The Suspicious Twitter Network Trolling for Regime Change in Iran
An American non-profit says it’s been the victim of a harassment campaign.
As the Trump administration has ramped up economic sanctions against Iran and aimed increasingly threatening rhetoric at the country, an influence network has popped up on Twitter pushing similar messages.
Networks comprising over four hundred Twitter accounts composed of likely bots along with real accounts and “cyborg” accounts—accounts run by real people, but augmented with software to push posts faster and more frequently—have consistently released messaging opposing the Iranian government.
Coordinated attempts to manipulate discourse on Twitter are explicitly against the platform’s rules.
The accounts often tweet messages backing regime change in Iran and calling for an end to the rule of Ayatollah Ali Khamenei. Many of the accounts also frequently voice their support for the People’s Mujahedin of Iran (MEK), a militant opposition group that some have called a terrorist organization, and its leader Maryam Rajavi. The accounts also frequently criticize the National Iranian American Council (NIAC)—a non-profit representing Iranians in the U.S.—claiming it advocates in support of Iran’s current religious authorities. There is no evidence to suggest this is true, and NIAC firmly denies the assertion. In 2008 the group filed a defamation suit against a writer who alleged they had lobbied on behalf of the Islamic Republic of Iran; a federal judge found that the defendant’s actions didn’t amount to defamation, but made no ruling on the truth of his allegations.*
The full impact of the networks is hard to gauge, but one set of over 350 accounts has collectively tweeted over 5 million times to nearly 500,000 followers, according to numbers collected by independent researcher Geoff Golberg, who first flagged the accounts to Mother Jones. Golberg, who founded the social media manipulation research project SocialCartograph, says that he has no specific interest in Iranian geopolitics and stumbled onto the accounts amid broader research into social media influence campaigns.
Another set of 75 accounts found by researcher Ben Decker, who runs the media and tech investigations consultancy Memetica, also post pro-regime change and anti-NIAC content. Decker, who is a former researcher at Harvard’s Shorenstein Center, says the accounts exhibit signs that suggest they are possibly either not real or are being augmented. Beyond accounts posting at a superhuman pace on a 24 hour a day, seven day a week schedule, Decker noted that “the network of accounts had a massive spike in followers, totaling around 125.2k users, during the last week of February”—a “red flag as far as inorganic network activity is concerned.”
While coordinated attempts to manipulate discourse on Twitter are explicitly against the platform’s rules, NIAC says it has been a victim of such attacks and complains the company hasn’t taken enough action to protect them. The organization claims that it was targeted by a coordinated social media attack over Memorial Day weekend, when accounts critical of NIAC tweeted out the hashtag #NIACLobbies4Mullahs in droves, to push the notion of NIAC’s supposed ties to Iran’s religious authorities. Jamal Abdi, the NIAC’s president, believes the efforts are an attempt to undermine his organization’s credibility and effectiveness.
“The goal of these attacks is simple: to divide and weaken our community. To ensure that Iranian Americans do not have a voice, do not hold influential positions in Washington D.C., do not run for office and build political power, and shy away from civic engagement,” he wrote in a piece for The Iranian. Golberg’s work has caught the attention of NIAC and he has publicly communicated with it his findings, but he says he is not being paid by the organization.
The networks are made up of a mix of legitimate and false accounts, and it can be difficult to definitively say which are bots, cyborgs, or normal posters augmented via other means. But some of the profiles’ behavior echoes patterns that experts use to judge if accounts are not being run organically. The five most prominent accounts in the network have tweeted hundreds of thousands of times in the several years since they were created, averaging over 100 tweets a day. That speed alone doesn’t confirm that the accounts are inauthentic or engaging in artificial coordination, but to Golberg it’s a clue, along with the interconnectedness of the network’s accounts and their similarities in the users they retweet, follow and interact with, as well as the sometimes nearly identical content of their tweets.
Twitter has deleted thousands of Iranian accounts in the past several months, including some of the over 350 accounts that appear to be a part of the influence campaign identified by Golberg. Over 200 of the accounts he flagged remain, pumping out content in support of regime change in Iran.
It’s unclear who is behind the accounts, but their positions mirror the positions of the MEK and what is seen as its international political arm, the National Council of Resistance of Iran (NCRI). Both have consistently pushed for regime change in Iran, earning allies in and close to the Trump administration, despite the organization formerly being labeled by the State Department as a terrorist group, a designation some experts believe it should still have.
Trump’s National Security Advisor, John Bolton, called the MEK “a viable opposition to the rule of the ayatollahs” at an MEK event in 2017. Trump’s lawyer, Rudy Giuliani, who has taken payments from the group, called for Iran’s current ruling regime to be replaced by the armed group at a 2018 rally hosted by the organization in Paris.
The MEK has a history of running online disinformation campaigns. Al-Jazeera has documented a Russian Internet Research Agency-style troll operation run out of Albania, interviewing former MEK members who detailed how the organization controlled thousands of accounts to spread propaganda about regime change and other political aims. And according to the Daily Beast, a former lobbyist for the NCRI, Soheila Aligholi Mayelzadeh, ran an influence campaign on Facebook in support of more aggressive confrontation with Iran.
It’s unclear what action Twitter is taking on the accounts. Golberg has for many months repeatedly flagged the network to Twitter employees, and had direct message conversations with the company about his disinformation research more broadly.
“Platform manipulation is a violation of the Twitter Rules,” a company spokesperson wrote after being asked about the accounts. “For accounts that we can reliably link to a nation state, we disclose every information operation down to the Tweet to a dedicated public archive—the largest of its kind in the industry. We have disclosed activities linked to Iran in the past and will remain vigilant.”
While news of Russian attempts to use social media platforms to influence politics both in the U.S. and elsewhere have dominated headlines, more and more examples of influence efforts related to Iran have surfaced. In addition to the online campaigns being carried out by people sympathetic to the MEK’s perspective, Iran’s ruling regime also appears to have engaged in its own political manipulation attempts.
Late last month, both Facebook and Twitter announced that they had deleted thousands of Iranian accounts that were engaged in what Facebook’s chief of security Nathaniel Gleicher called “coordinated inauthentic behavior.” The accounts appeared to have been created to mislead by posing as news organizations, journalists, and under other false identities, and to spread information about “political and social issues in Iran and globally,” according to Yoel Roth, Twitter’s head of site integrity. Both companies had previously deleted batches of accounts originating in Iran that they identified as being a part of a network trying to influence political discourse.
While the Trump administration has been wary of potential Iranian social media manipulation efforts, it seems their focus has been on content pushed by the current regime—and not by allies of a political group that, like the United States, is working against it.
“I can say definitively that it’s a sufficient national security concern about Chinese meddling, Iranian meddling, and North Korean meddling that we’re taking steps to try and prevent it,” Bolton told ABC News in August.
This article has been revised with additional information about the 2008 case.
Ali Breland, Motherjones.com