The Corner

National Security & Defense

Iran-Linked Individuals Faked Social Media Accounts, Blog Posts, Letters to the Editor

The Iranian flag flutters in front of the International Atomic Energy Agency headquarters in Vienna, Austria, March 4, 2019. (Leonhard Foeger/Reuters)

A private cybersecurity firm, FireEye Threat Intelligence, recently announced that they had identified a network of English-language social-media accounts that engaged in inauthentic behavior and misrepresentation and that “we assess with low confidence was organized in support of Iranian political interests.” This is the second group of social media accounts identified by FireEye as part of an Iranian propaganda or disinformation campaign.

Narratives promoted by these and other accounts in the network included anti-Saudi, anti-Israeli, and pro-Palestinian themes. Accounts expressed support for the Joint Comprehensive Plan of Action (JCPOA), commonly known as the Iran nuclear deal; opposition to the Trump administration’s designation of Iran’s Islamic Revolutionary Guard Corps (IRGC) as a Foreign Terrorist Organization; antipathy toward the Ministerial to Promote a Future of Peace and Security in the Middle East (a U.S.-led conference that focused on Iranian influence in the Middle East more commonly known as the February 2019 Warsaw Summit); and condemnation of U.S. President Trump’s veto of a resolution passed by Congress to end U.S. involvement in the Yemen conflict.

This Iranian operation is a little more sophisticated, and potentially more dangerous, than what we saw from Russia in 2016. Quite a few media institutions quoted the Russian Twitter accounts in their articles while covering that year’s presidential election. The Iranian accounts identified by Fire Eye managed to get letters, guest columns, and blog posts published in American publications and web sites, written under false names.

We observed some personas in the network leverage legitimate print and online media outlets in the U.S. and Israel to promote Iranian interests via the submission of letters, guest columns, and blog posts that were then published.

The letters and columns, many of which were published in 2018 and 2019, but which date as far back as 2015, were mostly published in small, local U.S. news outlets; however, several larger outlets have also published material that we suspect was submitted by these personas. In at least two cases, the text of letters purportedly authored by different personas and published in different newspapers was identical or nearly identical, while in other instances, separate personas promoted the same narratives in letters published within several days of each other. The published material was not limited to letters; one persona, “John Turner,” maintained a blog on The Times of Israel website from January 2017 to November 2018, and wrote articles for the U.S.-based site Natural News Blogs from August 2015 to July 2018. The letters and articles primarily addressed themes or promoted stances in line with Iranian political interests, similar to the activity conducted on social media.

The media entities that were fooled were not always small: The Los Angeles Times, the Seattle Times, and Galveston County’s the Daily News. The average newspaper letters page does not spend a lot of time and effort verifying the identities of those who write in, and some foreign power would probably find this venue to be low-hanging fruit for getting their propaganda messages distributed.  (Then again, we can ask how much propaganda value there is in getting a letter to the editor published. True cynics may conclude this problem will disappear when newspapers disappear.)

What’s more, the Iranian actors attempted to impersonate American political candidates online:

Some Twitter accounts in the network impersonated Republican political candidates that ran for House of Representatives seats in the 2018 U.S. congressional midterms. These accounts appropriated the candidates’ photographs and, in some cases, plagiarized tweets from the real individuals’ accounts. Aside from impersonating real U.S. political candidates, the behavior and activity of these accounts resembled that of the others in the network.

For example, the account @livengood_marla impersonated Marla Livengood, a 2018 candidate for California’s 9th Congressional District, using a photograph of Livengood and a campaign banner for its profile and background pictures. The account began tweeting on Sept. 24, 2018, with its first tweet plagiarizing one from Livengood’s official account earlier that month.

This didn’t attract much attention or generate much controversy last cycle, but it’s not hard to imagine the Iranians or some other foreign intelligence service making mischief by impersonating a candidate. In theory, verified accounts would present an obstacle to this activity, but Twitter is currently not validating any more accounts.

The FireEye analysis notes “some accounts in the network also posted a small amount of messaging seemingly contradictory to their otherwise pro-Iran stances.” This is similar to the approach of the Russian Internet Research Agency as described by former employees. Two employees argue the position that the Russian government favors, one employee argues the position that the Russian government opposes. (It’s easy to suspect that these IRA employees’ mission is to argue that side of the argument badly and unconvincingly.)

Note that many, but not all, of the Twitter accounts identified by FireEye use those familiar name-and-sequence-of-random-numbers handle — “@JasonCa26738291” “@MarkAda05568324” “@LindaJa02370118,” etc. Thank heaven for foreign operatives with no creativity.

Will this Iranian activity generate as much discussion as Russia’s activities in the 2016 election? Or do certain lawmakers and the media not find it as much of a concern when the foreign power’s intended victims are Republicans?

Most Popular

Politics & Policy

Hillary Ruins the Plan

Editor’s note: Andrew C. McCarthy’s new book is Ball of Collusion: The Plot to Rig an Election and Destroy a Presidency. This is the first in a series of excerpts.  There really was a collusion plot. It really did target our election system. It absolutely sought to usurp our capacity for ... Read More
Religion

Another Pop-Culture Christian Loses His Faith

It’s happened again. For the second time in three weeks, a prominent (at least in Evangelical circles) Christian has renounced his faith. In July, it was Josh Harris, a pastor and author of the mega-best-selling purity-culture book I Kissed Dating Goodbye. This month, it’s Hillsong United songwriter and ... Read More
Elections

A Brief History of Election Meddling

Editor’s note: Andrew C. McCarthy’s new book is Ball of Collusion: The Plot to Rig an Election and Destroy a Presidency. This is the second in a series of excerpts. ‘The 1980s are now calling to ask for their foreign policy back.” Thus spoke President Barack Obama just a couple of weeks before ... Read More
World

The End of Hong Kong as We Know It

The protests in Hong Kong have been going on for more than four months now, and no matter how the current crisis concludes in the coming days or weeks, it will mark the end of Hong Kong as we know it. The protests started in response to an extradition bill that was proposed by the city’s Beijing-backed ... Read More
Culture

Max Boot’s Dishonesty

Before yesterday, my primary criticism of the Washington Post’s Max Boot was political in nature. As I wrote in a recent book review, I found it regrettable that Boot’s opposition to the president had not prevented him from “succumbing reactively to Trump’s cult of personality, or from making Trump the ... Read More