On October 17, Twitter released an archive of over ten million tweets posted by accounts from 2013 through 2018. Of the total, over nine million tweets were attributable to 3,800 accounts affiliated with the Internet Research Agency, also known as Russia’s infamous St. Petersburg troll factory. Over one million tweets were attributable to 770 accounts, originating from Iran.
Each set is included in the same archive; however, because the actors and activity were separate, our analysis was conducted accordingly.
In an effort to promote shared understanding of the vulnerabilities exploited by various types on online influence operations, as well as social media’s role in democracy, @DFRlab had a brief advance opportunity to analyze the nearly complete archive.
What sets this archive apart is Twitter’s consolidation and release of all accounts the platform maintains high confidence are associated with the Russian Internet Research Agency and separate Iranian accounts.
In Part Three of our series, @DFRLab took a deep dive into the content from the Iranian troll farm with a focus on its purpose, behavior, and impact.
Iranian Twitter accounts posted more than one million tweets in six years in an attempt to influence foreign audiences, according to an almost-complete database of their activity shared with @DFRLab.
The Iranian operation was built around over 100 websites which took pro-regime messaging, stripped it of its attribution, and laundered it through a complex ecosystem of websites and social media accounts. Many of the accounts masqueraded as Western or Middle Eastern news outlets or journalists. Twitter suspended the accounts in August, after they were exposed by investigative team FireEye.
The Iranian Twitter campaign was essentially different from that run by the “troll farm” in St. Petersburg, Russia. The Iranian operation focused on using Twitter accounts — usually masquerading as news outlets or individuals — to attract potential audiences towards websites which posted pro-Iranian governemnt messaging. The accounts were eventually suspended for a range of Terms of Service violations, including inauthentic behavior and automation.
The campaign has not been fully attributed. FireEye tracked it to email addresses and phone numbers in Tehran, but did not identify the organization controlling it. @DFRLab’s own research showed that it consistently shared regime messaging, notably from Ayatollah Khamenei. We refer to it as “Iranian” on the basis of its geography and content; this should not be taken to mean “government run.”
Many Identities
The Twitter accounts claimed many different identities around the world. A number posed as media outlets or journalists; others pretended to be concerned citizens. They covered many languages, including English, French, Spanish, Russian, Turkish, and Arabic.
Some of the accounts were overt in their identities, even linking to Iran state-funded media outlet PressTV. These included @IranTodayPTV, whose bio proclaimed, “To know Iran better, follow us at the following times on PressTV channel: Tues: 20:33 GMT Wed: 01:33 GMT Wed: 14:33 GMT Thu: 03:33 GMT Fri: 12:33 GMT Fri: 22:33,” and @PressTVdocs, whose bio proclaimed, “PRESS TV’s documentaries try to reveal the truth with a different outlook on people and issues round the globe.”
Another overtly Iranian account was @real_iran, whose bio proclaimed, “Our goal is to introduce the Real Iran. Find whatever you missed about Iran in http://realiran.org. Judge Iran’s culture,civilization and tourism by yourself.”
This account was captured in February 2017 on the Wayback Machine internet archive.
It was linked to a website which was still active in October 2018, realiran.org. This pointed to a new Twitter account, @iran_reality, which was set up on August 25, 2018, after the earlier account was suspended.
Far more claimed to be operated by outlets in other countries. For example, @realnienovosti1 (Russian for “real news 1”) posted in Russian and claimed to be a Moscow-based “information agency”. It often posted on themes of importance to Iran, as the following Google archive shows.
@whatsupicfr claimed to be a French news site based on crowdsourced information gathering and based in Paris. @VoiceofQuds, which gave “Palestine” as a location, wrote in its bio, “As an independent news media organization we aim to inspire action on the likes of social justice & human rights & advocate transparency in politics.” @ElIntelecto called itself “a journalism project principally dedicated to political, economic and social news in Spain and the world.”
@yedisabah offered followers the chance to “Get the news from the right source! / News, articles, interviews, photos and videos.” @Balkanspost, which gave a Croatian location, said, “The mission of Balkans Post is to bring cogent and accurate analysis of Balkans events in a truthful and unfiltered manner.”
