INSIDE IRAN’S SHADOWY ONLINE CAMPAIGN
▶ Tehran caught using fake social media personas to support its interests
A wide-reaching Iranian online disinformation operation to influence western audiences and sow discord has been revealed in a major investigation.
The propaganda campaign, which spans Europe, the Americas and the Middle East, is using opaque social media accounts, fake websites and pro-Iranian posts to push Iran’s foreign and domestic interests.
An investigation by security company FireEye, the most sweeping probe into Iranian cyber activity to date, details the scale and reach of Tehran’s propaganda and attempts by its agents to shape the views of western audiences.
It is an effort of comparative scale to that of Russia’s troll factories, which have sought to influence elections, referendums and governments from Washington to Paris to London.
The years-long propaganda drive forced Twitter, Facebook and Google into action this week. The three social media giants removed hundreds of accounts after a tip-off from FireEye, because they were suspected to be originating from Iranian sources with links to the regime.
Iran denies the accusation that it is behind the massive online operation but FireEye has released its findings and explained how Iran used these fronts to target users in the US, Britain, Latin America and the Middle East.
It shows the lengths to which the Iranian regime is going to lobby western officials and the public into its corner.
Facebook had to remove 254 pages and 116 Instagram accounts that have gathered more than one million followers on both platforms. Those pages spent a total of about $12,000, or Dh44,078, on promoting their material between 2012 and last year.
The platform had also detected attempts to spread malware by the Tehran operation.
Twitter said it had taken down 284 accounts, many of them suspected of links to Iran, for “co-ordinated manipulation”.
Google took down 58 users from its YouTube video platform and other sites Google Plus and Blogger.
All of the accounts had ties to the Ayatollah-linked Islamic Republic of Iran Broadcasting and “disguised their connection”, company officials said.
The search platform analysed the accounts by inspecting their IP addresses, their metadata and who owned the domains.
It connected the accounts to Iran and found they had been active since early last year.
Other accounts linked to Iran gave away their link relatively easily.
FireEye found registration emails for at least two suspected Iranian disinformation sites tied to advertisements for site designers in Tehran and the Iran-based website gahvare.
They then found Twitter accounts linked to those sites, with phone numbers beginning with Iran’s +98 country code.
FireEye discovered that some of the accounts were tweeting mostly between 4am Co-ordinated Universal Time and 1pm, in line with the Iranian work day. The accounts often fell silent on Thursdays and Friday, the Iranian weekend.
One of the Facebook pages used by Tehran was named the Liberty Front Press. It posed as an independent page offering its views from Iran. But it was discovered to be closely linked to Press TV, a news station with links to the Iranian state.
Some of the material issued out by these accounts was supportive of left-leaning positions opposed to the government of US President Donald Trump, who in May pulled Washington out of the landmark 2015 nuclear deal signed between Tehran and world powers.
Other posts included cartoons of Saudi Arabia’s King Salman with critical messages about the Arab Coalition’s campaign to recapture Yemeni cities from the Iranbacked Houthi rebels.
Another accused Riyadh of interfering in the 2016 US presidential election in favour of Mr Trump.
One tweet called for the boycott of the Hajj in Makkah in protest against the Saudi government’s policies. Other tweets had anti-Israel themes and material that supported Britain’s left-wing leader Jeremy Corbyn.
In Latin America, Iran is suspected of using a front site called Instituto Manquehue to promote Iranian allies Venezuelan President Nicolas Maduro and Bolivian President Evo Morales.
Like Iran, Venezuela is a target of US sanctions.
In the US, Iran had a front site known as Real Progressive Front. In Britain, it was two sites: the British Left and Critics Chronicle.
The operation demonstrates that it is not only Russia seeking to influence political discourse in the West.
This threat from states online “continues to evolve”, FireEye said in its 32-page report, and it was likely that Iran would continue.
But as Tehran pushes its interests around the world through the internet, its trolls have been exposed.