'Iran’s Broadcaster: Inauthentic Behavior: Facebook Takes Down Covert Assets Linked To State Broadcaster' by Ben Nimmo, C. Shawn Eib, Léa Ronzaud, Rodrigo Ferreira, Thomas Lederer and Melanie Smith at Graphika
comments
On April 30, Facebook took down over 500 pages, groups, and accounts that it attributed to Islamic Republic of Iran Broadcasting Corporation, or IRIB, the Iranian state broadcaster. Parts of the network were live at the moment of the takedown; others had been briefly active as far back as 2011. Overall, the takedown covered nine years of sporadic activity in almost as many languages.
Announcing the takedown on May 5, Facebook said, “The individuals behind this network relied on a combination of authentic and fake accounts — some of which had been previously detected and disabled by our automated systems — to post in Groups, manage Pages, and drive people to off-platform sites. (...) Although the people behind this activity attempted to conceal their identities and coordination, our investigation found links to the Islamic Republic of Iran Broadcasting Corporation.”
Before the takedown, Facebook shared the names of some of the assets with Graphika for an independent assessment.
The assets posted about a wide range of themes, from perennial Iranian concerns, such as the country’s enmity with Israel and Saudi Arabia, to more surprising and momentary topics, such as the Occupy Movement of 2012 and the Scottish independence referendum of 2014. Some assets were only briefly active and appear to have been experimental; some posted for years. Many posed as independent news outlets or independent commentators or were associated with websites that made similar claims. Most of the assets had followings in the hundreds or low thousands; a handful had more, and a handful had none at all.
The primary language of these assets was Arabic, with English a distant second (there were three times as many pages in Arabic). The network also included assets that posted in Persian, Bengali, Bosnian, and French. Its initial focus was on politics, culture, and events in the Middle East, and it briefly flirted with domestic politics in the United States (2012) and United Kingdom (2014).
Starting in 2017, it began to build out a portfolio of accounts that were focused on events in Africa; by the time the network was taken down, these constituted a large part of its activity.
Much of the network’s activity resembled other known Iranian influence operations. The Islamic Republic has long been one of the most persistent actors in this field: the exposure of actors such as the International Union of Virtual Media(IUVM) and operations such as Endless Mayfly and Distinguished Impersonator have illustrated Iran’s repeated attempts at covert online influence, and Facebook and Twitter have e xposed repeated Iranian operations on their platforms. IRIB itself wasimplicatedinFacebooktakedownsinMarch2019(viaitssubsidiaryParsToday)and A ugust 2018 (via PressTV).
A particularly interesting feature of the network was the way it targeted the United States and United Kingdom with fake accounts, memes, and cartoons as early as 2012-2014. It particularly targeted the Republican primaries of early 2012, when it backed Ron Paul and attacked Mitt Romney, and the Scottish independence referendum of 2014, when it backed independence. These efforts do not appear to have yielded viral impact or any other measurable form of success, and the network abandoned them relatively quickly. Nevertheless, Facebook’s revelation is of historical interest: it provides a confirmed data point on attempted foreign interference in Western democratic exercises as far back as 2012, a full electoral cycle before the Russian interference of 2016.