Most of these accounts linked to websites which had the same or similar names as the Twitter accounts, were still operational as of October 2018, and regularly posted pro-Iranian messaging: realnienvosti.com, 7sabah.com.tr, whatsupic.net, and balkanspost.com. The exception was @VoiceofQuds, which linked to known Iranian site libertyfrontpress.com.
Other Twitter accounts in this network posed as individuals. This especially applied to accounts claiming U.S. identities created in late 2017, notably after the Russian information operation against America was exposed.
@MariaLuis91 claimed to be “an independent journalist. A real journalist is unemployed,” giving a location in Nantes, France. @Barbara6Jamison claimed a location in Manhattan; the bio read, “Buddy, can you paradigm?”, a pun on the song, “buddy, can you spare a dime?”
@Jack50Jonathan claimed a location in Atlantic City, New Jersey. @BitaBergius claimed to be “an extrovert game designer” in California. Both were created in August 2017. @daniilsanderson was created in December 2017 and claimed to be “local press” in Seattle. @jennifersm1th1 was created in January 2018 and was ostensibly a journalist in Orlando, Florida.
Some accounts claimed political positions as their main identities. @usresistance1, created in April 2018, gave as its bio, “Proudly followed by @funder and @TheDemCoalition #TheResistance #ImpeachTrump #FBR.” @riseagainstr, screen name “Rise Against the Right,” also proclaimed left-wing “resistance” views.
The account @berniecratss, exposed by FireEye, posed as a supporter of Democratic Senator Bernie Sanders, but was originally called @LibertyFrontPr, and changed its handle in July 2018.
Most of these personalized accounts served as amplifiers of the alleged press accounts and retweeted content more than posting their own.
Priority Messaging
Despite these many — sometimes partisan — identities, the main thrust of the Iranian campaign was to promote Iranian regime narratives on issues of direct importance to the government, judging by the volume of posts involved.
This was a different approach from the Russian “troll farm” accounts, also suspended by Twitter, which focused first on Russian domestic audience, then promoted divisive content in and about the United States, especially U.S. elections.
The Iranian Twitter accounts peaked earlier than the Russian ones, surged in activity in 2014, reached their highest output at the end of 2014, and achieved a second, smaller peak in October 2017.
Some of this traffic appeared to be driven by a network of bots run out of control, rather than a surge in political messaging. Over 23,000 of the tweets posted in December 2014 sent the same text in French to different journalists, commentators, and other users: “Ce qu’ils vous ne diront jamais sur Noel” (translated from French: “What they will never tell you about Christmas”).
The posts were accompanied by links to suspected Iranian site awdnews.fr. This was a core member of the Iranian messaging network, but the sheer volume of identical posts leading to a single article suggests a programming error by the bot herder.
Foreign Policy
Much of the Iranian operation’s Twitter traffic was focused on regional and international relations with partisan connotations, as opposed to explicitly domestic political issues in the target countries. According to a search of the database of 1,122,937 tweets provided by Twitter, the ten most frequently-used terms on geopolitical issues, in descending order, were as shown in the table below.
By contrast, Western political themes or slogans were utilized, but on a much smaller scale.
The narratives which these accounts embraced were closely aligned with Iranian government messaging.
Saudi Arabia
Posts on the Kingdom of Saudi Arabia, for example, were routinely hostile and accused the kingdom of terrorism, atrocities, and war crimes. They were often massively amplified by apparent bots, sometimes one account posting multiple times and sometimes multiple accounts posting.
The following was posted by @BenhadiiHedia on September 11, 2015.
“@JBushNews Donald Trump: 9/11 victims’ blood on Saudi Prince hands”
The headline came from an article on awdnews.com.
The identical text was posted 911 times by three different accounts on the same day, 9/11. The number of posts is unlikely to be a coincidence.
One of the most prolific Iranian accounts, @marialuis91, posted another attack on the Saudi forces 82 times to different users on October 7, 2015. Again, the headline came from an article on awdnews.com.
“@ManonaSoapbox Saudi forces deliberately used poisonous gas in Mecca stampede, says a Saudi expert.
Another Iranian account, @IUVMPressUrd, posted the headline from an article on IUVMpress.com on July 15, 2017.
