The Suspicious Twitter Network Trolling for Regime Change in Iran

An American non-profit says it’s been the victim of a harassment campaign.

National Security Advisor John Bolton and a little-understood Twitter network have both boosted MEK, an armed Iranian opposition group.Douglas Christian/ZUMA

Fight disinformation: Sign up for the free Mother Jones Daily newsletter and follow the news that matters.

As the Trump administration has ramped up economic sanctions against Iran and aimed increasingly threatening rhetoric at the country, an influence network has popped up on Twitter pushing similar messages.

Networks comprising over four hundred Twitter accounts composed of likely bots along with real accounts and “cyborg” accounts—accounts run by real people, but augmented with software to push posts faster and more frequently—have consistently released messaging opposing the Iranian government.

The accounts often tweet messages backing regime change in Iran and calling for an end to the rule of Ayatollah Ali Khamenei. Many of the accounts also frequently voice their support for the People’s Mujahedin of Iran (MEK), a militant opposition group that some have called a terrorist organization, and its leader Maryam Rajavi. The accounts also frequently criticize the National Iranian American Council (NIAC)—a non-profit representing Iranians in the U.S.—claiming it advocates in support of Iran’s current religious authorities. There is no evidence to suggest this is true, and NIAC firmly denies the assertion. In 2008 the group filed a defamation suit against a writer who alleged they had lobbied on behalf of the Islamic Republic of Iran; a federal judge found that the defendant’s actions didn’t amount to defamation, but made no ruling on the truth of his allegations.*

The full impact of the networks is hard to gauge, but one set of over 350 accounts has collectively tweeted over 5 million times to nearly 500,000 followers, according to numbers collected by independent researcher Geoff Golberg, who first flagged the accounts to Mother Jones. Golberg, who founded the social media manipulation research project SocialCartograph, says that he has no specific interest in Iranian geopolitics and stumbled onto the accounts amid broader research into social media influence campaigns.

Another set of 75 accounts found by researcher Ben Decker, who runs the media and tech investigations consultancy Memetica, also post pro-regime change and anti-NIAC content. Decker, who is a former researcher at Harvard’s Shorenstein Center, says the accounts exhibit signs that suggest they are possibly either not real or are being augmented. Beyond accounts posting at a superhuman pace on a 24 hour a day, seven day a week schedule, Decker noted that “the network of accounts had a massive spike in followers, totaling around 125.2k users, during the last week of February”—a “red flag as far as inorganic network activity is concerned.”

While coordinated attempts to manipulate discourse on Twitter are explicitly against the platform’s rules, NIAC says it has been a victim of such attacks and complains the company hasn’t taken enough action to protect them. The organization claims that it was targeted by a coordinated social media attack over Memorial Day weekend, when accounts critical of NIAC tweeted out the hashtag #NIACLobbies4Mullahs in droves, to push the notion of NIAC’s supposed ties to Iran’s religious authorities. Jamal Abdi, the NIAC’s president, believes the efforts are an attempt to undermine his organization’s credibility and effectiveness.

“The goal of these attacks is simple: to divide and weaken our community. To ensure that Iranian Americans do not have a voice, do not hold influential positions in Washington D.C., do not run for office and build political power, and shy away from civic engagement,” he wrote in a piece for The Iranian. Golberg’s work has caught the attention of NIAC and he has publicly communicated with it his findings, but he says he is not being paid by the organization.

The networks are made up of a mix of legitimate and false accounts, and it can be difficult to definitively say which are bots, cyborgs, or normal posters augmented via other means. But some of the profiles’ behavior echoes patterns that experts use to judge if accounts are not being run organically. The five most prominent accounts in the network have tweeted hundreds of thousands of times in the several years since they were created, averaging over 100 tweets a day. That speed alone doesn’t confirm that the accounts are inauthentic or engaging in artificial coordination, but to Golberg it’s a clue, along with the interconnectedness of the network’s accounts and their similarities in the users they retweet, follow and interact with, as well as the sometimes nearly identical content of their tweets.

Twitter has deleted thousands of Iranian accounts in the past several months, including some of the over 350 accounts that appear to be a part of the influence campaign identified by Golberg. Over 200 of the accounts he flagged remain, pumping out content in support of regime change in Iran.

It’s unclear who is behind the accounts, but their positions mirror the positions of the MEK and what is seen as its international political arm, the National Council of Resistance of Iran (NCRI). Both have consistently pushed for regime change in Iran, earning allies in and close to the Trump administration, despite the organization formerly being labeled by the State Department as a terrorist group, a designation some experts believe it should still have.

Trump’s National Security Advisor, John Bolton, called the MEK “a viable opposition to the rule of the ayatollahs” at an MEK event in 2017. Trump’s lawyer, Rudy Giuliani, who has taken payments from the group, called for Iran’s current ruling regime to be replaced by the armed group at a 2018 rally hosted by the organization in Paris.

The MEK has a history of running online disinformation campaigns. Al-Jazeera has documented a Russian Internet Research Agency-style troll operation run out of Albania, interviewing former MEK members who detailed how the organization controlled thousands of accounts to spread propaganda about regime change and other political aims. And according to the Daily Beast, a former lobbyist for the NCRI, Soheila Aligholi Mayelzadeh, ran an influence campaign on Facebook in support of more aggressive confrontation with Iran.

It’s unclear what action Twitter is taking on the accounts. Golberg has for many months repeatedly flagged the network to Twitter employees, and had direct message conversations with the company about his disinformation research more broadly. 

