Iran-Linked Individuals Faked Social Media Accounts, Blog Posts, Letters to the Editor By Jim Geraghty
Iran-Linked Individuals Faked Social Media Accounts, Blog Posts, Letters to the Editor
A private cybersecurity firm, FireEye Threat Intelligence, recently announced that they had identified a network of English-language social-media accounts that engaged in inauthentic behavior and misrepresentation and that “we assess with low confidence was organized in support of Iranian political interests.” This is the second group of social media accounts identified by FireEye as part of an Iranian propaganda or disinformation campaign.
Narratives promoted by these and other accounts in the network included anti-Saudi, anti-Israeli, and pro-Palestinian themes. Accounts expressed support for the Joint Comprehensive Plan of Action (JCPOA), commonly known as the Iran nuclear deal; opposition to the Trump administration’s designation of Iran’s Islamic Revolutionary Guard Corps (IRGC) as a Foreign Terrorist Organization; antipathy toward the Ministerial to Promote a Future of Peace and Security in the Middle East (a U.S.-led conference that focused on Iranian influence in the Middle East more commonly known as the February 2019 Warsaw Summit); and condemnation of U.S. President Trump’s veto of a resolution passed by Congress to end U.S. involvement in the Yemen conflict.
This Iranian operation is a little more sophisticated, and potentially more dangerous, than what we saw from Russia in 2016. Quite a few media institutions quoted the Russian Twitter accounts in their articles while covering that year’s presidential election. The Iranian accounts identified by Fire Eye managed to get letters, guest columns, and blog posts published in American publications and web sites, written under false names.
We observed some personas in the network leverage legitimate print and online media outlets in the U.S. and Israel to promote Iranian interests via the submission of letters, guest columns, and blog posts that were then published.
The letters and columns, many of which were published in 2018 and 2019, but which date as far back as 2015, were mostly published in small, local U.S. news outlets; however, several larger outlets have also published material that we suspect was submitted by these personas. In at least two cases, the text of letters purportedly authored by different personas and published in different newspapers was identical or nearly identical, while in other instances, separate personas promoted the same narratives in letters published within several days of each other. The published material was not limited to letters; one persona, “John Turner,” maintained a blog on The Times of Israel website from January 2017 to November 2018, and wrote articles for the U.S.-based site Natural News Blogs from August 2015 to July 2018. The letters and articles primarily addressed themes or promoted stances in line with Iranian political interests, similar to the activity conducted on social media.
The media entities that were fooled were not always small: The Los Angeles Times, the Seattle Times, and Galveston County’s the Daily News. The average newspaper letters page does not spend a lot of time and effort verifying the identities of those who write in, and some foreign power would probably find this venue to be low-hanging fruit for getting their propaganda messages distributed. (Then again, we can ask how much propaganda value there is in getting a letter to the editor published. True cynics may conclude this problem will disappear when newspapers disappear.)
What’s more, the Iranian actors attempted to impersonate American political candidates online:
Some Twitter accounts in the network impersonated Republican political candidates that ran for House of Representatives seats in the 2018 U.S. congressional midterms. These accounts appropriated the candidates’ photographs and, in some cases, plagiarized tweets from the real individuals’ accounts. Aside from impersonating real U.S. political candidates, the behavior and activity of these accounts resembled that of the others in the network.
For example, the account @livengood_marla impersonated Marla Livengood, a 2018 candidate for California’s 9th Congressional District, using a photograph of Livengood and a campaign banner for its profile and background pictures. The account began tweeting on Sept. 24, 2018, with its first tweet plagiarizing one from Livengood’s official account earlier that month.
This didn’t attract much attention or generate much controversy last cycle, but it’s not hard to imagine the Iranians or some other foreign intelligence service making mischief by impersonating a candidate. In theory, verified accounts would present an obstacle to this activity, but Twitter is currently not validating any more accounts.
The FireEye analysis notes “some accounts in the network also posted a small amount of messaging seemingly contradictory to their otherwise pro-Iran stances.” This is similar to the approach of the Russian Internet Research Agency as described by former employees. Two employees argue the position that the Russian government favors, one employee argues the position that the Russian government opposes. (It’s easy to suspect that these IRA employees’ mission is to argue that side of the argument badly and unconvincingly.)
Note that many, but not all, of the Twitter accounts identified by FireEye use those familiar name-and-sequence-of-random-numbers handle — “@JasonCa26738291” “@MarkAda05568324” “@LindaJa02370118,” etc. Thank heaven for foreign operatives with no creativity.
Will this Iranian activity generate as much discussion as Russia’s activities in the 2016 election? Or do certain lawmakers and the media not find it as much of a concern when the foreign power’s intended victims are Republicans?
Comments are closed.
