Iran’s online ‘influence operation’ more widespread than previously thought

Reuters uncovers websites, social media accounts pushing Tehran’s agenda, confronting ‘Zionism front activities’; security experts say they appear to be part of larger campaign

Iranians surf the Internet at a cafe in Tehran, Iran, on September 17, 2013. (Illustrative photo: AP/Ebrahim Noroozi)
Iranians surf the Internet at a cafe in Tehran, Iran, on September 17, 2013. (Illustrative photo: AP/Ebrahim Noroozi)

A misinformation campaign linked to Iran that included websites, Facebook, Twitter, Instagram and YouTube, is much larger than initially feared, according to a Wednesday Reuters report.

Following last week’s discovery of online accounts linked to the official Islamic Republic of Iran Broadcasting organization, Reuters said that it discovered 10 further websites and dozens of social media accounts on Facebook, Instagram, Twitter and YouTube connected to the Iranian government and operating under the banner of the International Union of Virtual Media (IUVM).

These accounts and sites push Tehran’s political narrative, including content from Iran’s PressTV and semi-official Fars news agency and al-Manar TV run by the Iran-backed Shiite Hezbollah terror group, the report said.

Reuters said that US cybersecurity firm FireEye and Israeli firm ClearSky reviewed the discoveries and said they appeared to be part of the same campaign taken down last week.

“It’s a large-scale amplifier for Iranian state messaging,” said Ben Nimmo, a senior fellow at the Atlantic Council’s Digital Forensic Research Lab. “This shows how easy it is to run an influence operation online, even when the level of skill is low. The Iranian operation relied on quantity, not quality, but it stayed undetected for years.”

On its website, IUVM lists among its goals: “Confronting with remarkable arrogance, western governments and Zionism front activities to correct the deflection of people movements in world,” and “Explaining the importance of Palestine and Quds issue to Internet audience.” Quds is the Arabic name for Jerusalem.

According to Reuters, the IUVM network operates in English, French, Arabic, Farsi, Urdu, Pashto, Russian, Hindi, Azerbaijani, Turkish and Spanish.

IUVM’s Facebook page was closed down following the Reuters report, but its Twitter and YouTube accounts remained active.

On Thursday Google said it blocked YouTube channels and other accounts over a misinformation campaign linked to Iran, on the heels of similar moves by Facebook and Twitter.

Google said that working with the cybersecurity firm FireEye, it linked the accounts to being part of an effort dating to at least January 2017.

“We identified and terminated a number of accounts linked to the IRIB organization that disguised their connection to this effort,” Google vice president Kent Walker said in a statement.

“Actors engaged in this type of influence operation violate our policies, and we swiftly remove such content from our services and terminate these actors’ accounts.”

Google’s Senior Vice President and General Counsel Kent Walker, right, speaks during a Senate Intelligence Committee hearing on Russian election activity and technology, on November 1, 2017, on Capitol Hill in Washington. (AP Photo/Jacquelyn Martin)

The tech giant said it blocked 39 YouTube channels that had racked up to total of 13,466 views in the US on “relevant videos” and disabled six accounts at Blogger and 13 accounts at its Google+ social network.

“In addition to the intelligence we received from FireEye, our teams have investigated a broader range of suspicious actors linked to Iran who have engaged in this effort,” Google said.

The internet firm added that it has updated US lawmakers and law enforcement about what its investigation uncovered, including associated political content.

Google also said it has blocked state-sponsored phishing attacks in which deceptive messages were sent to users of its free email service in an effort to trick people into disclosing information such as passwords.

“In recent months, we’ve detected and blocked attempts by state-sponsored actors in various countries to target political campaigns, journalists, activists, and academics located around the world,” Google said.

The California-based internet giant added that in the past year it has also intensified its defenses against “actors linked to” the Russia-backed Internet Research Agency (IRA).

Google has removed 42 YouTube channels and a Blogger account as a result of watching IRA activities, according to the company.

In this photo from November 12, 2015, fa man walks past a building on the Google campus in Mountain View, California. (AP Photo/Jeff Chiu, File)

A FireEye report released on Thursday detailed its findings and expressed confidence in attributing influence campaigns to Iran.

Evidence turned up in the investigation included phone numbers, website registration information, and promotion of content in sync with Iranian political interests, according to the report.

“The activity we have uncovered highlights that multiple actors continue to engage in and experiment with online, social media driven influence operations as a means of shaping political discourse,” FireEye said.

“These operations extend well beyond those conducted by Russia.”

Most Popular
read more: