Aug 27, 2018
#TrollTracker: Iran’s Suspected Information Operation
Assessing the main pages and accounts traced to Tehran by FireEye
A network of websites and social media pages which have been traced to Iran posted pro-Tehran articles mixed in with content taken from bona fide websites, and shared content attacking Saudi Arabia and U.S. President Donald Trump, according to the traces the operation left online.
The revelations by data analysis team FireEye, and by Facebook, expose what appears to have been a foreign-operated influence campaign which masqueraded as genuine websites and users. They underline the growing danger of such influence operations, which are clearly not limited to one country or one target.
This post analyzes the two websites with the most direct links to Iran.
What Was Exposed
The exposé originated with FireEye, which reported a “suspected influence operation that appears to originate from Iran aimed at audiences in the U.S., United Kingdom, Latin America, and the Middle East.” The company named the key websites in the campaign, associated social media accounts, and further possible members of the operation.
Based on FireEye’s findings, Facebook took down over 600 accounts and pages associated with the operation. Twitter also suspended a number of accounts.
The Websites
The two main websites which FireEye named were libertyfrontpress.com and InstitutoManquehue.org. As of August 22, both sites were still operational. All links in this post are to archived versions of the sites, taken on August 22–23, 2018, in case they are taken down, and to prevent giving them a search engine boost.
FireEye attributed the sites to Iran based on a triangulation of factors. None would be conclusive in itself, but the three points reinforce the conclusion.
- Website registrant emails associated with Iranian locations and services;
- Twitter accounts associated with the websites, but registered using Iranian telephone numbers;
- Apparently pro-Iranian content.
The Twitter accounts have been suspended. Recent WhoIs searches of the sites only revealed a U.S. registrar. The content of the websites therefore presents the most enduring evidence set.
The first core website identified by FireEye was institutomanquehue.org, self-described as a “civic organization which pursues the development of strategic visions on the main themes related to Latin America directed at the region’s inhabitants, as well as reflecting an accurate vision of the region to the world.”
The site’s English-language page was last updated in May 2017; the Spanish-language version was still operational in August 2018. All references in this analysis are to the Spanish version, unless otherwise stated.
Its geopolitical view was polemic:
“The voices of the people of Latin America have often been hijacked by foreign influences from the West and East, taking away their space in the administration of their own countries, as well as their participation in international decisions.”
It produced a considerable volume of content, sometimes posting half a dozen new stories a day. The great majority of this content was not original, but taken, without attribution, from Iran’s state-run Spanish-language television station, HispanTV.
For example, an article published by institutomanquehue.org on August 16, reporting an attack by Bolivian President Evo Morales on the visit of U.S. Defense Secretary James Mattis to the region was taken verbatim from a HispanTV article of August 14, without attribution.
The institutomanquehue.org article attributed it to an author called “mas pourk,” whose tag on the website provided no information. This appears to have been an attempt to launder an article from a declared Iranian state TV channel through an undeclared Iran-linked site.
Another article published under the “mas pourk” byline also matched a HispanTV article verbatim; this time, the two versions were published on the same day, August 16. The article concerned a reported threat from a “terrorist” leader in Idlib province against Russia in Syria.
Yet a third article also matched word for word a HispanTV article published the same day. This time, the content concerned a speech by Ayatollah Khamenei, Iran’s supreme leader, attacking the U.S.
Not all articles plagiarized HispanTV. One post on the “Zionist reconquest of Patagonia,” published in June 2018, was copied from an article on conspiracy site Voltairenet dated December 12, 2017, but with a much more polemic headline than the original, which asked what Israel was planning in Argentina.
Some content appeared to have been authored specifically for the website; as with libertyfrontpress.org, which focused on Iranian official positions, such as attacks on Saudi Arabia.
The top story on the site as of August 23, for example, headlined Saudi Arabia “extending the ideology of terror with the support of the United Kingdom.” It quoted an interview conducted by Iranian state outlet PressTV, without mentioning its affiliation.
Google searches for the exact phrasing used in the top two paragraphs only returned hits from institutomanquehue.org, indicating that this was original language.
However, even here, wording from further down the article was identical with what appeared to be stock HispanTV language describing Saudi relations with Israel.
Overall, institutomanquehue.org’s Spanish output appears to have been a thinly-veiled attempt to amplify Iranian government messaging in Latin America, primarily by copying HispanTV content without attribution.
The English-language output, by contrast, appeared to be largely original. It was often written in non-native English, and focused on issues from the Iranian state point of view.
As of August 23, 2018, three of its four top posts concerned a profile of a Bahraini ayatollah; a hostile view of Saudi influence in Bahrain (“Abduction, torture, and murdering more than 40 citizens during the military intervention was the heir of Saudis for Bahrain”); and an interview which claimed that “Iran’s democratic system is far more fair-minded to their voters than the American system.”
Instituto Manquehue claimed the latter interview as an exclusive, although it did not name the interviewer. A Google search for key sentences did not return earlier uses of the language, supporting the claim.
