(U//FOUO) We assess that Iran likely will continue to rely primarily on proxy news websites and affiliated social media accounts to attempt sustained influence against US audiences, while we expect intermittent, issue-specific influence attempts via other means (e.g., e-mails). We base this assessment on Iran’s actions since at least 2008 to build and maintain vast malign influence networks anchored by proxy websites, as well as Iran’s attempts to find new avenues to re-launch established malign influence networks after suspension. Tehran employs a network of proxy social media accounts and news websites that typically launder Iranian state media stories (stripped of attribution), plagiarize articles from Western wire services, and occasionally pay US persons to write articles to appear more legitimate to US audiences.
• (U) The American Herald Tribune (AHT)—an Iranian Government proxy website established in 2015 that purported to be a genuine media outlet—was seized by the US Government on 4 November 2020 for attempting to covertly influence United States policy and public opinion, according to a DOJ press release. However, AHT by at least 16 November 2020 resurfaced on a Canada-based domain, according to AHT’s website. AHT is also known to pay unwitting US persons to contribute to its disinformation campaigns, according to the same website.
• (U) The International Union of Virtual Media (IUVM) since at least August 2018 has maintained a network of proxy accounts and websites posing as news sources that attempted to insert Iranian Government narratives into Western target audiences and to denigrate the United States, Western governments, and other regional adversaries, according to reports from a research institute and a social media analysis firm. Since IUVM started, US social media outlets have repeatedly removed its accounts from their platforms for being engaged in pro-Iran information operations and deceiving users; most recently, the FBI in October 2020 seized IUVM’s domains, according to the same reports and a DOJ press release. Despite these setbacks, however, IUVM created new accounts and returned to operations, according to these same reports.
• (U) Iranian state media-linked Liberty Front Press, created in 2013, claimed to be an independent media organization that published US political news, including content from other proxies such as IUVM and US-based media sites, according to reports from a media outlet, a cybersecurity firm, and a research institute. Liberty Front Press and its network of affiliated proxy news websites published content directly from other sources, and any original content contained poorly written English, according to the same cybersecurity firm report. In August 2018, US social media platforms deactivated accounts associated with Liberty Front Press because of its connection to Iranian state media, according to media reporting. The Liberty Front Press website was officially seized by the FBI in October 2020, according to a DOJ affidavit. The FBI identified over 1,000 domains, e-mail accounts, and social media accounts associated with Liberty Front Press as part of its investigation, according to the same affidavit.
(U//FOUO) For at least the next year, we assess that these Iranian-run news websites and affiliated social media accounts targeting US audiences likely will remain easily detectable by the US Government and US social media companies due to Iran’s use of thinly masked and often unsubtle promotion of pro-Iranian content. We base this assessment on Iran’s promotion of pro-Iranian messaging behind a veneer of supposedly otherwise focused pages and the ease at which these pages have previously been identified and removed from US social media platforms and registered domains. While Iranian websites have remained easily detectable to date, if these deceptive outlets improved their obfuscation techniques and replaced obvious pro-Iranian content with divisive anti-US content, these outlets could blend into the information environment and be more difficult to attribute. Thus, it is important for the US Government and social media companies to maintain a close working relationship to continue to detect and uncover Iranian covert influence efforts as they develop and grow in complexity.
• (U) In August 2018, a cybersecurity firm made the first major attribution of Iranian proxy accounts attempting to promote political narratives in line with Iranian interests, which directly led to the suspension and removal of over 900 accounts, pages, and groups from US social media platforms, some accounts dating back as early as 2015, according to reports from a cybersecurity firm and social media companies.
• (U) In October 2019, a social media company removed several Iran-based pages attempting to hide behind a façade of otherwise focused pages, while pushing pro-Iranian messaging, including a page supposedly supporting Black Lives MatterUSPER, according to a research institute.
• (U) In October 2020, a US social media company removed an Iran-based page attempting to conceal its identity and activity, while pushing false claims and unsubstantiated US election-related threats as part of an influence operation, according to a report from the same social media company.
• (U) In October 2020, a social media company acted on information provided by the FBI to take down over a hundred accounts appearing to originate from Iran and attempting unsuccessfully to disrupt the public conversation of the first 2020 US presidential debate, according to a report from the same social media company.
Share this:
