U.S. Secretary of State’s Instagram account subjected to a coordinated Iran-related spam attack

Thousands of accounts spammed U.S. Secretary of State Mike Pompeo’s Instagram account in recent weeks by posting duplicate and often anti-American comments.

@DFRLab found that the activity called for the decline of the United States in what seemed to be a coordinated effort among accounts claiming affinity for Iran. The comments generally echoed the Iranian regime’s infamous and stereotypical call of “death to America.”

The comments, however, were not restricted to only one post by Secretary Pompeo. In fact, there was a sudden surge of comments across many separate posts after January 11, when Secretary Pompeo announced an international summit on Middle East security and Iran’s threat to stability in the region.

Several of the posts on Secretary Pompeo’s Instagram profile posted after January 11 contain Iran-related commentary. In response to one of Pompeo’s posts about the unrest in Venezuela, several comments expressed support for the end of the dictatorship in Venezuela. Others called for the overthrow of Ali Khamenei, Iran’s longtime Supreme Leader. In another post commemorating Holocaust Remembrance Day, several comments expressed support for the Iranian opposition movement “Restart.” As depicted below, these comments are often duplicated many times, indicating spam-like behavior.

@DFRLab performed an in-depth analysis of a recent post in which Secretary Pompeo praised President Donald Trump’s State of the Union speech, summarizing the Administration’s “progress” with North Korea on denuclearization, “confronting Iran” on security concerns, and fostering support to the Venezuelan people.

Around a day later, on February 11, 2019, there were approximately 4,700 comments on the post, of which 4,264 were incorporated into this research.

Duplicate Commenting

@DFRLab found that more than 3,500 of the comments on the post were extremely similar, which is indicative of spam.

Approximately 75 percent of all comments on the post contained anti-U.S. sentiment with phrases including “Down with USA” and “Death to America” accompanied by specific emoji combinations. Furthermore, more than 50 percent of the comments contained an emoji of the Iranian flag.

The most common comment was “🇮🇷🇮🇷 Down with USA 🇮🇷🇮🇷.” It was posted 1,551 times by 1,335 accounts.

@DFRLab analyzed the accounts that wrote this comment and found that most of these accounts produced very few posts, and around a third of the accounts never posted a photo or video. A small percentage of these accounts had many posts, and one especially active account had 2,338 posts and 13,481 followers.

The number of followers these accounts garnered was low compared with the number of accounts they followed.

Only 15 percent of the accounts had more followers than accounts followed, and more than 47 percent of accounts followed at least 25 times the number of accounts that followed them.

A 2015 study by Pennsylvania State University found that, among a random sample, the median number of followers for an Instagram account varied from 272 to 286 accounts and the number of accounts followed ranged between 348 and 401 (variance based on the estimated age of the account user). This finding translates to a median following-to-follower ratio of approximately 1.3:1, which is less than 10 percent of the following-to-follower ratio of most of the accounts @DFRLab examined. The relatively low following-to-follower ratio of the accounts indicates that the accounts may have been created recently with the express purpose of duplicating the frequent comments on Secretary Pompeo’s posts.

Playing Defense

A second wave of comments came from four of the most frequently commenting accounts, which had 2.5–5.5 times the number of comments as the next most frequent commenters. These four accounts commented an average of 40 times on Secretary Pompeo’s post about the State of the Union address, predominantly in response to the first wave of comments that expressed anti-American sentiment.

Compared to the many accounts expressing anti-American sentiment, these four frequent commenters had a low following-to-follower ratio (0.82:1). This ratio is lower than the baseline of approximately 1.3:1 established in the Pennsylvania State study. The top four commenters also had a high average number of posts of 402 per account.

The above screenshots of the four top accounts demonstrate that the profiles are quite similar to one another: they have four of their six most recent posts in common.

This cohort of accounts had a preference of engaging others via replies rather than posting original content. In 98 percent of their comments, they tagged another account and included poop and/or thumbs-down emojis. Many of the accounts tagged had previously commented with anti-American sentiment. The four accounts likely had the intention of expressing disagreement with the original commenter’s message.

In another indicator of a coordinated effort, three of the four accounts duplicated a message to President Trump:

“Mr trump please Iran’s opposition is incapable Iranian people do not trust their members Prince Reza Pahlavi is the only person who is popular with Iran. Invite the prince to the Warsaw summit.”

The comment referred to the February 13–14, 2019, summit in Poland, first announced by Secretary Pompeo on January 11, 2019.

The current Iranian regime has expressed fervent opposition to the conference. Iran’s Foreign Minister Mohammad Javad Zarif recently criticized Poland for jointly hosting the summit with the United States, calling it a “desperate anti-Iran circus.”

The tension between supporters and opponents of the summit also unfolded on Twitter. Accounts amplified several hashtags through inorganic means, including one hashtag that called for the Trump Administration to #InviteRestartLeaderToWarsaw, in reference of the Iranian opposition movement called “Restart.” Inorganic amplification is often orchestrated by several coordinated users focused on retweeting, sharing, or commenting a common phrase for a short amount of time with the aim of drawing attention to the topic. @DFRLab previously reported on the cooption of the hashtag “#WeSupportPolandSummit” on Twitter.

Conclusion

Several of the posts examined by @DFRLab exhibited patterns consistent with a concentrated, two-sided effort to control the discourse about the Poland summit. These included few overall posts among the commenting accounts, an abnormally high following-to-follower ratio among the accounts expressing anti-American sentiment, a pattern of similar phrases repeated thousands of times demonstrating anti-American sentiment, and a small but focused set of homogenous replies expressing disagreement with comments of anti-American sentiment.

The tactics employed in the spam attack on Secretary Pompeo’s Instagram page closely resemble the attack targeting the Macedonian government’s Facebook page that @DFRLab reported on in January 2019.

The flood of comments appearing on Secretary Pompeo’s posts unfolded in two waves. The first wave consisted of a large cohort of accounts expressing primarily anti-American sentiment. A much smaller cohort dominated the second wave, which expressed disagreement to posts by the first wave accounts. Across both waves, the topics broached by the spam accounts varied in the extent to which they concerned Iran, with some comments containing explicit references to Iranian domestic and international politics and others eschewing any reference whatsoever to Iran.

Follow along for more in-depth analysis from our #DigitalSherlocks.