Download Muslim-brotherhood report DOWNLOAD IRAN / AFGHANISTAN REPORT

On November 5, 2020 Facebook announced the takedown of two networks: 

• 25 Pages, 31 profiles, and 2 Instagram accounts affiliated with the Muslim Brotherhood. According to Facebook, the operation originated in Egypt, Turkey, and Morocco. The network targeted audiences both in Egypt directly and across the Middle East and North Africa.

• 11 Pages, 6 Groups, 33 profiles, and 47 Instagram accounts that originated in Afghanistan and Iran and targeted Farsi/Dari speakers in Afghanistan.

Facebook suspended these networks not due to the content of their posts, but for coordinated inauthentic behavior: the Facebook Pages and Groups were managed by fake accounts. A summary of the two networks is below, and full reports are linked at the top of this post. Facebook's announcement is here.

Muslim Brotherhood-Linked Takedown

Many social media disinformation campaigns—and associated takedowns—have been linked to Saudi Arabia, the UAE, and Egypt. But we believe this is the first takedown linked to opposing pro-Muslim Brotherhood actors. Interestingly, this network appears markedly similar to networks from anti-Muslim Brotherhood disinformation campaigns on Facebook. Both sides create professional branding for Pages and share polished, original videos. We conjecture that like anti-Muslim Brotherhood operations, this network may be linked to a digital marketing firm in Egypt. These firms have a particular signature.   

Key takeaways:

• This was a complex cross-platform operation with a substantial audience. The Facebook Pages the Stanford Internet Observatory analyzed had nearly 1.5 million followers. The operation was also linked to many Twitter accounts, YouTube channels, and Telegram channels, many of which had large followings. 
• The network created and shared hundreds of original videos and dozens of original songs. 
• While most of the profiles linked to this operation were stub accounts, one of the profiles ran a social media advertising agency in Egypt.
• Central messages included:
  • Praise for the Muslim Brotherhood-supporting governments of Turkey and Qatar.
  • Criticism of Saudia Arabian, Egyptian, and UAE governments. 
  • Accusations that the Egyptian government had imprisoned and killed Muslim Brotherhood supporters, and that Muslim Brotherhood supporters were being detained across countries
  • The Facebook Page names were direct and unsubtle. Examples include Tunisia Against the UAE, Hearts with Qatar, and YemenAgainstKSAUEA [sic].

The People and Hearts with Qatar Facebook Page

Takedown of Accounts Originating in Afghanistan and Iran

This operation produced content oriented towards women, including promoting women's rights. It also promoted the narrative that Iran is a good ally for Afghanistan, highlighted the brutality of the Taliban, and criticized Pakistani and American intervention in Afghanistan. 

Key takeaways:

• The network aimed to appeal to women. Fifty-three percent of the Instagram accounts had profile photos of women (compared to 11% with photos of men), and the network shared stories about the educational success of women. It is possible the intent was to undermine the peace negotiations between the Afghan government and the Taliban; the Taliban is known for restricting women’s rights.  

• The network shared messaging that criticized Pakistan, the Taliban, and the U.S. Content about the U.S. criticized U.S. President Donald Trump in general, and specifically claimed that Trump was colluding with the Taliban. The network praised the role Iran could play in Afghan peace negotiations.

• Posts from accounts purporting to be in Afghanistan used the term Farsi to describe its language, instead of Dari, often explicitly saying they were proud to use the term Farsi. The two languages are very similar; Iran uses the term Farsi and Afghanistan uses the term Dari. 

• The Facebook profiles and Instagram accounts were as actively involved in pushing particular narratives as the Pages and Groups, and in many cases had larger followers. 

• We identified five Telegram channels linked to this Facebook/Instagram operation. 

A post from the Afghanistan My Passion Instagram account using a fabricated photo. The Taliban are shown praying for their “partner” Trump.

Q. Why is this work important?

A lot of tech is produced in China so it’s important to understand their policies. And in Washington, D.C., you hear a lot of people say, “Well, you can’t know what China’s doing on tech policy. It’s all a secret.” But while China’s political system is often opaque, if you happen to read Chinese, there’s a lot that’s publicly available and can explain what the Chinese government is thinking and planning.

