#TrollTracker: Outward Influence Operation From Iran

Facebook identified a network of pages originating from Iran targeting more than a dozen countries in eight languages

(Source: @DFRLab)

Facebook removed 783 assets — pages, groups, and accounts — that the company assessed to be associated with an Iran-based network for “coordinated inauthentic behavior.” The network targeted users in more than a dozen countries and posted content in at least eight different languages.

All but 97 pages were previously removed by a mixture of automated systems, spam detectors, or varied platform integrity team. Before the takedown, Facebook shared the remaining 97 active pages with @DFRLab.

Of note, Twitter also took down a number of related accounts, on which @DFRLab will provide subsequent analysis.

The Facebook takedown included pages masquerading as local news outlets, blogs, and social movement pages. It remains unclear using exclusively open sources whether the pages were tied to a single actor or network; however, each of the pages promoted or amplified views in line with Iranian government’s international stances. The pages posted content with strong bias for the government in Tehran and against the “West” and regional neighbors, such as Saudi Arabia and Israel.

The nature of the pages removed by Facebook indicated an organized influence operation. The operation was noteworthy, however, that more than 30 percent of the removed assets were active for five or more years, indicating that Iranian entities have been engaged in social media influence campaigns since as early as 2010.

Overall Engagement

The 97 pages were created between 2010 and 2018, and at least 38 pages were active for more than five years. In total, the pages amassed nearly 2.5 million followers, of which 1.95 million were not duplicated. The majority of the pages were publishing in Arabic, followed by English, French, and Hebrew. A few pages also posted in Persian and Spanish.

The spread of languages in which the different pages were posting. (Source: @DFRLab)

Not all pages in the network had similar levels of engagement. While some amassed more than 250,000 followers, the vast majority of pages (66 out of 97) had fewer than 10,000 followers. The pages with most engagement, according to CrowdTangle, received upwards of 15 million Facebook engagements (likes, shares, comments, video views) in the past year alone.

At least one of these pages had similar versions previously removed by Facebook, according to one of its posts. In the span of approximately one year since its creation, the third version of the same page, which was removed by Facebook in this most recent round, had amassed almost 30,000 followers.

Analysis of the top performing Facebook pages, showing the total number of interactions, likes, and video views in the past year. (Source: @DFRLab via CrowdTangle)

Seventeen of the 97 pages contained information about the location of the page management. This information can be found in the “Page Info” section of a page, and according to Facebook’s online Help Center, “country locations where pages are managed are determined by a person’s information and activity on Facebook products, including the stated location on their Facebook profile, and device and connection information.”

All 17 of the pages containing information about manager location had managers from Iran. Canada, Saudi Arabia, and Syria were other common locations of page managers.

The location of page managers of the Facebook pages, showing Iran, by far, as the most frequent base. (Source: @DFRLab)

The location of the page managers was a good indicator of how pages of a political and social nature were being run by actors outside the region. The engagement on these pages varied, and some achieved a high amount of engagement and followers.

Polarization by Proxy

The pages acted as an amplification mechanism for Iran’s wider geopolitical stances. The map below marks countries with the highest number followers of the removed pages. The majority of the pages garnered followers from Iran. The network also garnered substantial audiences in Israel, Yemen, and the United States.

Map showing the number of followers according to the region. (Source: @DFRLab)

Israel-Palestine Conflict

Five of the removed pages were social movement pages focused on the Israel-Palestine conflict and posed as Palestinian-run campaigns: two posted in French, two in English, and one in Spanish. The overall content shared by each page focused on the ongoing Palestine-Israel conflict and had a strong bias in favor of Palestine.

Screenshots of anti-Israel content posted by the page @Palestine1945. (Source: @Palestine1945/archive)

One of the removed pages published in Spanish and had 10,000 followers. The page’s background image called on its followers to boycott notable Western brands from the United States, France, Israel, and elsewhere.

Banner image for @Palestine.sp showing the word “Boycott” divided by popart images of Leila Khaled, Nelson Mandela, and Che Guevara. (Source: @Palestine.sp/archive)

The two pages in French posted mostly anti-Israel memes.

Screenshots of content from the @laPalestine1M page. (Source: @laPalestine1M/archive)

The network featured five pages in Hebrew, most of which posted images, memes, and political cartoons. One of the pages, @Polcartoons, curated cartoons from various Israeli news outlets that lampooned Prime Minister Benjamin Netanyahu and conservative Israeli political sentiment.

Screenshots of cartoons posted by @Polcartoons. (Source: @polcartoons/archive)

The rest of the pages posted content from the website tel-avivtimes.com, which is registered in Paris, France, and includes some anti-Semitic content.

For instance, an article from tel-avivtimes.com shared by one of the removed pages had the headline (translated from Hebrew) “Why are evangelical Christians so supportive of Israel? Second Tuesday the Jews will be killed.” The tel-avivtimes.com article was fairly nonsensical, claiming in part that Grace Halsell, the late American journalist who wrote extensively on the Israeli-Palestine conflict, said God ordains that 9 million Jews will be killed in a coming war.

Article by tel-avivtimes.com showing Jewish and Christian groups in solidarity with Israel with a picture following saying “The End Is Near.” (Source: tel-avivtimes.com/archive)

Another article on the website conveyed an anti-Israel message by purportedly showing how Europe is against Israel as a Jewish state. The article headline, translated from Hebrew, is “That is why the Europeans want to destroy Israel as a Jewish state.”

Screenshot of the article from tel-avivtimes.com regarding lack of European support for Israel. (Source: tel-avivtimes.com/archive)

Saudi Arabia Proxy Conflict

Nine of the removed pages featured content related to Saudi Arabia. The page with the highest number of followers was @No2al.saud. According to the page information, it was operated by managers in Iran, Syria, and Turkey.

