The last few years saw an interesting shift in the use of social media networks in order to push targeted propaganda campaigns. Ranging from the fake news epidemic in Eastern Europe to the state sponsored interference in the electoral process of western states, it is safe to classify this phenomenon as an increasing risk to the national security of every state. What is interesting to observe is that the disinformation technique has been adopted at large scale by different actors across the globe which are using it to advance their national interest, in a cheap, effective and non-attributable way.
Iran is one of the most important actors in the Middle East, not just because of its sheer size, long history, strong culture and large population. Iran is also known as the protector of Shia Islam and this translates in a large influence across the Arab world, still divided greatly by the Shia-Sunni difference of interpreting the Islam. However, what makes Iran top of the headlines in the last years are the nuclear capabilities they are developing, a topic most sensibly felt by their biggest enemy, Israel. The nuclear deal signed by the Obama administration, cancelled by the Trump administration, renegotiated again by the Biden administration has put Iran in the corner, transforming a sensible topic in a live or die situation. This is coupled with the tough sanctions imposed by the Western world, Mossad attacks on its critical nuclear infrastructure, killings of key personnel and the coronavirus breakout.
Iran’s response to this, translated into a disinformation offensive, because the authoritarian regime leading Iran considers it a very important tool in gaining soft power domestically and externally further advancing its political and religious narrative. Since the 1979 revolution, the country has established the Revolutionary Guard, an institution which is in charge of maintaining the internal and external security of the country and advancing its interests, among a range of other things.
From a cybersecurity perspective, this translates into a potent Iran Cyber Army, which had some interesting successes in attacking Western websites, a cyber influence arm of Basij, a regimen of the Revolutionary Guard, focused on developing networks of bots and trolls influencing the narratives and the police which closely monitors the internet behaviour of Iranian users and cracks down when ambitious anti-regime movements are detected.
We’ll focus this short brief on a specific state affiliated network of Twitter accounts and Telegram channels used with the intent of artificially exerting digital influence on topics that are aligned with Iranian geo-political objectives and interests.
Before going further with the investigation, it is worth, for the sake of context, to present a short overview of the overall strategic importance of Iranian cyber operations. From our point of view, a crucial turning point in Iranian activities across cyberspace can be traced back to as far as 2009 and linked to the events associated with the Green Movement – a protest movement based around the irregularities of the Iranian presidential election of 2009. In the aftermath of this event, we can pinpoint the first increase of Iranian interest in the digital area, information dominance becoming the central objective in Iranian cyberspace operations.
According to a report published by AtlanticCouncil, Iran began its use of bot accounts on social media platforms as early as 2010 claiming to have built fully operational “cyber battalions” only 2 years after the Green Movement incidents. The aforementioned capabilities only continued to steadily grow with the expansion into websites like Reddit and even into some U.S. regional newspapers (according to the same report from AtlanticCouncil).
Unlike Russian disinformation campaigns, which are constructed with the sole purpose of polluting the flow of information with false narrative and acting as a disruptive agent – a good example would be the 2016 Russian influence campaign that specifically targeted African-Americans in order to suppress voter turnout in the elections and cause division, Iranian campaigns are not necessarily based on the dissemination of false information focusing more on presenting a distorted, overly exaggerated version of the truth with the purpose of advancing Iran’s geopolitical interests.
Based on the modus operandi described above we’ll present a campaign that we’re monitoring since October. We’ll conduct the analysis by addressing 2 questions:
- What is the methodology behind the campaign?
- What is the purpose of the campaign – any links to world events?
The activity was initially observed on a Telegram channel affiliated with Iranian digital influence campaigns characterized by long periods of inactivity coupled with short bursts of dozens of messages posted at the same time in a bot-like manner. The automated messages are easily distinguishable as they are all political in nature and containing specific Twitter hashtags. Even though since the beginning of the observation, two specific hashtag campaigns have been observed: #Erdoğan_Kapa_çeneni (this is potentially linked to Turkey announcements of seeking closer ties with Israel) and #HERO. We’ll showcase the latter as they are 100% similar in methodology and execution. Both hashtags campaigns display sudden bursts of messages, all posted at the same time and in different languages.
The #HERO campaign was observed in late December 2020 and going into the beginning of January 2021 and was focused around political messages having general Qasem Soleimani as a central figure. The timing is not random as 3 January 2021 is the 1 year anniversary of the termination of general Qasem Soleimani in a U.S. drone strike. This campaign lays on the path established by previous ones related to the same event: #HardRevenge (appearing 21 times/1000 tweets as uncovered by The Washington Post) and #DeathToAmerica, both hashtags seeing a surge in popularity in January 2020.
Sample of the same hashtag used with messages in different languages
The majority of the messages can be traced to Twitter, being posted by different accounts at around the same time they appear on Telegram.
Example of a message and its corresponding tweets
After checking the hashtag distribution per country we have noted that this campaign mostly targeted audiences from the United States, U.K. and India. This does not come as a surprise as English speaking countries, especially the United States, are usually the main targets for this type of propaganda where the actor attempts to over inflate its moral high ground on specific topics through digital influence.
