ANALYSIS: Iran's online propaganda is sloppy, unsophisticated and overhyped

NEW YORK, United States – A recent report from FireEye, a cybersecurity software maker, accused Iran of driving political web content to users in the US, UK, Latin America and the Middle East, prompting Facebook, Twitter and Google to collectively cut hundreds of suspect accounts.

Evidence that Tehran, a long-standing foe of the United States, built phony news websites to spread its political message via social media stoked pre-existing fears of online agitprop directed by Russia and others ahead of the US mid-term elections in November.

But digital security experts told Middle East Eye that Iran’s efforts were less sophisticated and worrisome than is suggested by FireEye’s report and may amount to little more than a dozen-or-so staff in a Tehran office running off a shoestring budget.

FireEye also has close ties with US intelligence agencies, counts Tehran’s arch-foe Saudi Arabia among its clients and has already benefited financially from a scare that propped up its sagging stock price.

Amin Sabeti, UK-based founder of online security firm Certfalab and Iranian internet researcher, said that while Tehran was only a mediocre player in the realm of “fake news,” the tech giants acted prudently.

“At this stage, Iran’s efforts at an online propaganda war do look amateurish and sloppy. These were a few websites that were updated infrequently, written in often poor English and with only a bunch of broken links,” Sabeti told MEE.

“But it was likely only a starting point for Iran. They were building up a base of followers and their efforts could become more sophisticated in a future in which many governments will be taking part in these types of information wars.”

Iranian effort ‘sloppy’ and easy to trace

According to FireEye, Iran’s propaganda machine represented a worrying effort to push narratives in line with Tehran’s interests. It involved a web of fake news websites and fraudulent social media personas spread across Facebook, Instagram, Twitter, Google Plus and YouTube.

In response, Twitter culled 284 accounts. Facebook cut 254 pages and 392 accounts across its flagship platform and its Instagram service. Google terminated 39 YouTube channels linked to state-run Islamic Republic of Iran Broadcasting.

The shared posts included “anti-Saudi, anti-Israeli, and pro-Palestinian themes,” including a cartoon depicting an Israeli soldier executing a Palestinian and a fake movie poster showing US President Donald Trump hugging North Korean leader Kim Jong Un.

Other posts praised US politicians and other Twitter users who criticised the Trump administration’s decision in May to abandon the 2015 Iranian nuclear deal, under which Tehran had traded nuclear curbs for sanctions relief.

However, a quick analysis of the Iranian news sites reveals that they were built on the cheap, are relatively unsophisticated and are poor imitations of the reputable news websites they seek to mimic.

The inauthentic sites, such as Liberty Front Press and Real Progressive Front, follow similar layouts to mainstream news portals, but are visibly less polished as household names, like BBC or the Huffington Post.

As readers dig into the content, they quickly find stories with clumsy and obvious political leanings that are often written in poor English and lack the clarity that is customary in edited news reports.  

For example, one story on Liberty Front Press excoriates Israeli Prime Minister Benjamin Netanyahu, a mouthy critic of Iran. While the article accords with Tehran’s narrative, readers may struggle to understand it.

Beneath images of Netanyahu, the story’s intro paragraph reads: “Netanyahu’s disinformation on Iran’s nuclear program not coincidentally was announced days ahead of Trump’s decision on whether to stick with or pull out of the JCPOA.”

MEE spoke with Lee Foster, the lead analyst at FireEye behind the Iran report, about his investigation and whether his tech firm was overstating the nature of the threat in order to drum up business.

Foster maintained that his study offered valuable and worrying insights, but acknowledged that the Iranian spin machine left a small footprint and could well have been managed with a limited staff and budget.

The barriers to entry are low. It’s relatively simple to get started. It doesn't necessarily require large, elaborate infrastructure

- Lee Foster, FireEye lead analyst

“The barriers to entry are low. It’s relatively simple to get started. It doesn't necessarily require large, elaborate infrastructure,” Foster told MEE.

Even cash-strapped governments could run Iran-scale propaganda drives, he added.

Also, Foster said the relative ease with which FireEye traced the websites and social media accounts back to Iran was down to “gaps in their ability to cover their tracks,” again suggesting an unsophisticated operation.  

MEE also spoke to Behnam Ben Taleblu, a fierce Iran critic at the Foundation for Defense of Democracies, a hawkish think tank. He was also alarmed by Tehran’s online message-spreading, but noted that it carried all “the hallmarks of Iranian sloppiness”.

“They are doing a quantity over quality campaign. They are simply trying to put the message out there and have it fall on any ear, no matter the quality,” Taleblu told MEE.

Overall impact could have been minimal

Little is more controversial in the US right now than Russian efforts to swing the 2016 election. While American lawmakers and intelligence chiefs broadly agree that Moscow was involved, it remains unclear whether it won Trump the White House.

The elections came down to some 80,000 votes in three states. Analysts disagree over whether voters were influenced most by Russian trolls, the manifestoes and characters of the candidates, or even a late-stage FBI probe into Trump’s Democratic rival, Hillary Clinton.

That row will not be settled any time soon. The same goes for Iran’s alleged efforts to influence the political conversation overseas. It may have shaped opinions, or it could just be one drop in a cacophonous ocean of online activity.

Whatever Iran is doing, it pales in comparison to the Saudi bots that have taken over Twitter the last few months

- Jamal Abdi, president of the National Iranian American Council

“It’s hard to measure popular sentiment based on a few Facebook posts,” Taleblu of the Foundation for Defense of Democracies told MEE, though he noted that Tehran evidently saw value in spending time, money and effort on shaping views overseas.

Foster agreed that impact is difficult to measure. Amid the bombardment of posts that every social media user experiences each time they log on, the Iran-spread messages likely left “some sort of impression” on browsers’ minds, he said.

Jamal Abdi, president of the National Iranian American Council, a lobby group for Iranian Americans, questioned this, noting that Tehran was outgunned by mightier governments who were not outed by FireEye.

“Whatever Iran is doing, it pales in comparison to the Saudi bots that have taken over Twitter the last few months,” Abdi told MEE.

FireEye has a dog in this fight

Finally, the Milpitas, California-based company benefited by releasing the Iran report: its share value rose by as much as 10 percent to $16.38 after Google identified it as a consultant this week.

The company provides software security to governments and private firms globally. Among its clients is Saudi Arabia’s Ministry of Petroleum and Mineral Resources. It oversees the kingdom’s oil giant Aramco, which was targeted by Iranian hackers in 2012.

As well as links to Riyadh, the company is staffed with a roster of former western military and law-enforcement cyber experts and trumpets itself as a “private-sector intelligence operation,” akin to the governments it supports.

FireEye’s CEO and board director, Kevin Mandia, once worked on computer security at the Pentagon and for the US Air Force. Travis Reese, the company’s president, was previously with the US Air Force Office of Special Investigations.

Responding to a question from MEE, Foster, who was himself previously a government consultant in his native Britain, said the Iran report was not part of a push to win new contracts in the Middle East or elsewhere.

“I don’t see direct commercial relationships stemming from putting this work out here,” Foster said.