Screenshot of “Info and Ads” section of the @No2al.saud Facebook page, showing page managers mainly from Iran. (Source: @no2al.saud/archive)

The page posted content related to the ongoing tensions between Saudi Arabia and Iran. Two of the pages, @thesauditimes and @no2al.saud, posted photoshopped images or memes.

Screenshots of pages stating that Saudi Arabia is behind the ongoing war in Yemen. (Source: @thesauditimes/archive, left; @no2al.saud, right)

Meanwhile, one of the pages, @PuppetofIsrael referred to some of the Middle East leaders as “terrorists.”

Screenshot of a post by the “Saudi King is Puppet of Israel” (@PuppetofIsrael) page calling Saudi Crown Prince Mohammed Bin Salman of Saudi Arabia, Israeli Prime Minister Netanyahu, and Sheikh Tamim bin Hamad Al Thani, the Emir of Qatar, “terrorists.” (Source: @PuppetofIsrael/archive)

Promoting Shi’a Political and Militant Views

One of the removed pages — @alalsadrr1 — promoted Moqtada al-Sadr, an influential Shi’a cleric and militia leader from Iraq and leader of the Mahdi Army. According to the Wilson Center, in the mid-2000’s, the Mahdi Army received weapons and training from the Islamic Revolutionary Guard Corps and Lebanese Hezbollah agents. In May 2018, The Atlantic reported that the “controversial” leader and his followers had committed brutal atrocities in Iraq, fought the U.S. military in Sadr City and Basra, and were known for corruption.

@alalsadrr1’s Facebook page, which propagated Muqtada al-Sadr’s views. (Source: @DFRLab)

Apart from Shi’a group amplification, one page in the network, @StopMEK, was promoting views against the People’s Mujahedin of Iran (MEK), the largest and most active political opposition group against the Islamic Republic of Iran Leadership.

The content on the page drew narratives showing parallels between the Islamic State of Iraq and Syria (ISIS) and the MEK.

Screenshots of content from different pages showing how similar MEK is to ISIS. (Source: @StopMEK/archive)

Apart from images and memes, the @StopMEK page shared a link to an archived report on how the United States was monitoring the MEK’s movement in Iran in the mid-1990’s. The file was embedded as a QR code on one of the page’s images.

Report on the MEK was barcoded in one of the images. (Source: @StopMEK/archive)

Anti-West Narratives

Other than posting content about the ongoing Iranian interests across the Middle East, some pages targeted an English-speaking audience, particularly in the United States. One page, @BarackObama.IR, predominantly posted content for an English and North American audience. According to the page information, it was managed by individuals working out of Iran, Canada, and the United Kingdom.

Screenshot of page BarackObama.IR showing page managers located in Iran, Canada, and the United Kingdom. (Source: @Barackobama.ir/archive)

The page posted polarizing content as well as conspiracy theories related to the 9/11 terrorist attack. One of the most widely viewed videos posted on the page in the past year allegedly showed U.S. soldiers mocking Iraqi children. The video was viewed more than 1.5 million times. Another video, which got nearly 900,000 views, argued that 9/11 was an “inside job” executed by the U.S. Government.

A video posted by BarackObama.IR page accusing U.S. soldiers of humiliating Iraqi children for a bottle of water, the video was viewed 1.5 million times. (Source: @BarackObama.IR/archive)
A video posted by BarackObama.IR page spreading conspiracy theories about 9/11, the video was viewed more than 891,000 times. (Source: @BarackObama.IR/archive)

The page had 142,000 followers and enjoyed relatively high engagement, getting on average 24,000 interactions every month.

Graph showing the number of interactions the @BarackObama.IR page received in the past year. (Source: @DFRLab via Crowdtangle)

In late 2017, one of the posts on the page received a very high number of shares suggesting that the post was an outlier and could have been promoted or may have garnered inauthentic engagement. The relevant post recounted a story of two policemen trying to arrest somebody and featured the caption, “White Supremacy is being able to Resist Arrest, fight Police, reach for their GUNS. Don’t get punch or kick And no one fears for their life.” The syntax and verbiage demonstrate a high likelihood that a non-native speaker wrote the post.

@BarackObama.IR page engagement in 2017, shows a rise in number of shares with a peak of 170,000 of shares on one post. (Source: @DFRLab)

Conclusion

The network taken down by Facebook was an influence campaign. The pages in the network built their audience by sharing more visual messages, pushed pro-Iranian messages aggressively, and attempted to push audiences in countries Iran sought to influence.

One notable component of this take down was the apparent industry collaboration cited by Facebook and Twitter.

@DFRLab’s research confirms that the main objective of the network was to amplify and spread pro-Iranian messaging on issues important to Iran, including Israeli statehood and the Israeli-Palestinian conflict, U.S. foreign policy, Saudi Arabia’s war in Yemen, and the conflict in Syria.

The tactics and messaging used by this network closely resembles previous Iran-linked influence pages taken down by Facebook in 2018. Taken with Facebook’s own attribution, this suggests that the pages were indeed part of an information operation supporting the Iranian regime.


Kanishk Karan is a Digital Forensic Research Assistant at @DFRLab.

Donara Barojan is a Digital Forensic Research Associate at @DFRLab.

Melissa Hall is an Editorial Intern at @DFRLab.

Graham Brookie is Director and Managing Editor at @DFRLab.

Follow along for more in-depth analysis from our #DigitalSherlocks.


DISCLOSURE: @DFRLab announced that we are partnering with Facebook to expand our #ElectionWatch program to identify, expose, and explain disinformation during elections around the world. The effort is part of a broader initiative to provide independent and credible research about the role of social media in elections, as well as democracy more generally.

For more information click here.