Facebook information warfare: Inside Iran's shadowy operations to target you on social media

Jessica Guynn | USA TODAY

Show Caption Hide Caption Are we really ready for a World War III? Fears are mounting around the world following the assassination of Iranian General Qasem Soleimani - but is World War 3 about to happen?

As a barrage of missiles rained down on two Iraqi bases housing thousands of U.S. troops, a stealthier form of warfare was striking on another front: Online information operations linked to the Iranian regime were blasting out messages to sway public opinion in Tehran and abroad.

Campaigns on Instagram, Twitter and elsewhere tapped into an outpouring of grief and rage at the killing of Iranian commander Qasem Soleimani. A violent image of President Trump’s head being ripped from his body. A photo of a child running among flag-draped caskets with the words: “Prepare the coffins.” Social media posts urging retaliation bore hashtags like #HardRevenge and #DeathToAmerica.

These shadowy operations which escalated with the hostilities between Iran and the United States have not yet been turned on full blast, security experts say.

Iran disinformation: These are the liberal memes Iran used to target Americans on Facebook

Influence operations uncovered: Facebook foils political influence campaigns originating in Iran, Russia ahead of U.S. midterms

“We are seeing some aspects of Iran’s information operations apparatus being used, but there’s so much more capacity it has,” says Lee Foster, senior manager of information operations analysis at security firm FireEye. “It’s important to remember that it’s early days. Both sides here are trying to feel out what the next steps are. So it’s entirely plausible that we could see more activity of this nature going forward."

Online information warfare has been part of Tehran’s arsenal for about a decade as a covert alternative to military confrontation. State-sponsored campaigns use social media to spread pro-Iranian talking points in the Middle East and in the west.

“Where it would be extremely difficult or escalatory for Iran to continue to carry out missile strikes at various U.S. assets, it is a lot easier and it flies way more under the radar to carry out influence operations,” says Graham Brookie, director of the Atlantic Council’s Digital Forensic Research Lab. “We should have our guard up even if the situation deescalates.”

Iran has engaged in influence operations since the Islamic Revolution. These operations gravitated online as Tehran looked to harness the growing power of social media. It shut off Twitter during anti-government protests in 2009, and in recent years amplified pro-Iranian propaganda critical of the U.S., Israel and Saudi Arabia through a shadowy network of phony online personas and a flurry of fake articles on websites designed to look like real news outlets.

“Iran is a persistent, sophisticated and well-resourced actor which has been active in the online disinformation space for years,” says Ben Nimmo, director of investigations for social media monitoring company Graphika.

In 2018, Iran was caught for the first time running a stealthy online disinformation campaign targeting the U.S. Facebook, Google and Twitter shuttered hundreds of accounts and channels set up by people with ties to Iranian state media.

Social media accounts with fake names tried to infiltrate liberal groups, such as supporters of Sen. Bernie Sanders, I-Vt., in the U.S. and Scottish separatists in the U.K., a USA TODAY review of the social media posts showed.

They then tapped into resentment on such heated topics as the conflict between Israel and the Palestinians, immigration and Britain's vote to leave the European Union, pushing pro-Iranian messages alongside anti-Trump messages or posts backing Jeremy Corbyn, leader of Britain’s opposition Labour Party.

Iran busted: Google, YouTube targeted by Iran influence operation, shut down dozens of accounts

Russian election manipulation: We read every one of the 3,517 Facebook ads bought by Russians. Here's what we found

The objective was different from Russia’s campaign to sow discord and chaos during and after the 2016 presidential election. Iran was attempting to hijack the political conversation to promote pro-Iranian talking points on Israel, Saudi Arabia and other interests around the globe, appealing to people “who are more inclined to consider America to be a bad actor on the world stage,” Brookie says. At the time Iran denied any involvement.

The revelation underscored the growing scale and frequency of disinformation operations by nation states threatening the United States.

With intensifying U.S. pressure and international sanctions, Iran has shown a growing willingness to carry out these online influence campaigns. More campaigns originating from Iran were discovered last year, security experts say.

Iran has also targeted American officials. In February, Iranian accounts carried out a spam attack on Secretary of State Mike Pompeo’s Instagram page to protest his post on the unrest in Venezuela at the time and urge support for the Nicolás Maduro regime, the Atlantic Council’s Digital Forensic Research Lab says.

Beware disinformation: False images and facts are being shared on the internet following Iran attacks

Social media is full of lies: The Iran attacks show how easily they spread

Still, genuine grassroots fervor can be confused with coordinated inauthentic state-sponsored propaganda on social media, Nimmo says.

Following the Jan. 2 American strike that killed Soleimani, social media saw a flood of reaction, much of it coming from real people. But some accounts on Instagram and Twitter targeting the U.S. government showed signs of coordinated and inauthentic behavior intended to propel the online conversation.

“Whenever there's a security escalation, you tend to see an escalation in rhetoric," Nimmo says. "We've already seen this from both sides, for example with both national leaders issuing threats, and we've seen apparent supporters of both sides joining in with what looks like organic engagement."

The conflict in the real world plays out online, too.

“It's important to remember that security escalations can drive genuine traffic too," Nimmo said. "Real people get angry about them and start posting in a way they might not have done before."