“Saudi Arabia succeeds in the battle of the British law court to commit more crimes”
One of @marialuis’ busiest days was October 27, 2014. That day, the account posted one text to 500 different users, calling the Saudi embassy in Turkey a “safe haven for ISIL terrorists.” Yet again, the headline came from an article on awdnews.com.
Israel
Some of the Iranian accounts’ posts on Israel were poetic, at least in form. One of them, @PalestinianLM, posted a haiku on July 15, 2018
“Our Palestine
occupied by barbaric
brutal Zionists
#FreePalestine #GreatReturnMarch #RightOfReturn #Nakba
#BDS #GroupPalestine #StopArmingIsrael
#micropoetry #haiku #haikuchallenge #Amwriting"
An ostensibly U.S.-based account, @PFUSA, was blunter, posting this text on June 9, 2016.
“This wasn’t a mistake. It was a cowardly act of terrorism.
On this day 51 years ago the Israelis deliberately murdered 34 American Sailors & wounded a further 174 with the attack on the USS Liberty."
This attack on Israel was posted on September 26, 2018, by an account called @LatinoDespertar (“Latino, awake!”), ostensibly based in Venezuela and focusing on politics, football, and foreign languages.
“#Regalo de #Israel para ti; #sangre , #Division , Desplazamiento
#KurdistanReferendum #DDHH #DerechosHumanos
(Translated from Spanish: A present for you from Israel; #blood, #Division, #Displacement #KurdistanReferendum #HR #HumanRights)
Syria
The Iranian accounts’ messaging on Syria echoed Tehran’s foreign policy, promoted the Assad regime and attacked the U.S. A typical post from @LFPressSyria on October 23, 2017, took the headline from an article on PressTV:
“U.S. has wiped Raqqah off the face of earth.”
Another account, @MeetTheNews, echoed the Russian government’s claims of “liberating” Aleppo, in a post on December 14, 2016, as the siege of Aleppo ended:
“Russia has announced that the Syrian government’s military operations to free the city of Aleppo have come to an end.”
The post copied the first line of an article on PressTV.
@IUVMPressUR copied the headline and lede of an article on the Iranian pro-regime Fars news agency when it tweeted on June 2, 2018:
“ISIL [The Islamic State of Iraq and the Levant] Fails to Prevail over Syrian Army Positions in Eastern Deir Ezzur.
The army men engaged in fierce clashes with ISIL in several flanks in al-Mayadeen desert in Eastern Deir Ezzur.”
Turkey
If the Iranian accounts looked on Russia and Syria with favor, their take on Turkey was anything but. The account @Whatsupic posted one assessment on Turkey’s President Erdogan on April 13, 2017:
“#Erdogan will turn Turkey into Iraq and Syria.”
The headline came from an article on IUVMpress.com.
One more, @marialuis91 was a high performer, posting an anti-Turkish article 656 times to different users on September 16–17, 2014.
The URL led to the awdnews.com website.
Sometimes, posts encapsulated multiple foreign policy objectives, such as this text, which @marialuis91 and fellow-Iranian account @BenhadiiHedia posted almost 750 times to numerous international figures, including the U.S. President’s official Twitter account, on September 8, 2015.
Yet again, the headlines led to an article on awdnews.com.
Messaging, Not Trolling
While these posts clearly amplified Iranian positions, it is questionable whether they should be viewed as a trolling campaign, in the sense of using social media to engage personally with other users.
The overwhelming bulk of these posts served as advertising, aimed at drawing users towards articles on websites associated with the broader messaging campaign. While they targeted individual users, the posts did not seek to engage with them in meaningful discussion. The purpose appears to have been to draw those users’ attention to pro-Iranian websites.
Many of the posts cited above fell into that category, targeting individual users and trying to draw their attention to articles on regime-run sites such as Press TV and Fars, or sites in the regime messaging ecosystem, such as iuvmpress.com and awdnews.com.
A minority of posts did appear more troll-like, and more closely resembled the output of the “troll farm” in Russia, which targeted the U.S. from 2014 to 2018.
Some called for active engagement in local politics, such as this post by @usresistance1 on August 7, 2018, focusing on a Michigan gubernatorial election.