“Platform manipulation is a violation of the Twitter Rules,” a company spokesperson wrote after being asked about the accounts. “For accounts that we can reliably link to a nation state, we disclose every information operation down to the Tweet to a dedicated public archive—the largest of its kind in the industry. We have disclosed activities linked to Iran in the past and will remain vigilant.”

While news of Russian attempts to use social media platforms to influence politics both in the U.S. and elsewhere have dominated headlines, more and more examples of influence efforts related to Iran have surfaced. In addition to the online campaigns being carried out by people sympathetic to the MEK’s perspective, Iran’s ruling regime also appears to have engaged in its own political manipulation attempts.

Late last month, both Facebook and Twitter announced that they had deleted thousands of Iranian accounts that were engaged in what Facebook’s chief of security Nathaniel Gleicher called “coordinated inauthentic behavior.” The accounts appeared to have been created to mislead by posing as news organizations, journalists, and under other false identities, and to spread information about “political and social issues in Iran and globally,” according to Yoel Roth, Twitter’s head of site integrity. Both companies had previously deleted batches of accounts originating in Iran that they identified as being a part of a network trying to influence political discourse.

While the Trump administration has been wary of potential Iranian social media manipulation efforts, it seems their focus has been on content pushed by the current regime—and not by allies of a political group that, like the United States, is working against it.

“I can say definitively that it’s a sufficient national security concern about Chinese meddling, Iranian meddling, and North Korean meddling that we’re taking steps to try and prevent it,” Bolton told ABC News in August.

This article has been revised with additional information about the 2008 case.

WE'LL BE BLUNT

It is astonishingly hard keeping a newsroom afloat these days, and we need to raise $253,000 in online donations quickly, by October 7.

The short of it: Last year, we had to cut $1 million from our budget so we could have any chance of breaking even by the time our fiscal year ended in June. And despite a huge rally from so many of you leading up to the deadline, we still came up a bit short on the whole. We can’t let that happen again. We have no wiggle room to begin with, and now we have a hole to dig out of.

Readers also told us to just give it to you straight when we need to ask for your support, and seeing how matter-of-factly explaining our inner workings, our challenges and finances, can bring more of you in has been a real silver lining. So our online membership lead, Brian, lays it all out for you in his personal, insider account (that literally puts his skin in the game!) of how urgent things are right now.

The upshot: Being able to rally $253,000 in donations over these next few weeks is vitally important simply because it is the number that keeps us right on track, helping make sure we don't end up with a bigger gap than can be filled again, helping us avoid any significant (and knowable) cash-flow crunches for now. We used to be more nonchalant about coming up short this time of year, thinking we can make it by the time June rolls around. Not anymore.

Because the in-depth journalism on underreported beats and unique perspectives on the daily news you turn to Mother Jones for is only possible because readers fund us. Corporations and powerful people with deep pockets will never sustain the type of journalism we exist to do. The only investors who won’t let independent, investigative journalism down are the people who actually care about its future—you.

And we need readers to show up for us big time—again.

Getting just 10 percent of the people who care enough about our work to be reading this blurb to part with a few bucks would be utterly transformative for us, and that's very much what we need to keep charging hard in this financially uncertain, high-stakes year.

If you can right now, please support the journalism you get from Mother Jones with a donation at whatever amount works for you. And please do it now, before you move on to whatever you're about to do next and think maybe you'll get to it later, because every gift matters and we really need to see a strong response if we're going to raise the $253,000 we need in less than three weeks.

payment methods

WE'LL BE BLUNT

It is astonishingly hard keeping a newsroom afloat these days, and we need to raise $253,000 in online donations quickly, by October 7.

The short of it: Last year, we had to cut $1 million from our budget so we could have any chance of breaking even by the time our fiscal year ended in June. And despite a huge rally from so many of you leading up to the deadline, we still came up a bit short on the whole. We can’t let that happen again. We have no wiggle room to begin with, and now we have a hole to dig out of.

Readers also told us to just give it to you straight when we need to ask for your support, and seeing how matter-of-factly explaining our inner workings, our challenges and finances, can bring more of you in has been a real silver lining. So our online membership lead, Brian, lays it all out for you in his personal, insider account (that literally puts his skin in the game!) of how urgent things are right now.

The upshot: Being able to rally $253,000 in donations over these next few weeks is vitally important simply because it is the number that keeps us right on track, helping make sure we don't end up with a bigger gap than can be filled again, helping us avoid any significant (and knowable) cash-flow crunches for now. We used to be more nonchalant about coming up short this time of year, thinking we can make it by the time June rolls around. Not anymore.

Because the in-depth journalism on underreported beats and unique perspectives on the daily news you turn to Mother Jones for is only possible because readers fund us. Corporations and powerful people with deep pockets will never sustain the type of journalism we exist to do. The only investors who won’t let independent, investigative journalism down are the people who actually care about its future—you.

And we need readers to show up for us big time—again.

Getting just 10 percent of the people who care enough about our work to be reading this blurb to part with a few bucks would be utterly transformative for us, and that's very much what we need to keep charging hard in this financially uncertain, high-stakes year.

If you can right now, please support the journalism you get from Mother Jones with a donation at whatever amount works for you. And please do it now, before you move on to whatever you're about to do next and think maybe you'll get to it later, because every gift matters and we really need to see a strong response if we're going to raise the $253,000 we need in less than three weeks.

payment methods

We Recommend

Latest

Sign up for our free newsletter

Subscribe to the Mother Jones Daily to have our top stories delivered directly to your inbox.

Get our award-winning magazine

Save big on a full year of investigations, ideas, and insights.

Subscribe

Support our journalism

Help Mother Jones' reporters dig deep with a tax-deductible donation.

Donate