With our network of experts, DigiChina works at the intersection of two policy challenges. One is how do we deal with high technology, and the questions around economic competitiveness, personal autonomy and the security risks that our dependence on tech creates.

The other challenge is, from a US government, business or values perspective, what needs to be done about the increased prominence and power of the Chinese government and its economic, technological and military capabilities.

These questions cut across tech sectors from IT infrastructure to data-driven automation, and cutting-edge developments in quantum technology, biotech, and other fields of research.

Q: How was DigiChina started?

A number of us were working at different organizations, think tanks, consultancies and universities and we all had an interest in explaining the laws and the bureaucratic language to others who aren’t Chinese policy specialists or don’t have the language skills.  

We started working informally at first and then reached out to New America, which is an innovative type of think tank combining research, innovation, and policy thinking on challenges arising during this time of rapid technological and social change. Under the New America umbrella, and through partnerships with the Leiden Asia Centre, a leading European research center based at the University of Leiden, and the Ethics and Governance of Artificial Intelligence Initiative at Harvard and MIT, we were able to build out the program and increase the number of experts in our network.

Q: Who is involved in DigiChina and what types of expertise do you and others bring to the project?

More than 40 people have contributed to DigiChina publications so far, and it’s a pretty diverse group. There are professors and think tank scholars, students and early-career professionals, and experienced government and industry analysts. Everyone has a different part of the picture they can contribute, and we reach out to other experts both in China and around the world when we need more context.

As for me, I was working at Yale Law School’s China Center when I was roped into what would become DigiChina and had spent several years in Beijing and New Haven working more generally on US-China relations and Track 2 dialogues, where experts and former officials from the two countries meet to take on tough problems. As a journalist and graduate student, I had long studied technology and politics in China, and I took on a coordinating role with DigiChina as I turned back to that pursuit full time.

Q. Are there other organizations involved as well?

We have a strong tie to the Leiden Asia Centre at the University of Leiden in the Netherlands, where one of DigiChina’s cofounders, Rogier Creemers, is a professor, and where staff and student researchers have contributed to existing and forthcoming work. We coordinate with a number of other groups on translations, and the project benefits greatly from the time and knowledge contributed by employees of various institutions. I hope that network will increasingly be a resource for contributors and their colleagues.

The project is currently supported by the Ford Foundation, which works to strengthen democratic values, promote international cooperation and advance human achievement around the world. A generous grant from Ford will keep the lights on for two years, giving us the ability to build our open-access resource and, with further fundraising, the potential to bring on more in-house editorial and research staff.

On September 29, the APARC China Program hosted Thomas Fingar and Stephen Stedman for the program “Rebuilding International Institutions.” The program, which was moderated by China Program Director Jean Oi, examined the future of international institutions such as the United Nations (UN), World Trade Organization (WTO), and World Health Organization (WHO) in our evolving global political landscape. While Fingar and Stedman acknowledged that such institutions facilitated attainment of unprecedented peace and prosperity after WWII, they also asked difficult questions: Are these institutions still adequate? And if not, how will we change them?

Shorenstein APARC Fellow Thomas Fingar kicked off the session by asking whether or not US-China tensions would impede cooperation on major global challenges, or if those challenges were so serious as to render such rivalries immaterial. Perhaps the most obvious example of such a crisis is the current COVID-19 pandemic. The efforts to curb the virus’ spread not only by individual countries, but also by international organizations like the WHO, have proven largely inadequate. According to Fingar, our existing institutions need to be reformed or supplemented to deal with these types of threats. However, such an overhaul of our international systems will be difficult, he says.

How, then, will we go about such a massive project? Stephen Stedman, Deputy Director at Stanford’s Center on Democracy, Development, and the Rule of Law (CDDRL), responded by explaining that the current failure of international cooperation makes such undertakings tough. Globalization has been a double-edged sword: On one hand, more contact, perhaps inherently, leads to increased tension. The resurgence of traditional notions of sovereignty in 2010, kickstarted by the opposition of countries like Russia and China to what was seen as UN overreaching, has led to a reduction of international cooperation overall. On the other hand, Fingar posits that our interconnectedness may force us toward cooperation despite rivalries as we face more and more transnational threats. International institutions create rules to organize and manage our many interconnected relationships so that we can deal with our problems effectively and reduce friction.

