Iran-based assets targeted audiences in Latin America and the United States with pro-Iranian messaging

As a part of a larger takedown, Facebook took down 131 accounts, 23 pages, four groups, and 14 Instagram accounts on October 21, 2019, identifying them as part of an operation that originated in Iran and focused on audiences throughout Latin America and the United States.

These online assets engaged in “coordinated inauthentic behavior,” Facebook’s term for when groups, pages, and accounts work together to mislead people about who they are and what they are doing on the platform. The DFRLab had access to seven pages prior to their removal, five of which had content beyond selfies and other apolitical posts.

In its blog post, Facebook explained about the subset of the assets targeting Latin America:

The Page administrators and account owners typically represented themselves as locals, used fake accounts to post in Groups and manage Pages posing as news organizations, as well as directed traffic to off-platform domains. They frequently repurposed Iranian state media stories on topics like Hezbollah, conflict between Iran and Saudi Arabia, tensions between Israel and Palestine and Iran and the US, war in Yemen, as well as posted content tailored for a particular country including domestic news, geopolitics and public figures.

In particular, these assets targeted audiences in Venezuela, Brazil, Argentina, Bolivia, Peru, Ecuador, and Mexico with messaging critical of the United States, Saudi Arabia, and Israel, as well as with a smaller number of posts on domestic politics in Latin America. The range of topics discussed included Saudi Arabia’s attacks against Yemen, U.S. sanctions on Venezuela and Iran, Israeli policies toward Palestine, spy drones, and information compiled during the October 2019 protests in Ecuador.

Also included in the pages the DFRLab had access to was one seemingly promoting the Black Lives Matter movement (“BLMNews”) in the United States.

In total, the five analyzed pages had 14,605 followers and 13,943 likes. A page called Elintelecto (“The intellect”), allegedly based in Lima, Peru, accounted for 82 percent of those followers.

Iran-based assets

Based on Facebook Page Transparency data, only four out of the five analyzed pages had manager locations listed.

All four of these pages each had at least one page manager in Iran. Elintelecto had an additional five managers in Peru, and the page Israel Deceits and Lies included a “Not available” description for one of the managers’ locations.

U.S. sanctions on Venezuela and Iran

Three of the pages in the set, 4Febrero (“February 4”), Elintelecto, and BLMNews posted about the U.S. sanctions on Venezuela and Iran.

4Febrero, a pro-Venezuelan government page with a profile picture featuring late President Hugo Chávez, focused on the sanctions against Venezuela, suggesting that the country had lost millions of dollars after U.S. President Donald Trump’s economic embargo. Some of the content on the page also suggested that the sanctions have resulted in a medicine shortage amid the humanitarian crisis in Venezuela.

4Febrero also shared posts that included hashtags such as #NoMoreTrump and #VenezuelaHeroica (Heroic Venezuela), as well as a narrative written, originally in Spanish, about Russian solidarity with the Venezuelan people after the sanctions were instituted: “The Russian Federation has shown its reliable, visible, and notorious solidarity with the Venezuelan case, which is perversely attacked by the North American empire, trying to impose blocks, purported sanctions.”

Altogether, 4Febrero’s posts on U.S. sanctions, published from August 13 to September 2, 2019, reached a paltry 37 reactions and 135 shares in total.

The page Elintelecto also posted on the sanctions. One of the posts included an article about U.S. sanctions on 10 shipping companies carrying food to Venezuela.

The same narrative about sanctions appeared on the page BLMNews, which shared an online article published on its external website, BLMNews.com, titled “U.S. Imposed New Sanctions on Iran’s Shipping Network.”

The BLMNews page was particularly noteworthy, as it targeted an audience interested in a specific social movement largely unique to the United States: Black Lives Matter. In doing so, it employed a tactic reminiscent of the Russian Internet Research Agency’s during the 2016 election.

BLMNews routinely shared content from an eponymous website, which claimed to be a “Source of African-American News all around the world.” The page, however, shared content from the website on a range of political topics with a particular focus on the Middle East, including Hezbollah and the Israel-Palestine conflict; the BDS (Boycott, Divestment, Sanctions) movement, whose self-described mission is “seeking to end international support for Israel’s oppression of Palestinians;” and the Saudi-led intervention in Yemen.

According to DNS historical data, BLMNews.com dates back to 2008, when the Iranian company Mizban Web Paytakht Co, Ltd., hosted BLMNews.com on two separate occasions.

Mizban Web Paytakht company appeared also in 2016 under NS (name server) records. This type of DNS stores the name of a domain’s server.

Using IP address location, the DFRLab found that Mizban Web Paytakht, a host provider company, is based in Tehran, Iran.

Narratives against Israel and Saudi Arabia

The pages routinely targeted Israel and Saudi Arabia, focusing especially on the Palestine and Yemen conflicts, respectively. The page Israel Deceits and Lies shared a controversial 2001 quote by former Israeli Prime Minister Benjamin Netanyahu on how to deal with Palestinians as well as shared quotes from Israeli writers and authors condemning Israeli politics on Palestine.

The page Campaña contra bloqueo a Hispantv (“HispanTV Anti-Block Campaign”), a likely reference to an earlier Facebook take down in August 2018, also included narratives against Israel, focusing on the country’s largest demolition project yet of Palestinian houses. Another post criticized Netanyahu’s comments thanking Trump for designating Iran’s Islamic Revolutionary Guard Corps (IRGC) as a foreign terrorist organization and for placing wide-ranging economic and travel sanctions on the IRGC, organizations, and companies linked to it as a consequence of the designation.

HispanTV is Iran’s state-run Spanish-language television channel and features content on Latin America on its eponymous website, but the posts on Facebook mainly concerned Iran, Palestine and Israel, and U.S. involvement in the region. Some of the posts highlighted Iran’s strategies to increase uranium if the P5+1 (the UN Security Council members plus Germany) violates the nuclear agreement.

Ecuadorian protests

The Elintelecto page was the only page among these Facebook assets that covered the protests in Ecuador. In particular, Elintelecto posted content demonizing Ecuadorean President Lenin Moreno, the International Monetary Fund (IMF), and U.S. Secretary of State Mike Pompeo. The recent protests arose after the government eliminated popular fuel subsidies and resulted in eight dead, more than 1,300 people injured, and nearly 1,200 arrested.

Conclusion

Overall, these networks were a fairly obvious attempt to push pro-Iranian narratives under the guise of an ostensible domestic focus. The removed assets propagated pro-Iranian content targeting three countries in particular — the United States, Israel, and Saudi Arabia — while delving into domestic politics at times.

The localized content from these Facebook pages discussed Latin American political topics, such as the protests in Ecuador, the Venezuelan government’s approach to the immigration crisis along the Colombian border, President Maduro’s approach to the 2020 legislative elections in Venezuela, and the primary elections in Argentina that took place on August 11, 2019.

Esteban Ponce de León is Research Assistant, Latin America, with the Digital Forensic Research Lab and is based in Colombia.

Follow along for more in-depth analysis from our #DigitalSherlocks.