Following the January 2 U.S. military strike that killed Major General Qasem Soleimani of Iran’s Islamic Revolutionary Guard Corps (IRGC), social media platforms experienced substantial engagement around the event. The vast majority of social media engagement was authentic, from a wide array of social media users, which is to be expected during a news event of this magnitude.
Instances of disinformation and misinformation have also proliferated along with the global conversation on escalating tensions between the United States and Iran. The DFRLab, alongside organizations such as Buzzfeed News, other outlets, and a broad community of #DigitalSherlocks, have undertaken a significant effort to monitor the information environment in real time.
The DFRLab will be compiling a list of its Iran-focused reporting here. Identifying, exposing, and explaining disinformation is often iterative and collaborative work, and the reporting outlined below reflects that. Our reporting includes information environments ranging from hyper-local to international and in English, Farsi, and Arabic languages.
Overview:
Over the last two years, the DFRLab has produced one of the largest bodies of primary, open source reporting on Iran’s activity and capability in the space of hybrid threats, which constitutes a large and vulnerable proxy front.
Iran has built a prolific online influence apparatus. Over time, the Iranian government has realigned its propaganda efforts to meet evolving foreign policy goals.
Iranian influence operations are somewhat different than other countries that have been at the forefront of our news cycle over the last few years. In cases the DFRLab has spotted or in which data was made available by Twitter, Facebook, and other platforms, Iran tended to engage in information operations to present its viewpoint and persuade others to its side. This style is extremely different than, say, Russia, which tries to infiltrate online communities and engage to cause more social chaos.
In the coming days, it will be necessary – if sometimes difficult – to distinguish between a very large online conversation with a multitude of sentiment, especially in official or public statements, and covert influence operations or behavior online that is both coordinated and inauthentic.
And beyond the United States and Iran, it is likely that other actors, especially across the Middle East region, will use the escalation to further their own goals in the information space, including using influence operations or manipulative means.
DFRLab reporting on Iran:
January 10, 2020: Alleged hack of Kuwaiti News Agency tweets bodes poorly for crisis coverage
Andy’s piece recounted how, at the height of the ongoing US-Iran conflagration, the Kuwaiti News Agency issued a series of tweets claiming that the United States was withdrawing from the country, only to later delete them under the auspices of having been hacked. The piece puts this claim of hacking in the context of other instances when news media are known to have been hacked.
January 4, 2020: Tensions escalate on social media platforms after Soleimani’s death
Given the magnitude of the event, traffic on Instagram and Twitter following the death of Qasem Soleimani appeared organic but highly sentiment driven. In the immediate aftermath of Soleimani’s death, there is no indication of online influence operations with an international focus deriving from Iran that gained a significant impact. Social media platforms are often the first point of escalation in times of crisis – in this case, high trending hashtags around the event appeared and gained traction quickly.
December 16, 2019: Visual forensics corroborate reports of Iran’s lethal crackdown on protests
The protests in Iran in November 2019 saw the use of a favorite and increasingly frequent tactic of repressive governments: throttling or entirely blocking all or parts of the internet as a means of limiting exposure of often violent suppression of protests. Despite attempting to limit secure messaging platforms, in the case of the November 2019 Iranian protests, the DFRLab was able to confirm or locate many instances of the use of force by the Iranian government.
October 24, 2019: Facebook takes down Iranian assets, some targeting Latin American audiences
Facebook removed a number of pages and groups operated from Iran that specifically targeted Latin America and even the United States. As with most other Iranian Facebook operations, the assets removed were not subtle in promoting pro-Iran messaging behind a veneer of supposedly otherwise focused pages, such as one ostensibly in supporting Black Lives Matter.
May 30, 2019: Facebook Removes Iran-based Assets. Again.
In another content moderation effort, Facebook shut down a number of pages heavy on pro-Iran messaging for inauthentic, or falsified, engagement. Unlike online influence operations from other countries such as Russia, which are designed to exacerbate, or in some cases generate, societal instability via profiles designed to appear local to the online community targeted, Iran – exemplified in this case – is easier to spot in its inauthentic operations: the messaging is often unsubtle in its pro-Iran, sectarian, anti-Israel, anti-United States, or anti-Western bias.