Stedman also pointed to the upcoming US elections and the major impact their outcome will have on how these problems are addressed—or not. In the last four year, the United States has pulled back significantly from international institutions and agreements, leaving a gap that China has started to fill. Furthermore, despite the US’s retreat from international responsibility, the country still remains a critical actor in global initiatives. China’s embrace of a global leadership role is not inherently negative, but its future relationship with the US will need to be “managed in a way that you get greater cooperation and not just paralysis.” Stedman says that it is likely that progress will need to be made on a bilateral front in order to have productive conversations about international issues with China.

Concluding on an optimistic note, Fingar voiced his hope that the current tensions and negative perceptions between rivals might ultimately “be mitigated by success in dealing with a common problem,” because “experience does shape perceptions.”

A video recording of this program is available upon request. Please contact Callista Wells, China Program Coordinator at cvwells@stanford.edu with any inquiries.

Summary

On October 8, 2020, Twitter announced the takedown of an operation it attributed to Iran. The actors compromised real accounts to tweet Black Lives Matter content, and additionally created fake accounts with bios stolen from other real accounts on Twitter. The Stanford Internet Observatory analyzed the accounts’ behaviors, tweets and images related to this relatively small operation. The activity observed in this dataset —  compromising Twitter accounts, then leveraging them to disseminate messaging — appears to be a bit of a departure from prior Iran-linked activity. As we will discuss, the effort encompassed in this set contained unrefined messaging and ineffective dissemination. Other Iran-linked malign actors involved in prior influence operations appear to have been far more adept at creating fake social media personas for the purpose of disseminating propaganda. Topically, as SIO has previously noted, verified accounts run by Iranian regime leaders and its state media have previously waded into the Black Lives Matter conversation, posting support for protestors, portraying American police as fascists, and declaring that the US government is guilty of human rights violations and racism.

Key Takeaways

• In total, 104 accounts were utilized in the Iran-linked operation. Of this dataset, 81 accounts were real accounts that had been hacked for the purposes of the operation. The remaining 23 accounts were fake accounts that Twitter assessed were created by the malign actor, and incorporated elements of theft such as bios stolen from real accounts. 

• The compromised accounts were hacked to tweet content about Black Lives Matter, using the hashtag #black_lives_matter. These tweets contained images or memes to advance a pro-BLM narrative. 

• Tweets from the fake accounts were broader in focus, and covered multiple topics. These accounts tweeted in English and Arabic. A subset of English tweets by accounts claiming to be journalists shared news articles that were more critical of Donald Trump but also retweeted the US President’s account. Tweets in Arabic focused on two individuals critical of the Kuwaiti government, alleging they abused or trafficked drugs. 

Tactics, Techniques, and Procedures

There were two distinct tactics observed in the dataset: hacking real accounts, and creating fake personas with stolen biographies. 

The majority of accounts, 81, fell into the first category: account theft. The compromised accounts sent all but two of their tweets on June 3, 2020, that consisted of the hashtag #black_lives_matter and an image, such as an alleged Black Lives Matter protest. The hacked accounts were primarily located in the United States and came from a variety of communities: there were DJs, gamers, and accounts that role-played as vampires and werewolves. We observed tweets, Facebook posts and website updates from accounts that were compromised, some of which noted that they had been hacked, and others stating that they had regained control of their accounts. We do not name these accounts for privacy reasons. 

The second category centered around 23 fake personas created by the malign actor. This subset of accounts followed similar naming conventions: a first name followed by a last name or last initial and a series of numbers. Of the accounts, 22 of 23 were created on one of three dates in January 2020 — January 8, January 11, and January 25 — and each batch had similarities in its location and bio profession. For example, eight accounts created on Jan 25, 2020, had bios claiming to be journalists. The final account, which shared the same naming convention, was created on January 22. Unlike the other accounts, this account’s bio was in Arabic and it tweeted mostly in Arabic. 

Figure 1: Account creation dates (aggregated by month) for all users in the dataset, both hacked and fake. The graph shows a spike in user creations in January 2020, when the adversary created its fake persona accounts. 

