasting) organization that disguised their connection to this effort, including while sharing English-language political content in the U.S.: 39 YouTube channels that had 13,466 total US views on relevant videos; 6 blogs on Blogger; 13 Google+ accounts.”

Many of the shuttered accounts were connected to web sites with left-wing views and political positions opposing the crimes of the American, Saudi, and Israeli governments in the Middle East. Other accounts purported to be in support of US Senator Bernie Sanders and expressed support for Palestinians and opposition to the state of Israel.

As the World Socialist Web Site has explained, the unified actions of the social media companies represent a new stage in an expanding US government-directed censorship of the Internet that began more than a year ago. In August 2017, the WSWS proved that changes to Google’s search algorithms that promote “authoritative” news sources were also suppressing left-wing, socialist and anti-war websites.

That the content of the social posts of supposed “bad actors” and “coordinated manipulation” is in direct conflict with US foreign policy agenda demonstrates that Twitter, Facebook and Google are acting in concert with government entities. In fact, the common thread between the unified censorship of the social media companies was their reliance upon information provided by FireEye, an IT firm with close ties to the US State Department and Wall Street and managed by former military intelligence and law enforcement officers.

What is Fire Eye?

FireEye is a publicly listed $3 billion cyber-security company founded in 2004 and based north of San Jose, in Milpitas, California. The company began by developing expertise in tracking and shutting down botnets that spread email spamming operations around the globe. According to one industry expert FireEye has “become the Navy SEALs of cybersecurity, especially for next-generation cybersecurity threats.”

Through a series of acquisitions over the past five years, FireEye has emerged as a prominent provider of investigative services for high-profile cyber-attacks on American corporations such as the breach of customer data at Target (2013), the hack of Sony Pictures email servers (2014) and the Experian data breach (2017).

A major aspect of the present-day operations of FireEye is government contracts for network security at the state and federal level. FireEye has contracts with US government departments and there have been reports of close ties between the company and the National Security Agency.

FireEye has played a prominent role in the campaign regarding “Russian meddling” in the 2016 elections and it is a proponent of the claims that Russia has “weaponized” social media. The firm published a report on the alleged disinformation and influence campaign of the Russian government following the testimony of FireEye CEO Kevin Mandia before Congress on March 30, 2017.

Mandia served in the United States Air Force and was a computer security officer in the 7th Communications Group at the Pentagon and a special agent in the Air Force Office of Special Investigations. He began his commercial cyber-security career working as a contractor for Lockheed and later founded Mandiant, a company that investigated espionage by the Chinese government and also held contracts with the Defense Department.

The President of FireEye is Travis Reese, who was co-founder of the Computer Forensic and Intrusion Analysis Group at Aegis Research Corporation, which has held multiple Defense Department contracts over the past 15 years. Previously he was a Special Agent with the United States Air Force Office of Special Investigations.

The main financial muscle behind FireEye is Bain Capital Management, the hedge fund once run by Mitt Romney. FireEye’s chairman of the board is Enrique Salem, managing director of Bain Capital Ventures, formerly CEO of Symantec, a director of ADP and other software giants, as well as a member of President Obama’s Management Advisory Board.

The FireEye report on “Iranian Influence”

The censoring of social media accounts by Twitter, Facebook and Google was based primarily upon information provided to them by FireEye. On August 23, FireEye published a 38-page report titled, “Suspected Iranian Influence Operation.”

The report includes flowcharts, account names and screen shots of specific websites and social media accounts that it claims exist to “promote political narratives in line with Iranian interests,” adding, “These narratives include anti-Saudi, anti-Israeli, and pro-Palestinian themes, as well as support for specific U.S. policies favorable to Iran, such as the U.S.-Iran nuclear deal (JCPOA).”

However, as the title of the document suggests, FireEye provides only speculation of any connection between the targeted online publishers and the Iranian government. As with the previous “Russian interference” campaign, where no proof of social media meddling in the 2016 elections was ever provided, the FireEye report says, “While highly unlikely given the evidence we have identified, some possibility nonetheless remains that the activity could originate from elsewhere, was designed for alternative purposes, or includes some small percentage of authentic online behavior. We do not currently possess additional visibility into the specific actors, organizations, or entities behind this activity.”

The concept of “coordinated inauthentic behavior,” a phrase that wreaks of state repression, is being developed and promoted as part of advanced forms of Internet and social media censorship. The technology monopolies are preparing measures, with the assistance of government contractors like FireEye, to shut down the websites, email accounts, social media pages and blog posts of forms of expression that they deem are outside the spectrum of “authentic” sources.

The targeting of supposed Russian and Iranian influence in US politics is part of the strategic rollout of these censorship techniques as they are being tested and perfected. These methods will be used to stifle and shut down social and political opposition by masses of people against growing inequality, war and attacks on democratic rights. We encourage readers to contact the World Socialist Web Site and report instances of social media censorship and to join our campaign to defend freedom of speech on the Internet.