Lastly, we monitored the hashtag #HERO popularity from the end of December 2020 up to 3 January 2021 and came up with an expectable increase in distribution.
End of December 2020
Beginning of January 2021:
As mentioned before, it is a radically different approach from the one employed by Russia as, rather than having the creation of havoc through totally false information as its main aim, Iran uses propaganda-type actions in order to not only influence international actors but also keep its domestic affairs in check. The dual aim of its online campaigns stems from the belief that the state can only survive through informational dominance both on the domestic level, by ferociously censoring opposing views and controlling the Internet, and on the international stage, using informational war tactics as a continuation of its public diplomacy. Although these tactics have increasingly been used after intensifying US pressure and international sanctions, information warfare as a covert alternative to military actions can be seen as a priority of the Iranian state since the Islamic Revolution of 1978-1979. This priority is based on the permanent fight of this state to be recognised as a religious centre, an anti-imperialist and anti-colonialist warrior and a victim of the US, all at the same time. Taking all of these into account, it is clear that the motive behind most of Iran’s online actions is to promote pro-Iranian talking points by hijacking the political conversation. Even though these types of campaigns do not employ disinformation as the main tactic, one can not ignore the danger that this type of propaganda poses against factual discourse through its use of distorted truth and exaggerated rhetoric.
On the other hand, it has to be pointed out that Russian-like campaigns are not totally disregarded by Iran. As an example, creating division within the US (especially) and polarising the society even more than it already is can also be observed as outcomes of an action mentioned in the Atlantic Council report and the usual occurrence of Russian rather than Iranian strategy. In that case, Iranian affiliated entities (as discovered by Facebook in 2019) established a page named “BLMNews.com” (connected with the Black Lives Matter movement) with the objective of ‘feeding’ manipulated information to progressive activists and promote Iranian interests. However, the secondary effect was, most probably, deepening the right-left divide and adding fuel to the fire.
Another important aspect to be taken into account is the fact that Iran seems to learn information warfare tactics from the ‘elders’ like Russia and China. The creation and development of trolls and bots armies is a key step into conducting efficient propaganda campaigns. In the case of Iran however, there seems to be a lack of hierarchy. This is a crucial element of an effective cyber propaganda army as vertical leadership leads to a more efficient repartition of tasks and objectives that have to be achieved. For instance, Russia’s Internet Research Agency – also known as ‘Glavset’ – is financed (and maybe ruled) by the Russian oligarch Yevgeny Viktorovich Prigozhin, also known as ‘Putin’s chef’. Consequently, its workers are divided into one category of trolls focused on the production of memories (content that has an impact on the user) and another one which concentrates on writing comments on posts of other users. Particularly, according to Dawson and Innes (2019), these two branches of the Russian IRA have to maintain six Facebook accounts and ten Twitter ones, post at least three times a day about the most recent news and discuss the evolution of the social media groups where the malicious accounts spread the Kremlin’s narratives. This relevant feature seems to not be available for Iran’s cyber armies.
Nevertheless, just like Russia, Iran seems to have developed its cyber armies based on swarm intelligence. According to Gerardo Beni and Jing Wang, swarm intelligence represents a collective behaviour of decentralized, self-organized systems, natural or artificial. Speaking of state-sponsored disinformation campaigns, trolls represent the human actors whose job is to give a personal touch to Tehran’s narratives. Around them, hundreds or even thousands of bot accounts revolve and disseminate those narratives in order to ensure that they reach even in the most informationally isolated corners of public opinion. Basically, they behave as technological actants (Bennett & Segerberg, 2013), namely networks of non-human agents.
In addition, if Russia also aims to create a Russian dedicated Internet – RUNET – where the ‘malicious digital information’ spread by the West does not infect the Russian population anymore, Iran is far from wishing to achieve this objective. Rather Teheran strictly wants to project its geopolitical interests through mechanisms of personalized communication, the one used here being the hashtag. As Bennett & Segerberg (2013) argue mechanisms of personalized communication like hashtags and mentions provide the user the capability to exactly target the audience.
Iran is not to be ignored when it comes to digital influence. Although it is only at the beginning of the road on digital propaganda, and its effects are not felt at a level similar to that of Russia, Iran has a capacity for rapid adaptability and being forced, it will increasingly focus on this tool of influence, domestic and global. From our analysis, we noticed that Iran has a special specific when it comes to disinformation campaigns, but it also borrows strategies from Russia, operating in a hybrid propaganda model.
Surrounded by enemies, with China and Russia as the only strategic allies, Tehran will increasingly use digital weapons against the West to advance its interests of social destabilization, division and mistrust. What is certain is that we are moving towards a digital age where the threats are getting bigger and bigger, and the information we will interact with will be more and more manipulated. There is a need for a state approach against misinformation, with a program developed to educate civil society, digital platforms to help limit and detect this phenomenon early, and to introduce critical thinking into the school curriculum. The truth is becoming increasingly difficult to identify on the Internet, and increasing the ability to distinguish false news is a matter of national security.
Authors: Intel4Patriam (Felix Staicu, Alexandra Ivan, Razvan Ceuca) Factide (Daniel Leu)