Facebook and Twitter have both removed accounts linked to inauthentic behaviour originating from Iran. While Facebook removed a total of 51 pages, acocunts, and groups, Twitter removed 2,800 accounts. Most accounts were created between April 2018 and March 2019, per cybersecurity firm FireEye, which investigated and found this activity. Its worth noting that Facebook had removed over 2,500 pages, groups and accounts in March for inauthentic behavior linked to Iran and Russia, among other countries.

What ‘inauthentic behaviour’ did these account carry out?

1. They posed as journalists: Using fake accounts to run pages and groups, the people behind this activity posed as journalists from US and Europe and tried to contact reporters, academics, Iranian dissidents, and other public figures. They also impersonated legitimate news organizations in the Middle East. As FireEye’s appendix shows, most accounts claimed to be ‘free’ journalists (some even specified their apparent organizations) or students in American universities, activists – and most claimed to be based in the US. FireEye said it was unable to identify individuals belonging to the news organizations.

Credit: FireEye

2. And impersonated Republican candidates for the 2018 US elections: Some accounts impersonated Republican congressional candidates for the 2018 US mid-term elections; the managed to get content published in US and Israeli media outlets, attempted to lobby journalists, and orchestrated audio and video interviews with U.S. and UK-based individuals on political issues. One account claimed to that of Republican candidate from New York Jineea Butler. Another impersonated Marla Livengood, a 2018 candidate for California’s 9th Congressional District. The account used her picture, campaign banner, plagiarized tweets from Livengood’s actual Twitter account, and even tweeted news snippets on issues in the US.

4. They got letters, guest columns, and blog posts published in US media: Some of the accounts used US and Israeli media to promote Iranian interests via the submission of letters, guest columns, and blog posts that were then published, including in Seattle Times, LA Times, and Times of Israel blog, and other local papers in the US. For insance, one letter to the Seattle Times writen by one Jeremy Watte was about Americans killed by an ISIS suicide bomber in Syria, it asserts that the Islamic extremist ideology espoused by the terrorist group remains undefeated.

5. People behind the network conducted interviews of UK and US citizens: FireEye explains that the accounts solicited various individuals over Twitter for interviews and chats, including real journalists and politicians. They conducted remote audio and video interviews U.S. and UK-based individuals, including a prominent activist, a radio talk show host, and a former U.S. Government official, and subsequently posted the interviews on social media, showing only the individual being interviewed and not the interviewer.

What kind of content did they share and distribute?

The page admins and account owners typically posted content in English and Arabic, without focus on any specific country. They discussed public figures in the US and UK, US secessionist movements, Islam, Arab minorities in Iran and the influence of Saudi Arabia in the Middle East.

Narratives promoted by these and other accounts in the network included anti-Saudi, anti-Israeli, and pro-Palestinian themes. Accounts expressed support for the Joint Comprehensive Plan of Action (JCPOA), commonly known as the Iran nuclear deal; opposition to the Trump administration’s designation of Iran’s Islamic Revolutionary Guard Corps (IRGC) as a Foreign Terrorist Organization; antipathy toward the Ministerial to Promote a Future of Peace and Security in the Middle East (a U.S.-led conference that focused on Iranian influence in the Middle East more commonly known as the February 2019 Warsaw Summit); and condemnation of U.S. President Trump’s veto of a resolution passed by Congress to end U.S. involvement in the Yemen conflict.

How many people did these accounts reach?

On Facebook, 21,000 people followed one or more of the pages, 1900 accounts joined one or more groups, and 2600 people followed at least one Instagram account. Twitter has not given the volume of follows or engagement that the 2800 suspended accounts managed.