The majority of the fake accounts stole their bios from real accounts on Twitter, most of which were from users located in the United Kingdom. The bios from real accounts ranged from those of government officials, to a primary school teacher, to TV presenters and journalists. A majority of the real accounts that bios were stolen from had large followings (the largest had 508,800 followers), though some were relatively small (101 followers). It is unclear why these individuals were selected. 

The most active fake persona, Jennife55580973, and other accounts to a lesser extent, tweeted extensively for accounts to “please follow me back.” This behavior suggests this cluster was in the early phase of network building. The accounts mentioned each other in their tweets, creating a retweet ring of fake journalist personas that we discuss in more detail below.  

Figure 2: The network of interactions (retweets, replies and mentions) initiated by the fake persona accounts (filtered to remove single-instance activity). This graph demonstrates the interconnectedness of the fake account network, while also showing that the accounts branched out to prominent figures such as @realdonaldtrump. 

Themes

#black_lives_matter

The 81 hacked accounts in the dataset were very minimally utilized: they tweeted the hashtag “#black_lives_matter,” along with an image. There were several variants of George Floyd's face edited to include an overlay of Joaquin Phoenix-style Joker makeup, which we have elected not to include. This analogy may have been meant to show support for protesters, or to encourage a more violent revolution as was depicted in the 2019 movie Joker; the purpose was somewhat unclear given the limited text. Other images shared in the tweets suggested a pro-BLM narrative, such as an image of Martin Luther King Jr. with the text, “even viruses know we are all made the same: STOP RACISM”. 

Figure 3: Examples of additional content sent through the compromised accounts. Left: An image of what seems to be a Black Lives Matter protest, with the phrase “I can not breathe,” a slight variant from the more commonly used phrase “I can’t breathe.” Right: An image of Martin Luther King Jr. and “even viruses know we are all made the same,” an anti-racism and pro-Black Lives Matter message. 

A Ring of Fake Journalists

Among the fake accounts created by the Iran-affiliated entity, eight personas claimed to be journalists. The narrative focus of the journalist ring differed based on the language of the tweets. The majority of tweets from this network were in English; a small amount were in Arabic and Urdu. 

English tweets

The tweets in English shared links to articles from CNN, the New York Times and the Wall Street Journal; the text of the tweets was the opening of the article (or copied from the news outlet’s own tweet about the article). The English tweets from this journalist ring were substantively different from the tweets from the “non-journalist” fake accounts, which didn’t share article links or focus primarily on events in the news. 

English tweets from the fake journalist accounts did not seem to center around a single dominant narrative; the accounts tweeted about global political events, COVID-19, President Donald Trump and George Floyd. The articles shared by the fake accounts were usually critical of Trump. For example, one account shared an article from CNN about how the governor of Illinois had labeled President Trump “a miserable failure.” At the same time, the accounts also retweeted a small but notable amount of tweets from sources that tend to be more favorable to Donald Trump, such as Candace Owens, Charlie Kirk and Donald Trump himself. 

The narratives incorporating Black Lives Matter and George Floyd were pro-BLM. For example, one account shared a CNN article and quote from Michelle Obama about the George Floyd protests: 

“Race and racism is a reality that so many of us grow up learning to just deal with. But if we ever hope to move past it, it can’t just be on people of color to deal with it,” former first lady Michelle Obama said while speaking out on George Floyd’s deathhttps://t.co/B3ZVUa0fL3

Another account copied CNN’s tweet that claimed GOP senators had asked the President to take a “far more compassionate approach amid the deep unrest” after George Floyd’s death. 

Arabic tweets

The content in Arabic from the fake journalists were mostly retweets of tweets critical of two individuals: Hani Hussein (هاني حسين), a former Kuwaiti oil minister who resigned in 2013 due to tensions with Parliament, and Abdul Hamid Dashti (عبدالحميد دشتي), a Shiite former Kuwaiti MP who was sentenced in absentia in 2016 and 2017 for remarks and tweets insulting Saudi Arabia and Bahrain. The targeting of these two individuals was not exclusive to the fake journalist accounts — all 23 fake accounts posted tweets in Arabic about the two individuals. The tweets aimed to paint Hussein and Dashti in a negative light. For example, the tweets spread rumors that Hani Hussein was abusing drugs, and referred to Abdul Hamid Dashti as a mercenary and a degenerate thief. Similarly, there was a subset of copypasta tweets — tweets that shared verbatim text — from the fake accounts in this dataset responding to real accounts on Twitter with tweets critical of Dashti, as seen in the tweet below. 

