Facebook Removes Iran-based Assets. Again.

The pages spread pro-Iran messaging and targeted U.S., British, and Saudi politics

(Source: @KaranKanishk/DFRLab via Facebook)

On May 28, Facebook removed a number of assets operating from Iran that amplified Iranian state messaging and that targeted the United States 2016 presidential election in a manner similar to operations run from Russia in 2016.

In total, Facebook and Instagram removed 92 assets — pages, groups, and accounts — that targeted U.S., British, and Saudi politics and elections using false identities to pose as local pages. These online assets were taken down for “coordinated inauthentic behavior,” when groups, pages, and accounts mislead people through deceptive behavior.

The assets dealt with a range of issues, including promoting the messages of Ayatollah Khamenei, Iran’s spiritual leader, and attacking Saudi Crown Prince Mohammed Bin Salman (also commonly referred to by his initials, “MBS”). Most striking, however, the assets also briefly forayed into U.S. electoral politics, with short and ineffective campaigns against Hillary Clinton and for Donald Trump.

The Iranian election interference strongly resembled the Russian operation of 2016 in approach and demographic targeting, but the Iranian pages were much less effective and attracted very few followers — just 595 spread across five election-related pages.

Iranian Political Interests

The takedown began with a tip from online investigation group FireEye. On May 28, FireEye published an analysis of the operation’s activity on Twitter and other online sites, concluding with low confidence that it was “organized in support of Iranian political interests.” Based on the tipoff, Facebook identified related assets on its own platform and shared a subset of these with the DFRLab prior to their removal. Facebook concluded that their inauthentic behavior “originated in Iran.”

In a blog post, Facebook stated:

“The Page admins and account owners typically posted content in English or Arabic without a focus on a particular country, although some Pages focused on the U.S. or U.K. The posts from these Pages and accounts discussed topics like public figures and politics in the U.S. and U.K., U.S. secessionist movements, Islam, Arab minorities in Iran and the influence of Saudi Arabia in the Middle East.”

Much of the content reviewed by the DFRLab fit this pattern of messaging consistent with Iranian government narratives. One page, for example, was titled “Resign you murderer” and focused on MBS, the Crown Prince of Saudi Arabia, one of Iran’s chief regional rivals. Active in late 2015, it accused MBS of personal responsibility for the deaths of children in Yemen, sometimes with graphic imagery of dead children.

Post by the anti-MBS page “Resign you Murderer,” linking him to the deaths of children in Yemen. (Source: Resign you Murderer)

Other pages promoted the sayings of Ayatollah Khamenei and criticized Israel’s actions in Gaza and the Palestinian territories. One, “Meet the Beauty of Islam,” operated in English. A second with the concise name of “Les messages conçus dans le discours de Khamenei aux jeunes occidentaux” (translated from the French, “The messages conceived in Khamenei’s speech to young Westerners”) operated in French but was minimally active, only posting at the end of 2015 and focusing solely on the content of two Khamenei speeches addressed to young Westerners that year.

Posts by “Meet the Beauty of Islam” on the Palestinian conflict and “Les messages conçus…” on Khamenei’s speeches. (Source: Meet the Beauty of Islam, left; Les messages conçus dans le discours de Khamenei aux jeunes accidentaux, right)

Further pages boosted Iran as a tourist destination, under the banner “Discover New Persia,” and posed as a news service, the “World News Agency,” that largely focused on the conflicts in Syria and Yemen and published news favorable to Iran’s allies and proxies.

One Arabic-language page, @AlArabyi, repeatedly posted links to the website of Saudi-funded broadcaster AlArabiya.net. The broadcaster’s website links to a different, verified Facebook account, @AlArabiya, with over 22 million followers. The Iranian page used similar visual branding to the verified account and largely shared content from the website, making it likely that it was an attempt to pass pro-Iranian messaging under the guise of the Saudi broadcaster. It stopped posting in September 2015, by which time it had over 5,000 followers — by far the highest follower number in the takedown set to which the DFRLab had access.

Comparison of the Iranian page (top) with the verified version of the Al Arabiya page (bottom). (Source: @Alarabyi, top; @AlArabiya/archive, bottom)

With the exception of the Al Arabiya lookalike, none of these pages garnered substantial followings. Most of them fell silent in 2016 or early 2017, suggesting that the operation was an experiment that was abandoned well before it was taken down.