April 19, 2019: Facebook Dismantled Iranian Influence Operation
As with other countries, highly biased – and sometimes outright false – coverage from state-run news outlets, such as the Islamic Republic of Iran Broadcasting (IRIB), is often matched with inauthentic social media amplification produced by online networks. In this case, the DFRLab had an exclusive investigation of efforts to game IRIB’s online reach on Facebook, with the intent to inflate the Iranian government’s narratives, prior to the network’s removal from Facebook.
March 26, 2019: KEY FINDINGS: Iranian Propaganda Network Goes Down
As with most online influence operations deriving from Iran, the network featured in this piece promoted pro-Iran, sectarian, anti-Israel, anti-U.S., and anti-Saudi messaging, often reposting content from Iranian state media. This online network was notable for the geographic diversity in its targeting audiences across Africa and much of South Asia, which suggested it to be state-backed given the resources necessary to undertake such an effort.
March 26, 2019: IN DEPTH: Iranian Propaganda Network Goes Down
Given the size of the network summarized above, this in-depth investigation details the open source and digital forensic evidence of an Iranian online network targeting audiences in most of Africa and much of South Asia.
February 25, 2019: #TrollTracker: Spam Attack on Secretary Pompeo
A flood of seemingly coordinated replies to an Instagram post on U.S. Secretary of State Mike Pompeo’s official account displayed anti-U.S. or pro-Iran sentiment. The activity showed how Instagram is emerging as a vector for coordinated campaigns, with a handful of accounts generating a significant volume of traffic on individual posts.
January 31, 2019: #TrollTracker: Outward Influence from Iran
Facebook removed yet another Iranian operation, easily identifiable by the content, behavior, and narratives by the assets. Notable in this case, however, was the amount of time many of the assets had been on the platform, with many assets active for more than five years. The finding is a recent but significant record of how long Iran has carried out social media influence operations.
October 26, 2018: #TrollTracker: Facebook Uncovers Iranian Influence Operation
The operation detailed in this report indicated that Iran has the capacity to be more sophisticated in its operations, as the pro-Iran messaging from these assets was often buried in more local, and divisive, political content. For example, many of the pages involved posted content regarding the 2018 U.S. midterm elections, mostly targeting left or left-leaning audiences that would be predisposed to agree with some narratives of the United States as an imperial power.
October 17, 2018: #TrollTracker: Twitter Troll Farm Archives
In 2018, Twitter released an enormous data set of 10 million tweets the platform assessed to be networks aligned or controlled by nation states as a means of covert influence. Of the overall set, 9 million were Russian, some from operated by the Internet Research Agency, while 1 million were Iranian. The DFRLab had exclusive access to the data prior to its release, and this investigation dives into the Iranian assets. The Iranian Twitter accounts pointed the platform’s users toward off-platform websites disguised as news outlets that predominantly posted content backing the Iranian government’s foreign policy positions. As with other cases, the DFRLab could only isolate the culprits to the country of Iran and not to its government.
August 29, 2018: #TrollTracker: An Iranian Messaging Laundromat
Following up on a Reuters report, the DFRLab identified a cluster of websites under the banner of the “International Union of Virtual Media” (IUVM) posting exclusively pro-Iran content. In doing so, it effectively laundered content from Iranian state media, lending it an air of credibility by stripping the affiliation, thereby enabling it to be passed to less discerning readers as (ostensibly) credible.
August 27, 2018: #TrollTracker: Iran’s Suspected Information Operation
Building on a high profile report from FireEye that exposed an Iranian influence operation, the DFRLab concluded that it was the first instance of a large-scale troll operation targeting Western protest groups (predominantly in the United States and the United Kingdom) run by a nation other than Russia in the lead up to 2018 U.S. midterms.
Image: A woman walks past an anti U.S. mural on the former U.S. Embassy's wall in Tehran, Iran January 7, 2020. Nazanin Tabatabaee/WANA (West Asia News Agency) via REUTERS