The Corner

National Security & Defense

Iran-Linked Individuals Faked Social Media Accounts, Blog Posts, Letters to the Editor

The Iranian flag flutters in front of the International Atomic Energy Agency headquarters in Vienna, Austria, March 4, 2019. (Leonhard Foeger/Reuters)

A private cybersecurity firm, FireEye Threat Intelligence, recently announced that they had identified a network of English-language social-media accounts that engaged in inauthentic behavior and misrepresentation and that “we assess with low confidence was organized in support of Iranian political interests.” This is the second group of social media accounts identified by FireEye as part of an Iranian propaganda or disinformation campaign.

Narratives promoted by these and other accounts in the network included anti-Saudi, anti-Israeli, and pro-Palestinian themes. Accounts expressed support for the Joint Comprehensive Plan of Action (JCPOA), commonly known as the Iran nuclear deal; opposition to the Trump administration’s designation of Iran’s Islamic Revolutionary Guard Corps (IRGC) as a Foreign Terrorist Organization; antipathy toward the Ministerial to Promote a Future of Peace and Security in the Middle East (a U.S.-led conference that focused on Iranian influence in the Middle East more commonly known as the February 2019 Warsaw Summit); and condemnation of U.S. President Trump’s veto of a resolution passed by Congress to end U.S. involvement in the Yemen conflict.

This Iranian operation is a little more sophisticated, and potentially more dangerous, than what we saw from Russia in 2016. Quite a few media institutions quoted the Russian Twitter accounts in their articles while covering that year’s presidential election. The Iranian accounts identified by Fire Eye managed to get letters, guest columns, and blog posts published in American publications and web sites, written under false names.

We observed some personas in the network leverage legitimate print and online media outlets in the U.S. and Israel to promote Iranian interests via the submission of letters, guest columns, and blog posts that were then published.

The letters and columns, many of which were published in 2018 and 2019, but which date as far back as 2015, were mostly published in small, local U.S. news outlets; however, several larger outlets have also published material that we suspect was submitted by these personas. In at least two cases, the text of letters purportedly authored by different personas and published in different newspapers was identical or nearly identical, while in other instances, separate personas promoted the same narratives in letters published within several days of each other. The published material was not limited to letters; one persona, “John Turner,” maintained a blog on The Times of Israel website from January 2017 to November 2018, and wrote articles for the U.S.-based site Natural News Blogs from August 2015 to July 2018. The letters and articles primarily addressed themes or promoted stances in line with Iranian political interests, similar to the activity conducted on social media.

The media entities that were fooled were not always small: The Los Angeles Times, the Seattle Times, and Galveston County’s the Daily News. The average newspaper letters page does not spend a lot of time and effort verifying the identities of those who write in, and some foreign power would probably find this venue to be low-hanging fruit for getting their propaganda messages distributed.  (Then again, we can ask how much propaganda value there is in getting a letter to the editor published. True cynics may conclude this problem will disappear when newspapers disappear.)

What’s more, the Iranian actors attempted to impersonate American political candidates online:

Some Twitter accounts in the network impersonated Republican political candidates that ran for House of Representatives seats in the 2018 U.S. congressional midterms. These accounts appropriated the candidates’ photographs and, in some cases, plagiarized tweets from the real individuals’ accounts. Aside from impersonating real U.S. political candidates, the behavior and activity of these accounts resembled that of the others in the network.

For example, the account @livengood_marla impersonated Marla Livengood, a 2018 candidate for California’s 9th Congressional District, using a photograph of Livengood and a campaign banner for its profile and background pictures. The account began tweeting on Sept. 24, 2018, with its first tweet plagiarizing one from Livengood’s official account earlier that month.

This didn’t attract much attention or generate much controversy last cycle, but it’s not hard to imagine the Iranians or some other foreign intelligence service making mischief by impersonating a candidate. In theory, verified accounts would present an obstacle to this activity, but Twitter is currently not validating any more accounts.

The FireEye analysis notes “some accounts in the network also posted a small amount of messaging seemingly contradictory to their otherwise pro-Iran stances.” This is similar to the approach of the Russian Internet Research Agency as described by former employees. Two employees argue the position that the Russian government favors, one employee argues the position that the Russian government opposes. (It’s easy to suspect that these IRA employees’ mission is to argue that side of the argument badly and unconvincingly.)

Note that many, but not all, of the Twitter accounts identified by FireEye use those familiar name-and-sequence-of-random-numbers handle — “@JasonCa26738291” “@MarkAda05568324” “@LindaJa02370118,” etc. Thank heaven for foreign operatives with no creativity.

Will this Iranian activity generate as much discussion as Russia’s activities in the 2016 election? Or do certain lawmakers and the media not find it as much of a concern when the foreign power’s intended victims are Republicans?

Most Popular


In Defense of Coleman Hughes

Picture the scene: A young man walks into a congressional hearing to offer witness testimony. His grandfather was barbarically brutalized by people who are now long dead. The nation in which he resides built its wealth of his grandfather’s brutalization. The question: Should his fellow citizens pay the young ... Read More
Film & TV

Toy Story 4: A National Anthem

The Toy Story franchise is the closest thing we have to an undisputed national anthem, a popular belief that celebrates what we think we all stand for — cooperation, ingenuity, and simple values, such as perpetual hope. This fact of our infantile, desensitized culture became apparent back in 2010 when I took a ... Read More

College Leaders Should Learn from Oberlin

Thanks to their social-justice warrior mindset, the leaders of Oberlin College have caused an Ohio jury to hit it with $44 million in compensatory and punitive damages in a case where the school couldn't resist the urge to side with its “woke” students against a local business. College leaders should learn ... Read More

Joe and the Segs

Joe Biden has stepped in it, good and deep. Biden, if he has any hope of ever being elected president, will be dependent on residual goodwill among African Americans from his time as Barack Obama’s loyal and deferential vice president — so deferential, in fact, that he stood aside for Herself in 2016 even ... Read More
Politics & Policy

The Madcap Caution of Donald Trump

The worry last week was that the Trump administration was ginning up fake intelligence about Iran blowing up oil tankers in the Strait of Hormuz to justify a war against Iran. Then, this week, President Donald Trump said the Iranian attacks weren’t a big deal. The episode is another indication of the ... Read More
Film & TV

Fosse/Verdon and the Dismal #MeToo Obsession

In the final episode of Fosse/Verdon, one of the two titular characters, Bob Fosse, is shooting one of the greatest films of all time. The other, Gwen Verdon, is having a quarrel with her unspeakably dull boyfriend about whether he approves of her performing in a road-show production of a Broadway musical. These ... Read More