Iran flag

Iran

Iran country

Date Released

17 November 2019

Twitter Takedowns

Seven

Twitter Attribution: Iran

  • Accounts ‘associated with—or directly backed by—the Iranian government’

Key Messages & Targets

  • Promoting the views of the Iranian state
  • Targeting the domestic politics of states with a military presence near Iran or otherwise important for Iran’s strategic interests
  • Targeting US elections with content supportive of certain candidates, amplifying socially divisive issues, or both
  • Content focusing on the Yemeni civil war, discrediting opponents of the Houthis
  • Amplifying disinformation about Israel arming neo-Nazis in Ukraine and Islamic State in Syria

Notable Tactics

  • Impersonating media, civil society groups, activists
  • Amplifying conversations on politically sensitive topics
  • Amplifying news content favourable to Iran
  • Using compromised accounts
  • Spammy activity to gain followers

Twitter Activity

2,724,125

Tweets

8,211

Accounts in dataset

80%

(6,569)

Active accounts in dataset

59%

(1,607,234)

Were retweets

28%

(762,755)

Had media

22%

(599,308)

Had links

48%

(1,307,580)

Used hashtags


Takedown Timeline

Twitter Description

An ‘attempted influence campaign we identified as potentially located within Iran’.


Twitter has released seven datasets with networks that it has attributed to Iran. The datasets indicate techniques aimed at interfering in domestic politics and conflicts across Eurasia and the US. Iran’s information warfare campaigns have sought to influence perceptions of Iran while stirring up political division and encouraging unrest in adversary states. For example, that has included supporting the Houthi side in Yemen’s civil war and attempting to intervene in presidential debates in the US. These networks also amplified content relating to social divisions in the US, such as the Black Lives Matter movement.

Some networks benefited from a sophisticated fake news and state media apparatus. The most shared links overall were to AWDNews, which was used to host fake news sites. Five of the top 10 most shared links were to the French version of AWDNews, and one to the English version. The website shared stories on Charlie Hebdo and imminent terrorist attacks in the US. The network also integrated its efforts across platforms; the second most shared link was to the Telegram channel Pars Today Russian and the third being to Pars Today Dari’s Facebook page. The channels are a part of Iran’s state international broadcasting network.

The network’s fake personas were sometimes convincing, well-rounded characters, giving the appearance of locals concerned with particular political issues. The more than 8,000 accounts disclosed by Twitter are diverse: they ranged from a New York-based political analyst and a Bollywood actor parody account to political activists or fringe media. As measured by follower count, the most influential accounts were fake news organisations and political activists. While followers can be purchased and are not necessarily organic, they give the appearance of the accounts being credible influencers. Some accounts presented as independent media organisations based internationally, including in the US. Such organisations claimed to promote human rights, social justice and transparency in politics. Along with impersonating social media activists, they encouraged users to take action and advocate for the reform of institutions in the target countries and shared content generally supportive of Iran’s foreign policy.

The operations targeted international audiences in many languages. The presence of customer service-related tweets in Indonesian showed that the network may have used an ‘influence for hire’ network. The campaigns targeted domestic politics of states with a military presence near Iran or otherwise important for Iran’s strategic interests. Some of the most commonly mentioned locations were in Europe, the Middle East, South Asia and the US. Some campaigns also employed sophisticated cyber techniques: the network took control of compromised accounts established by other users. Some tweets bragged that the accounts had been taken over by the Nasrallah Cyber Unit. The network also showed competence in graphic design and the selection of image and video content, from memes to using digitally distorted or otherwise unflattering images of the subjects.

One strand of activity was a negative campaign focused on attacking then incumbent President Donald Trump. Content used to denigrate the US presidential candidate was more humorous and sarcastic, with heavy use of memes. Some content was devoted to supporting individual US Democratic Party candidates, including supporters of Bernie Sanders, although the congressional elections appeared far less important to Iran’s campaign than the presidential election.


Here is the databroken down.


Tweets Over Time

Account Creation Over Time


Twitter Activity

Top 10 Most Retweeted Accounts

Top 10 Most Used Hashtags

Top 10 Most Mentioned Countries


Top 10 Most Shared Domains

DomainShares
Loading...data
Loading...data
Loading...data
Loading...data
Loading...data
Loading...data
Loading...data
Loading...data
Loading...data
Loading...data

Top 10 Most Used Twitter Clients

Twitter ClientTimes Used
Loading...data
Loading...data
Loading...data
Loading...data
Loading...data
Loading...data
Loading...data
Loading...data
Loading...data
Loading...data

Posting Activity

Recorded posting patterns, captured tweets, and media data.

Understanding behaviour by looking at daily patterns, captured tweets, and the type of media and commentary made by accounts.

Iran Posting Patterns

Download CSV

To reference this pageuse the button below