The interviewee was identified as Robert Carter, a “London-based commentator.” Appended to the interview was a fact box stating that he worked for Shia TV outlet Ahlulbayt TV, but also contributed to Iranian state broadcaster Press TV and pro-Kremlin conspiracy site Veterans Today.
The questions ranged from anodyne to pro-Iranian:
Mr. Carter, what’s your take on the recent presidential election in Iran and its effect on the region?
When campaigning, all of the candidates — especially Rouhani — suggested that they will remain committed to the nuclear agreement. What will happen if the other sides, especially the US, violate the deal?
Compared to other countries in the Middle East, how is the establishment of democracy and free speech in Iran?
How would you predict the US-Iran relations in the coming years?
The answers were anti-American, pro-Iranian, or both.
Iran has proven, to itself and the world, that diplomacy and economic expansion are what gives a country real power.
Iran is, without a doubt, one of the most democratic countries in the Middle East at the moment.
America is clearly putting together an anti-Iran coalition disguised as an ‘anti-terrorism’ effort.
The relationship between the US & Iran is likely to remain strained as the US seems incapable of anything else but to continue its campaign of provocation. Thankfully Iran has re-elected a candidate who has proven he can handle hostile political situations with patience and calm, a skill which will become incredibly important in the foreseeable future.
Of the eight latest stories featured on the homepage, only one had a vaguely Latin American theme — footballer Lionel Messi. Far more concerned Middle Eastern geopolitics, criticizing the U.S. and Saudi Arabia.
While the Institute’s English page contained more original content than the Spanish one, it was equally aligned with Iranian foreign policy.
The other core website identified by FireEye was libertyfrontpress.com, self-described as an “independent media organization” offering news “without any distortions, made by the mainstream media in favor of their contributors, in support of the oppressed and the downtrodden.”
Diagnostically, it also wrote that it aimed “to inspire action on the likes of social justice, civil liberties and human rights.”
As of August 22, the libertyfrontpress.com homepage featured a range of reporting on United States, United Kingdom, and international politics, largely from a left-leaning or liberal point of view.
Again, the great majority of its content was copied verbatim from other sources; however, these were drawn from more sources than in the case of institutomanquehue.org. For example, the top story as of August 22, a profile of Colombian politician Ivan Duque, reproduced a Newsweek article; the article featured the Newsweek logo, and a link to the original.
Other top stories were taken verbatim from the Guardian (on British Labor leader Jeremy Corbyn), The Hill (on Trump’s lawyer Rudy Giuliani), and Al Jazeera (on migrant rescue ship Aquarius).
One piece was copied from the Independent, in the UK, and criticized British government support for Israel.
It is questionable whether this constitutes plagiarism, since the original source and link were prominently displayed; it may constitute copyright violation, if libertyfrontpress.com did not have a syndication agreement with the publications it copied.
It did give the site an easy way of stocking itself with legitimate, well-written and largely left-leaning content.
Other content was drawn from much more contentious sources. An extremely hostile article accusing Israel’s Prime Minister Benjamin Netanyahu of disinformation was taken word for word from Canadian-based site globalresearch.ca, a known hub of false stories.
Another post, dated June 17, gave a partial transcript of an interview between Syrian President Bashar al-Assad and Iran’s state-owned Arabic-language channel, al-Alam TV. This post appeared to be original content; it resembled a full transcript provided by Syrian pro-regime outlet al-Masdar on June 13, but differed in the detail.
The libertyfrontpress.com version was shorter (under 2,000 words, against more than 5,000). Its headline differed from that of al-Masdar, placing the emphasis on Syria’s relationship with Iran, and Assad’s intention of visiting Tehran.
The content selected by libertyfrontpress.com focused on those parts of the interview which dealt with Iran, and especially the comparison with Russia.
The fact that one of the few original articles on the site took an interview by an Iranian state outlet, and condensed it to focus on comments about Syria’s relationship with Iran, betrays a clear interest in, and bias in favor of, Iran.
Another apparently original article reported that Iran’s regional rival Saudi Arabia had been defeated in an assault on the port city of Hodeidah, Yemen on June 14, 2018.
This was written in barely comprehensible English, and may have been machine translated, as in this sentence:
A mission on the implementation of the Saudi-led by the destruction of a coalition frigate, under the auspices of the Saudi naval gunfire, intends to deploy forces on the Al-Hodeidah coast, as well as the capture of hundreds of them at the least heavy defenses, was a serious failure.
The post maximized its rhetoric, while minimizing linguistic and editorial competence.
Meanwhile, another Ansarullah commander insists that the Saudi coalition used anything they had on the attack , there was nothing they did not fly or did not have on the battlefield, but, the Saudi coalition only They have won the battle on TV screens and virtual networks, but in real battle, they have merely defeated.
In fact, according to mainstream media, the Saudi-led assault continued, and captured Hodeidah airport two days later.