U.S. Politics

The same applied to the pages that focused on U.S. politics in general, and the 2016 presidential election in particular. These pages were striking for their resemblance to the parallel Russian operation but came nowhere near it in scale or user response.

One election-related page focused on supporting Democratic Senator Bernie Sanders and attacked his main rival for the presidential nomination, former Secretary of State Hillary Clinton.

The page, created on April 4, 2016, was called “Not the billionaires” when it was first created but changed its name three days later to the more personal “Bernie Sanders — a way to a better future.” Its content was outspokenly pro-Sanders and explicitly supported his bid against Clinton. It ceased posting in May 2016, however, before Clinton had secured the Democratic nomination.

Posts by the Iranian pro-Bernie Sanders page, explicitly favoring him over Clinton. (Source: Bernie Sanders: A way to a better future/archive)

The page expressed a broadly anti-interventionist stance, quoting Sanders on the “magical thinking” inherent in regime change by force. On at least one occasion, it shared an article originally published by Kremlin broadcaster RT that attacked Clinton.

Left, the RT post shared by the pro-Sanders page. Right, a comment on military intervention. (Source: Bernie Sanders: A way to a better future/archive, left; Bernie Sanders: A way to a better future/archive, right)

This behavior was remarkably similar to the Russian election interference operation in 2016, as illuminated in Special Prosecutor Robert Mueller’s February 2018 indictment of Russia’s Internet Research Agency, more commonly known as the St. Petersburg Troll Farm. As with the 2016 Russian operation, the assets removed in this takedown also promoted Sanders at Clinton’s expense and even urged African American voters not to vote for Clinton in order to suppress Democratic turnout.

“We support Sanders”: details from paragraphs 43 and 46 of Special Prosecutor Robert Mueller’s February 2018 indictment of the Internet Research Agency, also known as the “St. Petersburg Troll Farm.” (Source: U.S. Department of Justice/archive)

The Russian operation focused heavily on the African American community. The Iranian operation also ran a page focused on the Black Lives Matter movement, though it fell silent on December 9, 2015, before the presidential race heated up. Little of its content related to presidential candidates; one post shared an article from Sanders, while another called for a U.S. president like British Labour Party leader Jeremy Corbyn, whose name it misspelled.

“Black Live Matters 2015” posting content on Bernie Sanders and Jeremy Corbyn. (Source: Black lives matter 2015/archive, left; Black lives matter 2015/archive, right)

Like the pro-Sanders page, “Black Lives Matter 2015” shared posts from RT on several occasions but did not share posts from Iranian state outlets such as PressTV.

Post recommending RT’s “Redacted Tonight” show, shared by the Iranian page. (Source: Black lives matter 2015/archive)

Neither page performed well on Facebook. The Sanders page had 144 followers, and the BLM page had 205 — both yielding less than one thousandth of the following just one (“Blacktivist”) of the Russian pages managed to garner during its existence.

Support for Trump

Two of the pages, “Fight for my conservative president” and “Fight for a conservative president,” were dedicated to supporting Donald Trump’s candidacy. One of the pages had no posts, while the other page often shared content from the website thetrumptimes.com, a right-wing website posting pro-Trump content. The page also advertised products that cater to “patriotic” ideology.

A heavy-on-the-patriotism post promoting USA Flag Lens Aviator Sunglasses. (Source: Fight for a conservative president/archive)

The page posted sporadic pro-Trump and anti-Clinton memes in the buildup to the 2016 election and thereafter. It regularly posted commercial ads, including an ad for a Trump-themed cruise in the Caribbean.

Posts supporting Trump, attacking Clinton, and advertising Trump-supporting groups. (Source: Fight for a conservative president/archive, top; Fight for a conservative president/archive, bottom)
Posts promoting a “Trump Victory Cruise” and other merchandise: posts by the Iranian page from before (left) and after (right) the election. (Source: Fight for a conservative president/archive, left; Fight for a conservative president/archive, right)

As with the anti-Clinton pages, these pro-Trump pages were similar to, but much less effective than, their Russian counterparts. The Iranian pro-Trump pages together garnered just 324 followers.

Third Parties

The Iranian operation also featured assets that boosted third parties and urged Americans not to vote at all.

Two pages — “American Citizen Party” and “America’s Party” — ostensibly promoted parties outside the mainstream duopoly. In the countdown to the 2016 presidential election, however, they were unsparingly hostile to Clinton, while leaving Trump largely unmentioned.

