BANNER: (Source: @KaranKanishk/DFRLab via Facebook)

On May 28, Facebook removed a number of assets operating from Iran that amplified Iranian state messaging and that targeted the United States 2016 presidential election in a manner similar to operations run from Russia in 2016.

In total, Facebook and Instagram removed 92 assets — pages, groups, and accounts — that targeted U.S., British, and Saudi politics and elections using false identities to pose as local pages. These online assets were taken down for “coordinated inauthentic behavior,” when groups, pages, and accounts mislead people through deceptive behavior.

The assets dealt with a range of issues, including promoting the messages of Ayatollah Khamenei, Iran’s spiritual leader, and attacking Saudi Crown Prince Mohammed Bin Salman (also commonly referred to by his initials, “MBS”). Most striking, however, the assets also briefly forayed into U.S. electoral politics, with short and ineffective campaigns against Hillary Clinton and for Donald Trump.

The Iranian election interference strongly resembled the Russian operation of 2016 in approach and demographic targeting, but the Iranian pages were much less effective and attracted very few followers — just 595 spread across five election-related pages.

The takedown began with a tip from online investigation group FireEye. On May 28, FireEye published an analysis of the operation’s activity on Twitter and other online sites, concluding with low confidence that it was “organized in support of Iranian political interests.” Based on the tipoff, Facebook identified related assets on its own platform and shared a subset of these with the DFRLab prior to their removal. Facebook concluded that their inauthentic behavior “originated in Iran.”

In a blog post, Facebook stated:

Much of the content reviewed by the DFRLab fit this pattern of messaging consistent with Iranian government narratives. One page, for example, was titled “Resign you murderer” and focused on MBS, the Crown Prince of Saudi Arabia, one of Iran’s chief regional rivals. Active in late 2015, it accused MBS of personal responsibility for the deaths of children in Yemen, sometimes with graphic imagery of dead children.

Other pages promoted the sayings of Ayatollah Khamenei and criticized Israel’s actions in Gaza and the Palestinian territories. One, “Meet the Beauty of Islam,” operated in English. A second with the concise name of “Les messages conçus dans le discours de Khamenei aux jeunes occidentaux” (translated from the French, “The messages conceived in Khamenei’s speech to young Westerners”) operated in French but was minimally active, only posting at the end of 2015 and focusing solely on the content of two Khamenei speeches addressed to young Westerners that year.

Further pages boosted Iran as a tourist destination, under the banner “Discover New Persia,” and posed as a news service, the “World News Agency,” that largely focused on the conflicts in Syria and Yemen and published news favorable to Iran’s allies and proxies.

One Arabic-language page, @AlArabyi, repeatedly posted links to the website of Saudi-funded broadcaster AlArabiya.net. The broadcaster’s website links to a different, verified Facebook account, @AlArabiya, with over 22 million followers. The Iranian page used similar visual branding to the verified account and largely shared content from the website, making it likely that it was an attempt to pass pro-Iranian messaging under the guise of the Saudi broadcaster. It stopped posting in September 2015, by which time it had over 5,000 followers — by far the highest follower number in the takedown set to which the DFRLab had access.

With the exception of the Al Arabiya lookalike, none of these pages garnered substantial followings. Most of them fell silent in 2016 or early 2017, suggesting that the operation was an experiment that was abandoned well before it was taken down.

The same applied to the pages that focused on U.S. politics in general, and the 2016 presidential election in particular. These pages were striking for their resemblance to the parallel Russian operation but came nowhere near it in scale or user response.

One election-related page focused on supporting Democratic Senator Bernie Sanders and attacked his main rival for the presidential nomination, former Secretary of State Hillary Clinton.

The page, created on April 4, 2016, was called “Not the billionaires” when it was first created but changed its name three days later to the more personal “Bernie Sanders — a way to a better future.” Its content was outspokenly pro-Sanders and explicitly supported his bid against Clinton. It ceased posting in May 2016, however, before Clinton had secured the Democratic nomination.

The page expressed a broadly anti-interventionist stance, quoting Sanders on the “magical thinking” inherent in regime change by force. On at least one occasion, it shared an article originally published by Kremlin broadcaster RT that attacked Clinton.

This behavior was remarkably similar to the Russian election interference operation in 2016, as illuminated in Special Prosecutor Robert Mueller’s February 2018 indictment of Russia’s Internet Research Agency, more commonly known as the St. Petersburg Troll Farm. As with the 2016 Russian operation, the assets removed in this takedown also promoted Sanders at Clinton’s expense and even urged African American voters not to vote for Clinton in order to suppress Democratic turnout.

The Russian operation focused heavily on the African American community. The Iranian operation also ran a page focused on the Black Lives Matter movement, though it fell silent on December 9, 2015, before the presidential race heated up. Little of its content related to presidential candidates; one post shared an article from Sanders, while another called for a U.S. president like British Labour Party leader Jeremy Corbyn, whose name it misspelled.

