The Washington PostDemocracy Dies in Darkness

Iranians masqueraded as foreign journalists to push political messages online, new Twitter data shows

The Twitter logo is displayed on an iPhone screen. (Alex FLynn/Bloomberg News)

Twitter accounts originating in Iran masqueraded as foreign journalists and concerned U.S. citizens in their attempt to push political messages on the social media site until they were suspended earlier this year, according to research published Wednesday.

The analysis — performed by the Atlantic Council’s Digital Forensic Research Lab — reflects an attempt by some in Iran to “spread regime messaging through covert channels.” But researchers said the campaign had proved less pervasive and effective than the coordinated disinformation operation carried out by Russia, which focused its efforts instead on exacerbating social and political tensions in the United States during the 2016 election.

"The scale and scope of the Russian troll farm drastically outweighed the scale and scope of the Iranian troll farm,” said Graham Brookie, the director and managing editor of the Digital Forensic Research Lab.

In August, Twitter revealed it had suspended 770 accounts — all appearing to originate in Iran, with potential ties to its government — for engaging in “coordinated manipulation.” Facebook and Google-owned YouTube similarly spotted and took down Iranian content, some of which had been linked to state-owned media, according to an analysis by FireEye, a security firm that first uncovered the activity.

At the time, the companies pledged more vigilance, as tech giants continue to grapple with the rise of inauthentic activity and the threat of disinformation with the 2018 midterms weeks away — and Twitter in particular said it would “provide the public with transparency and context on our efforts.”

To that end, Twitter on Wednesday announced it would make available roughly 10 million tweets and 2 million images, live video and other content that had been created by the Iranian accounts and thousands of other, widely reported online trolls that previously had been tied to Russia.

“It is clear that information operations and coordinated inauthentic behavior will not cease,” wrote Vijaya Gadde, the legal, public policy, and trust and safety lead at Twitter, and Yoel Roth, the company’s head of site integrity, in a blog post. They stressed they would “continue to proactively combat nefarious attempts to undermine the integrity of Twitter.”

Twitter also shared roughly 1.1 million tweets from Iran with the Atlantic Council, which said it could not fully attribute the accounts to the country’s government in its own report Wednesday. But researchers said the Iranian operation relied on many identities, and at times bots, to push the preferred messages of the Iranian government over a six-year period. That includes attacks on Saudi Arabia and Israel and support for the Syrian government, according to the DFR Lab’s review. Surprising researchers, these accounts had been far less active on Twitter about a major touchstone in U.S.-Iranian relations: the nuclear deal President Trump abandoned earlier this year.

Some of the since-removed, Iran-tied Twitter accounts had been explicit in their design, linking to government-funded media outlet PressTV. But “far more,” according to the Atlantic Council, “claimed to be operated by outlets in other countries.” One account, @realnienovosti1 — Russian for “real news 1" — posted in that language, claimed to be based in Moscow and tweeted about issues that mattered to Iran. Similar accounts with suspected Iranian ties cloaked their efforts as French, Croatian and Spanish reporters.

In other cases, the Atlantic Council found accounts in this network that appeared to be everyday Americans — a game designer from California, for example, or a reporter from Seattle. Often, these accounts served to amplify state-run media, retweeting their content and linking to Iranian news stories, DFR Lab found. But the Iranian network at times did dabble in U.S. politics, including one account called @usresistance1, created in April 2018, that advocated for Trump’s impeachment. At one point in August, the account tweeted in support of an unsuccessful gubernatorial candidate in Michigan whose family has roots in Egypt. Others sought to “blend into U.S. anti-Trump communities,” Atlantic Council found.

For all its efforts, Iran’s social media accounts gained little traction, failing to reach influencers and often only receiving fewer than a dozen engagements, according to the Atlantic Council, which concluded: “They were ill-adapted to the platforms they sought to use."

But the group praised Twitter for providing and releasing the cache of Iranian and Russian tweets and other content, which researchers can now further scrape for insight.

“I think more transparency around this information is better than less transparency,” Brookie said, “and that’s not strictly limited to foreign influence operations or domestic advertising. Consumers have a right to have more information about the things they see that are presented to them.”