Wired described the underlying report by the cyber security firm FireEye as a “sequel of sorts” to a report it had previously released in August. The firm apparently stopped short of affirming a direct connection between the two observed campaigns, although a number of previous stories have highlighted rising levels of coordination among hacking and cyber espionage collectives backed by the Iranian government.
The newly disclosed information seems to indicate that previously established trends are still ongoing, making Iranian hackers and false social media accounts a developing threat, and one that tech firms are struggling to keep ahead of.
Facebook and Twitter both confirmed FireEye’s findings by announcing that they had taken down hundreds of accounts in recent weeks after determining that they were deceptive in nature. Facebook also noted that the purveyors of “coordinated inauthentic behavior” had “originated in Iran.”
But neither Facebook nor Twitter gave any indication of how they might prevent more such accounts from emerging in the future. And indeed, NBC correspondent Ken Dilanian plainly stated in an interview with MSNBC’s Ali Velshi that there is currently no clear means of policing such activity, and that after one network of fake accounts is shut down, “another network will crop up three months from now, doing the same thing.”
The Washington Post described the recently shuttered network as “sprawling,” although in reality is was considerably smaller than that which had been exposed last year. In that case, Facebook and Twitter each shut down several hundred accounts, pages, and groups. But early in May, Twitter reportedly deleted 2,800 inauthentic accounts, and Facebook followed suit later that month by closing 51 accounts, 36 pages, and seven groups.
Prior to the closures, 21,000 people had reportedly followed the pages in question, while 1,900 had joined the groups. Additionally, 2,600 apparently genuine users collectively followed three accounts that were identified as operating deceptively on Instagram, the image-sharing network that Facebook owns. But these networks do not fully encapsulate the influence exerted by the Iranian campaign, which despite being smaller than the campaign from last August, was described in the Post as “a more sophisticated operation.”
This label reflects a more deliberately tailored campaign of influence, involving tactics that included the impersonation of specific individuals, as well as generic Americans and Europeans. In this way, participants in the campaign initiated more one-on-one interactions, often targeting journalists, mainstream media, and politicians. In at least two cases, the Iranians created false Twitter accounts modeled on those of actual Republican candidates for the US House of Representatives, then mixed pro-Iranian propaganda into posts which reflected the candidates’ actual positions.
By means of impersonation and direct communication with media outlets, the campaign was also reportedly able to have op-eds, letters to the editor, guest blog posts published in major newspapers and popular websites. This successful infiltration of mainstream media was no doubt supported by a parallel campaign, previously uncovered by the University of Toronto’s Citizen Lab, in which Iran-linked entities created false web pages that were designed to look like they belonged to well-known outlets. These generally exploited common misspellings of genuine domain names, in order to deceive the public into clicking on fraudulent links disseminated by the false social media accounts.
Agence France-Presse reported last week that the group known as Endless Mayfly “created at least 135 inauthentic articles and 72 lookalike domains,” reaching thousands of users throughout the world between 2016 and the date of the report’s publication. In keeping with what has been said about the social media impersonation campaign, this fake news operation is presumably either ongoing or awaiting an opportunity to restart once the public is no longer on guard against the revealed examples.
The AFP report was unable to estimate the extent to which the Endless Mayfly operation swayed public opinion, but it did note that there were clear instances in which fake stories originating in Iran were picked up by legitimate news outlets and thus were spread across the world before they could be retracted.
The expansive reach of Iran’s global influence campaign indicates that it may very well have come full-circle by exerting influence over a domestic audience that strikes to avoid Iran’s own tightly controlled media, in favor of using virtual proxy networks to access foreign media that is officially banned in the Islamic Republic. This impulse has surely been strengthened in recent months and years by an escalating climate of repression within Iranian media and Iranian society in general.
In fact, Jason Rezaian, the former Tehran correspondent for the Washington Post, and former political prisoner, wrote on Tuesday that “the Islamic Republic reached a new low in its suppression of the press” last week, “and almost no one noticed.”
Noting that Iran is already “home to one of the most closed media landscapes on Earth,” Rezaian added that growing numbers of independent news outlets are either having their permission to publish revoked by the government, or are being starved out of existence. But his claim about the recent turn toward even more repressive trends was based in large part on the public statements made by Ebrahim Raisi, the recently-appointed head of Iran’s judiciary, regarding the role of the press.
Raisi’s appointment was widely lamented as a likely sign of even greater repression throughout Iranian society, owing to his past judicial record and the leading role he played in the mass execution of political prisoners in the summer of 1988. And so many pro-reform Iranians and foreign defenders of human rights are naturally worried that journalists will be a particular target of a Raisi-led judiciary’s willingness to utilize political violence.
His speech to a gathering of executives from state-affiliated news outlets seemed to further justify those concerns by portraying independent journalists and reformist publishers as enemies of the state and treasonous servants of the foreign “enemies” of the Islamic Republic. “Media is responsible for monitoring the enemy as it prepares its attacks on us, and journalists must be careful not to publish or spread any ideas or signals that would make the enemy happy,” Raisi said, adding, “We should publish content that restores the public’s trust in the system.”
Such remarks arguably set the stage for more aggressive treatment of Iranian reporters by individual judges. And Rezaian suggested that this phenomenon may already be underway when he highlighted the case of Masoud Kazemi, an experienced journalist whose tweets about government corruption landed him in court on charges of spreading propaganda against the state last week.
In setting bail at the equivalent of 42 years’ salary for a journalist, the judge exceeded the defendant’s “pessimistic expectations,” according to Rezaian. But more than that, Judge Mohammad Moghiseh also took it upon himself to berate Kazemi and his colleagues for the nature of their work, saying among other things, “May God damn you. Your mouths should be filled with gunpowder, your tongues should be cut out.”
Such open condemnation of the press from low-level judges and the head of the Iranian judiciary stands alongside clandestine influence campaigns to send a clear message about how the Iranian regime thinks media should operate both at home and abroad. Domestically, that regime is working to shut out any voices that threaten to contradict state-run propaganda networks. But recognizing that the international press is made accessible to Iranians through the modern internet, the regime and its supporters are also working to spread the reach of those networks beyond Iran’s borders, to muddy the waters of the international press.