Like the pro-Sanders page, “Black Lives Matter 2015” shared posts from RT on several occasions but did not share posts from Iranian state outlets such as PressTV.

Neither page performed well on Facebook. The Sanders page had 144 followers, and the BLM page had 205 — both yielding less than one thousandth of the following just one (“Blacktivist”) of the Russian pages managed to garner during its existence.

Two of the pages, “Fight for my conservative president” and “Fight for a conservative president,” were dedicated to supporting Donald Trump’s candidacy. One of the pages had no posts, while the other page often shared content from the website thetrumptimes.com, a right-wing website posting pro-Trump content. The page also advertised products that cater to “patriotic” ideology.

The page posted sporadic pro-Trump and anti-Clinton memes in the buildup to the 2016 election and thereafter. It regularly posted commercial ads, including an ad for a Trump-themed cruise in the Caribbean.

As with the anti-Clinton pages, these pro-Trump pages were similar to, but much less effective than, their Russian counterparts. The Iranian pro-Trump pages together garnered just 324 followers.

The Iranian operation also featured assets that boosted third parties and urged Americans not to vote at all.

Two pages — “American Citizen Party” and “America’s Party” — ostensibly promoted parties outside the mainstream duopoly. In the countdown to the 2016 presidential election, however, they were unsparingly hostile to Clinton, while leaving Trump largely unmentioned.

This is reminiscent of the Russian campaign, which targeted many different groups, including third-party voters, in a bid to steer them away from voting Democratic.

These third-party accounts also posted occasionally on issues much closer to Iran’s foreign-policy concerns. The “American Citizen Party” criticized U.S. support for Israel, for example, and the “America’s Party” page did the same while also criticizing Saudi Arabia.

A similar page, the clumsily named “TWO PARTY system; ‘Illusion of choice,’” ostensibly promoted the idea of a multi-party democracy. Many of its posts, however, concerned U.S. foreign policy, especially on Israel and the Middle East.

The pages also demonstrated a severe lack of command of English, one of the main indicators to look for when identifying a fake asset.

Neither of the pages achieved more than 80 followers, and both stopped posting by early 2017. Again, this operation strongly resembled the Russian one in style and approach, but not in scale, determination, or reach.

The Iranian operation also had targets outside the United States, with one of the pages, “Republicanism for Great Britain,” dedicating itself to a campaign against the British monarchy. The page featured mordant and vitriolic posts directed at the Royal Family.

“Support-Jeremy-Corbyn,” a page committed to supporting Jeremy Corbyn’s reelection campaign, following a no-confidence vote, to retain his leadership of the Labour Party in 2016. The page was heavy on memes along with some original posts and others that shared links from various media organizations.

Many of the pages in this takedown were critical of the United States’ and United Kingdom’s monetary and diplomatic support for Israel and strongly in favor of Palestine. In line with this narrative, Support-Jeremy-Corbyn also highlighted comments by the British leader that were critical of the Israeli blockade on Gaza, showing him as pro-Palestinian in his outlook.

The support for Corbyn and for Sanders in 2016 is striking, because the pages resemble those created during another Iranian influence operation first exposed by FireEye in the summer of 2018. In that operation, Iranian operators maintained a number of Facebook and Twitter accounts, including one called “Berniecratss” and another called “The British Left,” that often praised Corbyn.

The Facebook pages and groups to which the DFRLab had access removed as a part of the company’s May 28 takedown covered a wide breadth of topics. Some focused on the Middle East, with a strong interest in attacking Saudi Arabia and its Crown Prince, in particular, or promoting Iran and its virtues. Others conveyed an intention to infiltrate domestic American politics concurrently or sometimes even earlier than the 2016 Russian effort. Still others took aim at the supposed corruption of the British Royal Family. Despite their varied focus, they were all similar in two important ways: they were all relatively limited in lifespan, being abandoned after only a short tenure of operation, and they were quite limited in reach, usually with a very low follower count and even lower engagement rate.

Register for the DFRLab’s upcoming 360/OS summit, to be held in London on June 20–21. Join us for two days of interactive sessions and join a growing network of #DigitalSherlocks fighting for facts worldwide!

Previous reports from the DFRLab on Facebook takedowns of Iranian assets:

April 19, 2019: Facebook Dismantled Iranian Influence Operation

March 26, 2019: KEY FINDINGS: Iranian Propaganda Network Goes Down

March 26, 2019: IN DEPTH: Iranian Propaganda Network Goes Down

January 31, 2019: #TrollTracker: Outward Influence from Iran

October 26, 2018: #TrollTracker: Facebook Uncovers Iranian Influence Operation

August 29, 2018: #TrollTracker: An Iranian Messaging Laundromat

August 27, 2018: #TrollTracker: Iran’s Suspected Information Operation