This article read like war propaganda, rather than a credible piece of journalism. A Google search for specific sentences from the article did not turn up other instances of their use online, confirming that it was original content.
Again, this fits with the perception of the site as an anti-Saudi outlet, in line with Iran’s known foreign policy.
The Social Media Feeds
Both sites were associated with social media feeds; according to FireEye, the Twitter accounts in question were linked to Iranian telephone numbers. The accounts have been suspended, but Google’s cache facility preserved some information.
The Instituto Manquehue feed, @insmanquehue, blended anti-American, anti-Israeli and anti-Saudi content with Latin American coverage.
The main Facebook page, @InsManquehue, according to residual Google results, also shared assorted anti-Israel, anti-Saudi and anti-U.S. content.
The Instagram account with the same handle largely posted content on Latin American issues, according to a Google cache of online service Picbear dated to August 21, 2018. Most of the posts pointed to institutomanquehue.org, but copied their language verbatim from HispanTV.
A few posts showed geopolitical interest; one recorded the visit of the Mayor of Jerusalem to Latin America, with a #racist hashtag added, while another focused on Chinese military exercises aimed at striking U.S. targets. Both articles were taken from HispanTV (here and here).
Their impact was small. The Twitter account only had 2,881 followers, despite having posted almost 12,000 times since it was created in September 2014.
The Instagram page counted 9,000 followers, but followed 7,000 accounts itself, suggesting a followback system rather than organic interest.
The institute also had backup Facebook and Instagram accounts under the handle @institutomanquehue. Neither had meaningful impact, with only a handful of followers and likes.
libertyfrontpress.com also had an array of social media feeds. The Twitter feed was captured by Google’s cache. Some of its posts focused on Gaza, Venezuela, Yemen, and an Iranian missile test — foreign-policy priorities for Iran. One post called for the Mujahedeen Khalk group, an opponent of the Iranian regime, to be banned, using the hashtag #BanTerrorOrg.
Far more, however, attacked U.S. President Donald Trump, not only over his handling of relations with Iran, but more generally. These largely shared memes from other anti-Trump accounts.
The Twitter bio read:
“As an independent news media organization we aim to inspire action on the likes of social justice & human rights & advocate transparency in politics.”
This is too close to the language used on the website’s “About” page to be a coincidence.
According to FireEye’s report (page 12), @LibertyFrontPr changed its name to @berniecratss in July 2018, and began targeting supporters of progressive U.S. politician Bernie Sanders. According to Google’s cache, it had the same biography, and was created in the same minute, confirming the identification.
The renamed account posted a large volume of anti-Trump comment, together with more occasional posts espousing Iran’s foreign-policy views.
This largely appears to have been an attempt at infiltrating the pro-Sanders community in order to insert specific messages tailored to Iran’s foreign policy. On at least one occasion, the feed promoted a street protest, in an echo of Russia’s interference operations in the U.S.
Both handles also had Facebook equivalents, but neither performed well, according to Google searches for their handles.
On Instagram, a number of posts by @berniecratss have been preserved by the Google cache of Picbear. They show an account which was routinely anti-Trump and left-leaning, but which occasionally posted geopolitical content reflecting Iran’s stance on the Middle East.
Picbear also saved posts from @liberty_front_press and @libertyfrontpress. Those which were saved focused exclusively on U.S. politics and attacks on Trump — including, ironically, on the issue of Russia’s interference in the U.S.
These were not as overtly aligned with Iran’s interests. However, their bios were word for word the same as the Twitter accounts and webpage, confirming their connection.
Conclusions
The two websites identified by FireEye posted large quantities of pro-Iranian content, much of it taken directly from regime sources. They mixed that content with plagiarized or borrowed copy, in an apparent attempt to give themselves the appearance of legitimacy, and to appeal to their target audiences.
The associated social media feeds, linked by identical biographies, performed in a very similar way. Their content was seldom as overtly pro-Iranian as the websites’, and appeared aimed more at building an audience in the target communities.
Those communities were largely anti-establishment and left-leaning protest groups in the United States and United Kingdom.
The operation’s exposure, through the use of Iran-based telephone numbers and email addresses, suggests that it was run amateurishly, much as the original Russian troll operation was. Its goal appears to have been to insert pro-Iran messaging into potentially receptive audiences.
Few of its posts achieved notable impact, but it remained in operation for a considerable period.
It is perhaps most striking as the first full-scale troll operation run by a country other than Russia to have targeted Western protest groups. Some of its tactics appeared borrowed from Russia; others appear home-grown.
It underscores the ongoing danger which Western democracies face from disinformation actors who use the anonymity of the internet, and the anger of Western communities, to pass their own messages into the debate.
Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).
@DFRLab is a non-partisan team dedicated to exposing disinformation in all its forms. Follow along for more from the #DigitalSherlocks.
This post was updated on August 27 to clarify the identification of the @LibertyFrontPr and @Berniecratss accounts, and correct the translation of the phrase “tsunami del cólera” in the caption to the image of Instituto Manquehue’s Facebook videos.
