Social media giant Twitter released detailed data files related to efforts by foreign countries to meddle in U.S. elections, including actions by taken by Twitter against more than 4,500 accounts linked to state-backed operators; 3,841 accounts were linked to Russia’s Internet Research Agency and another 770 accounts linked to the Iranian regime.
Twitter had previously disclosed the false-front efforts, but this data release included the actual tweets sent out by the bogus accounts; the data dump totaled more than 360 gigabytes of information including more than 10 million tweets with more than two million images, GIFs, videos and livestream broadcasts.
Twitter also released information on each profile including the number of followers it had, who they followed in turn, the geolocation of those tweets and more. The earliest activity noted by Twitter stretched back to 2009 which indicates how committed the trolling operation was in hijacking dormant accounts and spreading disinformation.
Twitter noted that the “information operations and coordinated inauthentic behavior will not cease. These types of tactics have been around for far longer than Twitter has existed — they will adapt and change as the geopolitical terrain evolves worldwide and as new technologies emerge.”
According to Ben Nimmo, a data analyst for at the Atlantic Council’s Digital Forensic Research Lab, the Iranian tweet effort consisted of about a million tweets from 770 accounts that mainly attempted to get Twitter users to go to websites that hosted pro-Iran, anti-Israel or anti-U.S. content.
The Iranian effort to steer users to websites populated with pro-Iran content is typical of recent Iranian cyber-operations to support initiatives such as passage of the Iran nuclear deal and opposition to the U.S. pull out from the same deal and imposition of economic sanctions.
The top three geopolitical phrases mentioned by the Iranian trolls included Saudi, Iran, and Trump. One-third of the posts from the Iranian troll farm led users to AWDNEWS.com, which calls itself an independent news agency, yet Nimmo refers to it as “part of the Iranian messaging laundromat.”
AWD News is a part of a cluster of sites exposed by FireEye in August to be Iranian government sponsored outlets
The cyber efforts closely mirrored those of the Iran lobby in building the larger “echo chamber” of opinion from bloggers such as Lobelog.com and academics such as Seyed Hossein Mousavian, advocacy groups such the National Iranian American Council and false-front websites such as Iran-interlink.org.
Many of the Iranian trolls either posed as news sites or masqueraded as journalists. One account with 1,450 followers, MariaLuis91, which claimed to be a French journalist, posted the same article to hundreds of different people each day throughout 2014, Nimmo said.
“They were just spam sharers, but that’s not the kind of behavior which is going to engage lots of people. They are just going to think who are you and why are you sending me this, and I will probably block you,” he added.
It is unclear if all of Iran’s operation has been shut down by Twitter, but Nimmo says there are “indications that the websites that have been identified so far are not the full set.”
All of which goes on to demonstrate that the Iranian social media campaigns are likely far from dead and in fact are only in the beginning stages as the regime gains a better understanding and sophistication of how to conduct such campaigns more effectively.
While this initial effort was termed “clumsy” by Nimmo and other analysts, the truth is that Tehran may only view this effort as experimental and as FireEye and other cybersecurity firms publish findings, future Iranian efforts will most likely take into account their missteps and try better tactics in trying to influence American journalists and voters.
The U.S. wasn’t the only target of Iranian social media campaigns as Bahrain revealed that it has discovered social media accounts managed in Iran by political groups operating outside of Bahrain were issuing death threats aimed at electoral candidates in the country.
The director-general of the Anti-corruption and Economic and Electronic Security department said they had monitored and followed up the complaints by some candidates who claimed to have received threats on social media asking them to withdraw their candidacy.
He said that an investigation showed that those social media accounts were managed in Iran and were aimed at “disrupting the election process”, the official Bahrain News Agency reported.
The ongoing Iranian efforts have caused continued concern in the U.S. as intelligence officials issued a joint statement from the Office of the Director of National Intelligence, the Homeland Security Department, the Justice Department and the FBI who say they’re worried about activities that “seek to influence voter perceptions and decision-making” in the 2018 and 2020 elections.
The agencies say the “ongoing campaigns” could take many forms. Examples include attempts to influence voters through social media, sponsoring content in English language media such as the Russian outlet RT, or “seeding disinformation through sympathetic spokespersons regarding political candidates and disseminating foreign propaganda.”
Intelligence officials said they were concerned about “ongoing campaigns” by Russia, China, Iran and other countries to undermine confidence in American democracy.
The U.S. needs to continue its focus on Iran, but not only on Iranian efforts to influence U.S. policy, but also the regime’s efforts to discredit dissidents and political opponents who are growing in number and bolder with protests flaring up throughout Iran.