“Vote for @AbdulElSayed Vote for U.S Future#AbdulForMichigan #DoneWaiting #AbdulForGovernor #TuesdayThoughts #TuesdayMotivation #ElectionDay”
Some reached out to foreign politicians and asked for engagement, without apparent success, such as @JoliePrevoit, on January 14, 2017.
“@jeremycorbyn Hi Mr.Corbyn,please follow us at @PSJCommunity and re-tweet if you like.we are all in the same line.”
In the last months of the 2016 U.S. presidential campaign, some accounts posted aggressively against then-candidate Donald Trump. Few of these posts had an Iran-specific focus; given the relatively small number of accounts involved and the lack of engagement achieved, the likelihood is that these were designed to blend into U.S. anti-Trump communities, rather than as a serious attempt to increase resistance to a specific candidate.
Those anti-Trump efforts continued after his election.
Iranian account @LibertyFrontPr continued in this vein well into 2018, with these posts on January 14 and June 30, respectively:
“Trump Is Insane https://t.co/ljluzDFRsK"
The link led to an article of the same headline on libertyfrontpress.com.
“#Trump thinks TradeWars are easy to win. Let’s talk to the farmers and workers impacted #notmypresident #resist #LockThemAllUp "
Surprising Silence
One issue on which the Iranian accounts might have been expected to go into overdrive was Trump’s decision to decertify, and then abandon, the Iran nuclear agreement, known as JCPOA. Surprisingly, the Iranian accounts were relatively quiet.
According to the Twitter archive, the Iranian operation only mentioned “JCPOA” 928 times; the combination “decert-” was only mentioned 61 times. The tone was predictably anti-Trump, but the volume and engagement levels were too small to constitute a serious influence attempt.
@LibertyFrontPr shared its own article on October 14, 2017:
“Trump ‘Plays With The Lion’s Tail,’ Decertifying Iran Nuclear Deal."
Apparently personal account @SayedMoussavi took a more conspiratorial tone on May 9, 2018:
“@davidnelson313 I see the US as the deep state before looking at the president (Obama or Trump). Obama or anybody else, had to sign something like the JCPOA because the US & its allies had tried to contain & sanction Iran on the basis of nuclear energy. So when Iran put up nuclear energy for …”
The same day, @riseagainstr made use of emojis, hashtags and a call to action to make its point:
“#CallToAction🚨🚨🚨
Support #Peace
Support the #IranDeal
#NoWarWithIran #IranDeal #NoWar #JCPOA #Irandeal #TheResistance #VetsResistSupportSquadron #LibertyRising🗽 https://t.co/bqaYphTE9z
This had a rare success, with nine retweets and eight likes. Few of the other Iranian accounts performed so well.
Conclusion
The Iranian operation was aimed at influence, but it should not be confused with the concurrent Russian one. Some of its posts were aimed at polarized audiences in the United States, notably the anti-Trump “resistance” and supporters of Bernie Sanders, but the great majority of content was designed to promote Iranian regime narratives and viewpoints.
The operation can be considered covert, in the sense that it used apparently independent websites and Twitter accounts to amplify messaging associated with Iranian regime sources.
Lower in output than the Russian operation, the Iranian one was far more broad-based, posted in multiple languages (notably Turkish, Russian and Arabic), and claimed identities in the Middle East, Europe, and the Americas. It was much more focused on web-based content, using social media accounts as an amplifier for websites, rather than a separate platform.
Overall, its purpose was much less pernicious. This was an attempt to spread regime messaging through covert channels, alongside the overt ones, not to spread division. Despite the large effort put into it — tweeting the same posts to individual influencers hundreds of times over — it was not especially effective, with most posts scoring under a dozen engagements.
This approach may well have been the key to its failure. Few of the accounts showed distinctive personalities: they largely shared online articles. As such, they were a poor fit for Twitter, where personal comment tends to resonate more strongly than website shares.
Iran’s social media accounts focused on media, not social engagement. They were ill-adapted to the platforms they sought to use.
Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).
Graham Brookie is Director and Managing Editor at @DFRLab.
Kanishk Karan is a Digital Forensic Research Assistant at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).
Follow along for more in-depth analysis from our #DigitalSherlocks.