Image

Tweet Reply Translation: “The first residency dealer in Kuwait is the mercenary Abdul Hamid Dashti and his son Talal ‘Al-Nibras.’ This is a letter from the Iranian embassy to the Kuwaiti Ministry of Interior complaining about his trafficking in residences. The funny thing is that this degenerate thief, at the behest of the son of the tanker thief Khalifa, who stole Kuwait during the invasion, looks up to us! https://t.co/wyACCtdkUo”

The image in the tweet is allegedly a letter sent from the Iranian Embassy to the Kuwaiti Ministry of the Interior complaining that Dashti was ‘trafficking’ in government-funded residences, though the tweet did not specify what specifically he was trafficking. Some of these tweets were retweets of politicians in Pakistan and Kuwait, such as Dr. Basel Al-Sabah, Kuwait’s Minister of Health, which tweeted comments such as defending the state’s response to the pandemic in the face of “malicious rumors and propaganda.”  

Given their scattered focus, it is unclear from the content what the adversary’s intended purpose was for the fake accounts. 

Conclusion

Overall, this was a relatively small network in the early stages of its activity that was detected and removed before it had a chance to have a significant impact. Given Iranian-affiliated actors’ prior willingness to overtly leverage #BLM hashtags to denigrate American society and political leaders, it is somewhat surprising to see an Iran-linked adversary doing the work to compromise accounts to simply use them to send out a handful of #black_lives_matter tweets. While the narratives may not have been singularly focused across both the hacked and fake accounts, this operation provides researchers more insight into the different tactics and strategies leveraged to weigh in on political conversations and narratives on Twitter.   

In this post and in the attached report we investigate a U.S. domestic astroturfing operation that Facebook attributed to social media consultancy Rally Forge. The use of marketing agencies and social consultancies to carry out influence operations has become quite common now, worldwide. Hiring an agency may afford the client plausible deniability in the event of discovery. Rally Forge served a range of clients including Turning Point Action and Inclusive Conservation Group. In September 2019 it was implicated in an operation uncovered by the Washington Post, in which teenagers appeared to be posting comments using fake accounts. Twitter and Facebook each took down a subset of the accounts immediately, and Facebook opened an investigation. This report provides an assessment of content taken down as a result of that investigation. 

Key takeaways

• Rally Forge-linked accounts engaged in astroturfing operations on multiple platforms, posting “vox populi” comments about hunting or politics that appeared grassroots but was in fact paid commentary, much of it from people who did not exist.

• The fake accounts were operated over a period of several years, with a period of dormancy that appeared to coincide with the end of the 2018 election cycle. These fake accounts occasionally pivoted in their expressed political beliefs and topical focus. 

• Most of the Rally Forge-linked Page audiences were small, and comments that its personas left did not appear to generate much response. However, several of its Pages did achieve significant reach at their peak.

Examples of content and replies from the hunting-advocacy astroturfing operation carried out by the network.

While there are bright lines when it comes to foreign influence operations, policies are fuzzier when considering U.S.-based actors, particularly as networked activism tactics are used by an increasing variety of domestic political and issue-based advocacy groups. In this case, the vast majority of the content that Facebook attributed to the Rally Forge network consisted of fairly standard political and issue-based advocacy work. However, there was additionally extensive inauthenticity in the form of fake accounts, which attempted to manipulate the public by way of astroturfed comment activity.

The Rally Forge network across Facebook, Instagram, and Twitter. Twitter is the upper left, Instagram lower right, and Facebook the smaller cluster between them. Large nodes are individual actors in the network, and the small nodes surrounding them are “interests”—Pages and accounts that they follow. Accounts are increasingly likely to be “real” as they stray from the center of the clusters and have additional diverse interests. Subcommunities of the 3 major social networks, represented with different color, are inferred by modularity. For example, the two darkest colored clusters on the lower right are of International Conservation Group leadership.