Revealed: Iran's 'clumsy' troll army pushed one million tweets in effort to destabilise region

Twitter releases extent of Tehran's Twitter activity, showing hundreds of accounts set up to spread regime's propaganda. But efforts were fairly crude and ineffective, analyst says

The Equifax data breach in 2017 exposed sensitive information, such as social security numbers, belonging to about half the US population. Getty

A data dump of state-sponsored Twitter troll operations has revealed Iran's "clumsy" efforts to mimic Russia's social media disinformation campaign, including hundreds of accounts and one million tweets.

Twitter released its complete data set of Iran's and Russia's activity, which combined amounts to more than 10 million tweets and two million images.

The company announced the data dump on Wednesday, encouraging researchers and experts to analyse the data so they can better understand how their platform had been misused.

Analysis of the Iranian troll activity shows a focus on discrediting Saudi Arabia and crude attempts at copying their more effective Russian counterparts.

"It is clear that information operations and co-ordinated inauthentic behaviour will not cease," the social network wrote on its blog. "These types of tactics have been around for far longer than Twitter has existed — they will adapt and change as the geopolitical terrain evolves worldwide and as new technologies emerge," it said in the post authored by two members of staff.

Data on trolls connected to the Russian Internet Research Agency, which is the subject of United States intelligence investigations into Russian interference in the 2016 presidential elections, have also been released.

Both regimes put a huge amount of effort into their operations. The Iranian troll operation consisted of 770 users and one million tweets, while Russia's 3,841 accounts posted nine million tweets.

"The Iranian operation was big but it was frankly clumsy," Ben Nimmo, an Information Defense Fellow at the Atlantic Council who had an advance look at the data told The National. "They weren't very good at what they did. The big difference between the Iranian operation and the Russian one was that the Russian operation was using Twitter and other social media to engage people, the Iranian operation was using social media to message people."

Approximately a third of the one million Iranian tweets released by Twitter contained links to awdnews.com. AWD News is a part of a cluster of sites exposed by FireEye in August to be Iranian government sponsored outlets, Mr Nimmo said.

The Iranian operation, however, was pushing pro-regime narratives, without engaging people.

"If you compare that with some of the best performing Russia troll accounts, they had real personalities. They were engaging with people, they were funny, they were sarcastic, they were edgy, they appeared to be real people. The Iranian attempt didn't have personality, they just had content," Mr Nimmo said.

_______________

Read more:

_______________

Iranian trolls posted about Saudi Arabia more than any other geopolitical phrase, mentioning the phrase "Saudi" nearly 90,000 times, accusing the Saudis of committing war crimes, analysis by Mr Nimmo revealed.

"This was really about promoting Iranian narratives...there were a lot of posts about Yemen and the Syrian conflict.

"It was very much 'the Saudis are bad and they are doing bad things', it wasn't a very sophisticated message," Mr Nimmo said.

Once Russia's disinformation campaign was exposed by newspapers, the Iranian operation appeared to mimic the Russian operation.

"One of the key moments is that there was an account called Liberty Front Press, which in July of this year changed its name to Bernicrats...it looks like the Iranian troll operation was probably watching the Russian operation and looked at what works."

Other popular phrases used in the Iranian campaign were "Trump", "Palestine", "Israel", "Syria", "Quds" (Jerusalem in Arabic), "Turkey", "Assad" and "Netanyahu".

Many of the Iranian trolls either posed as news sites or masqueraded as journalists. One account with 1,450 followers, MariaLuis91, which claimed to be a French journalist, posted the same article to hundreds of different people each day throughout 2014, Mr Nimmo said.

"They were just spam sharers, but that's not the kind of behaviour which is going to engage lots of people. They are just going to think who are you and why are you sending me this, and I will probably block you."

Many of the tweets and pictures from the archives were in French, some referring to Charlie Hebdo, the satirical newspaper which was the subject of a terror attack in 2015. Some implied France was becoming overrun by terrorists, mimicking lines from far-right anti-immigration parties.

It is unclear if all of Iran's operation has been shut down by Twitter, by Mr Nimmo says there are "indications that the websites that have been identified so far are not the full set".