Iran’s Newest Info Op Shows an Evolution of Tactics
On October 26, Facebook announced that it removed “82 pages, groups, and accounts for coordinated inauthentic behavior” originating from Iran. The information operation targeted citizens of the United States and United Kingdom, often by creating fictitious personas impersonating Americans and Brits, and by seizing on divisive domestic issues to incite partisanship and build audience engagement.
Comparing the tactics of this campaign to the Iranian-linked campaign Facebook uncovered in August indicates that Iranian tactics are becoming increasingly sophisticated, mirroring the evolution of the Russian Internet Research Agency (IRA)’s tactical playbook. As more and more authoritarian regimes learn lessons from each other’s information operations, all democratic actors — governments, private companies, media, and civil society — need to accelerate efforts to expose and defend against the growing wave of authoritarian interference.
Iran’s Changing Toolkit
In August 2018, Facebook removed 652 Pages, Groups, and accounts linked to an ongoing Iranian interference campaign. The operation, which was originally identified and flagged by cybersecurity firm FireEye, dated back to 2013 and involved a network of websites and social media accounts. As described by The Atlantic Council’s Digital Forensic Research Lab, the Iranian Facebook network was largely intended to steer users to other inauthentic websites that were created to launder Iranian state propaganda through the Western information ecosystem. The accounts and connected websites, which sought to appear independent while parroting narratives faithful to the Iranian regime’s worldview, did a poor job of concealing their connections to Iranian state media. Most of their content focused directly on Middle East politics, although some did focus on domestic issues in the United States, U.K., and Latin America.
Figure 1 Content from the Irainian information operation removed by Facebook in August. Note the picture is meant to be interpreted right-to-left as Arabic is read instead of left-to-right as with English.
Concurrent with Facebook’s revelations, Twitter also removed accounts related to the Iranian network, later releasing over one million tweets pushed by the Iranian-linked accounts. Inauthentic Iranian accounts on Twitter similarly sought to steer users to external pro-regime websites. And while some accounts seized on domestic divisions in the United States, the main utility of the network was to promote Iranian government messages (especially related to Middle East policy) through seemingly legitimate fronts.
Media from an Iranian Twitter account removed in August depicting a before-and-after picture of Sanaa, the capital of Yemen. The picture was likely used to criticize Saudi Arabia’s bombing campaign in the country.
Media from an Iranian Twitter account removed in August promoting Iranian Ayatollah Khamenei.
The most recent exposure of Iran’s information operations reveals a more sophisticated approach. Rather than focus specifically on Middle East politics, the October campaign seized on domestic U.S. and U.K. issues to inflame divisions and engage with users. Similar to Russian operations exposed by Special Counsel Robert Mueller, this campaign targeted domestic U.S. politics and democratic institutions, rather than American perceptions of Iran, by engaging with specific audiences and minority groups. The operation also specifically targeted U.S. midterm elections. And, in a departure from previous Iranian efforts, the new network aimed to spread influence through organic content on social media instead of attempting to steer users to external sites.
On the left, a piece of social media content from the Russian Internet Research Agency. On the right, an example of content from the October Iranian operation.
The operation also employed more subtle influence tactics, such as the impersonation of Americans and a more effective separation of social media accounts from Iranian state media. Additionally, the content shared by the Iranian accounts was much more timely and targeted, actively exploiting divisive issues in order to drive engagement and elicit emotional responses.
Images of social media content from the October Iranian operation. (Sources: Image 1, Image 2)
More Authoritarian Regimes to Use These Tactics against Democracies
As described by Clint Watts, a non-resident senior fellow at the Alliance for Securing Democracy, Iran’s social media operations are not new, only thrust into the spotlight now given their targeting of the U.S. midterm elections. The Iranian and Russian operations indicate that authoritarian regimes have long perceived vulnerabilities and opportunities in manipulating the Western social media ecosystem.
Worryingly, the striking similarities between the operations by Tehran and Moscow demonstrate that authoritarians are learning from one another, all while their tactics evolve and become more sophisticated more rapidly than efforts by Western governments and societies to expose and defend against them. Attempts by social media companies to secure their platforms have been imperfect thus far, and Silicon Valley must act quickly to close off vulnerabilities and protect users.
Most importantly, social media platforms will need to move past reactionary measures and window-dressing and begin addressing the flaws inherent in their business model that allow for such easy manipulation. Additionally, democratic governments need to work together to establish norms on identifying, countering, and deterring hostile foreign influence. Finally, citizens will need to learn how to safely and responsibly consume and share information online, as no government policy or social media feature will defend against every piece of disinformation.