This is reminiscent of the Russian campaign, which targeted many different groups, including third-party voters, in a bid to steer them away from voting Democratic.

Shares of the same anti-Clinton post by “American Citizen Party” (left) and “America’s Party” (right). (Source: American Citizen Party/archive, left; America’s Party/archive, right)

These third-party accounts also posted occasionally on issues much closer to Iran’s foreign-policy concerns. The “American Citizen Party” criticized U.S. support for Israel, for example, and the “America’s Party” page did the same while also criticizing Saudi Arabia.

Posts by “America’s Party” and “American Citizen Party” on Israel and Saudi Arabia. (Source: America’s Party/archive, left; America’s Party/archive, center; American Citizen Party/archive, right)

A similar page, the clumsily named “TWO PARTY system; ‘Illusion of choice,’” ostensibly promoted the idea of a multi-party democracy. Many of its posts, however, concerned U.S. foreign policy, especially on Israel and the Middle East.

Anti-Israel posts by the “TWO PARTY” page. (Source: TWO PARTY system; ‘Illusion of choice’/archive, left; TWO PARTY system; ‘Illusion of choice’/archive, right)

The pages also demonstrated a severe lack of command of English, one of the main indicators to look for when identifying a fake asset.

A memorably worded post on the economy from the American Citizen Party page. (Source: American Citizen Party/archive)

Neither of the pages achieved more than 80 followers, and both stopped posting by early 2017. Again, this operation strongly resembled the Russian one in style and approach, but not in scale, determination, or reach.

Targeting the British Monarchy

The Iranian operation also had targets outside the United States, with one of the pages, “Republicanism for Great Britain,” dedicating itself to a campaign against the British monarchy. The page featured mordant and vitriolic posts directed at the Royal Family.

A post shared by “Republicanism for Great Britain” that disparaged the British monarchy. (Source: Republicanism for Great Britain/archive)
Another post targeted the Queen of the United Kingdom. (Source: Republicanism for Great Britain/archive)

Support Page for Jeremy Corbyn

“Support-Jeremy-Corbyn,” a page committed to supporting Jeremy Corbyn’s reelection campaign, following a no-confidence vote, to retain his leadership of the Labour Party in 2016. The page was heavy on memes along with some original posts and others that shared links from various media organizations.

Many of the pages in this takedown were critical of the United States’ and United Kingdom’s monetary and diplomatic support for Israel and strongly in favor of Palestine. In line with this narrative, Support-Jeremy-Corbyn also highlighted comments by the British leader that were critical of the Israeli blockade on Gaza, showing him as pro-Palestinian in his outlook.

Posts by Support-Jeremy-Corbyn that portrayed the Labour leader as pro-Palestinian. (Source: Support-Jeremy-Corbyn/archive)
Meme-ready post from the Support-Jeremy-Corbyn page. (Source: Support-Jeremy-Corbyn/archive)
Another meme-ready post from the Support-Jeremy-Corbyn page. (Source: Support-Jeremy-Corbyn/archive)

The support for Corbyn and for Sanders in 2016 is striking, because the pages resemble those created during another Iranian influence operation first exposed by FireEye in the summer of 2018. In that operation, Iranian operators maintained a number of Facebook and Twitter accounts, including one called “Berniecratss” and another called “The British Left,” that often praised Corbyn.

Conclusion

The Facebook pages and groups to which the DFRLab had access removed as a part of the company’s May 28 takedown covered a wide breadth of topics. Some focused on the Middle East, with a strong interest in attacking Saudi Arabia and its Crown Prince, in particular, or promoting Iran and its virtues. Others conveyed an intention to infiltrate domestic American politics concurrently or sometimes even earlier than the 2016 Russian effort. Still others took aim at the supposed corruption of the British Royal Family. Despite their varied focus, they were all similar in two important ways: they were all relatively limited in lifespan, being abandoned after only a short tenure of operation, and they were quite limited in reach, usually with a very low follower count and even lower engagement rate.


Kanishk Karan is a Digital Forensic Research Associate at @DFRLab.

Ayushman Kaul is a Digital Forensic Research Assistant, South Asia, at @DFRLab.

Ben Nimmo is Senior Fellow for Information Defense at @DFRLab.

Register for the DFRLab’s upcoming 360/OS summit, to be held in London on June 20–21. Join us for two days of interactive sessions and join a growing network of #DigitalSherlocks fighting for facts worldwide!