Twitter has released seven datasets with networks that it has attributed to Iran. The datasets indicate techniques aimed at interfering in domestic politics and conflicts across Eurasia and the US. Iran’s information warfare campaigns have sought to influence perceptions of Iran while stirring up political division and encouraging unrest in adversary states. For example, that has included supporting the Houthi side in Yemen’s civil war and attempting to intervene in presidential debates in the US. These networks also amplified content relating to social divisions in the US, such as the Black Lives Matter movement.
Some networks benefited from a sophisticated fake news and state media apparatus. The most shared links overall were to AWDNews, which was used to host fake news sites. Five of the top 10 most shared links were to the French version of AWDNews, and one to the English version. The website shared stories on Charlie Hebdo and imminent terrorist attacks in the US. The network also integrated its efforts across platforms; the second most shared link was to the Telegram channel Pars Today Russian and the third being to Pars Today Dari’s Facebook page. The channels are a part of Iran’s state international broadcasting network.
The network’s fake personas were sometimes convincing, well-rounded characters, giving the appearance of locals concerned with particular political issues. The more than 8,000 accounts disclosed by Twitter are diverse: they ranged from a New York-based political analyst and a Bollywood actor parody account to political activists or fringe media. As measured by follower count, the most influential accounts were fake news organisations and political activists. While followers can be purchased and are not necessarily organic, they give the appearance of the accounts being credible influencers. Some accounts presented as independent media organisations based internationally, including in the US. Such organisations claimed to promote human rights, social justice and transparency in politics. Along with impersonating social media activists, they encouraged users to take action and advocate for the reform of institutions in the target countries and shared content generally supportive of Iran’s foreign policy.
The operations targeted international audiences in many languages. The presence of customer service-related tweets in Indonesian showed that the network may have used an ‘influence for hire’ network. The campaigns targeted domestic politics of states with a military presence near Iran or otherwise important for Iran’s strategic interests. Some of the most commonly mentioned locations were in Europe, the Middle East, South Asia and the US. Some campaigns also employed sophisticated cyber techniques: the network took control of compromised accounts established by other users. Some tweets bragged that the accounts had been taken over by the Nasrallah Cyber Unit. The network also showed competence in graphic design and the selection of image and video content, from memes to using digitally distorted or otherwise unflattering images of the subjects.
One strand of activity was a negative campaign focused on attacking then incumbent President Donald Trump. Content used to denigrate the US presidential candidate was more humorous and sarcastic, with heavy use of memes. Some content was devoted to supporting individual US Democratic Party candidates, including supporters of Bernie Sanders, although the congressional elections appeared far less important to Iran’s campaign than the presidential election.
