Featured

Published on February 17th, 2023 📆 | 3337 Views ⚑

0

Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests

korean tts

In August 2018, FireEye Threat Intelligence released a report
exposing what we assessed to be an Iranian
influence operation leveraging networks of inauthentic news
sites and social media accounts aimed at audiences around the world.
We identified inauthentic social media accounts posing as everyday
Americans that were used to promote content from inauthentic news
sites such as Liberty Front Press (LFP), US Journal, and Real
Progressive Front. We also noted a then-recent shift in branding for
some accounts that had previously self-affiliated with LFP; in July
2018, the accounts dropped their LFP branding and adopted personas
aligned with progressive political movements in the U.S. Since then,
we have continued to investigate and report on the operation to our
intelligence customers, detailing the activity of dozens of additional
sites and hundreds of additional social media accounts.

Recently, we investigated a network of English-language social media
accounts that engaged in inauthentic behavior and misrepresentation
and that we assess with low confidence was organized in support of
Iranian political interests. In addition to utilizing fake American
personas that espoused both progressive and conservative political
stances, some accounts impersonated real American individuals,
including a handful of Republican political candidates that ran for
House of Representatives seats in 2018. Personas in this network have
also had material published in U.S. and Israeli media outlets,
attempted to lobby journalists to cover specific topics, and appear to
have orchestrated audio and video interviews with U.S. and UK-based
individuals on political issues. While we have not at this time tied
these accounts to the broader influence operation we identified last
year, they promoted material in line with Iranian political interests
in a manner similar to accounts that we have previously assessed to be
of Iranian origin. Most of the accounts in the network appear to have
been suspended on or around the evening of 9 May, 2019. Appendix 1
provides a sample of accounts in the network.

The Network

The accounts, most of which were created between April 2018 and
March 2019, used profile pictures appropriated from various online
sources, including, but not limited to, photographs of individuals on
social media with the same first names as the personas. As with some
of the accounts that we identified to be of Iranian origin last
August, some of these new accounts self-described as activists,
correspondents, or “free journalist[s]” in their user descriptions.
Some accounts posing as journalists claimed to belong to specific news
organizations, although we have been unable to identify individuals
belonging to those news organizations with those names.

Narratives promoted by these and other accounts in the network
included anti-Saudi, anti-Israeli, and pro-Palestinian themes.
Accounts expressed support for the Joint Comprehensive Plan of Action
(JCPOA), commonly known as the Iran nuclear deal; opposition to the
Trump administration’s designation of Iran’s Islamic Revolutionary
Guard Corps (IRGC) as a Foreign Terrorist Organization; antipathy
toward the Ministerial to Promote a Future of Peace and Security in
the Middle East (a U.S.-led conference that focused on Iranian
influence in the Middle East more commonly known as the February 2019
Warsaw Summit); and condemnation of U.S. President Trump’s veto of a
resolution passed by Congress to end U.S. involvement in the Yemen conflict.

Figure 1: Sample tweets on the Trump
administration’s designation of Iran’s IRGC as a Foreign Terrorist Organization

Interestingly, some accounts in the network also posted a small
amount of messaging seemingly contradictory to their otherwise
pro-Iran stances. For example, while one account’s tweets were almost
entirely in line with Iranian political interests, including a tweet
claiming that “iran has shown us that his nuclear program is peaceful
[sic],” the account also posted a series of tweets directed at U.S.
President Trump on Sept. 25, 2018, the same day that he gave a speech
to the United Nations in which he excoriated the Iranian Government.
The account called on Trump to attack Iran, using the hashtags
#attack_Iran, #go_to_hell_Rouhani, #stop_sanctions, #UnitedNations,
and #trump_speech; other accounts in the network, which likewise
predominantly held pro-Iran stances, echoed these sentiments, using
the same or similar hashtags. It is possible that these accounts were
seeking to build an audience with views antipathetic to Iran that
could then later be targeted with pro-Iranian messaging.

Apart from the narratives and messaging promoted, we observed
several limited indicators that the network was operated by Iranian
actors. For example, one account in the network, @AlexRyanNY, created
in 2010, had only two visible tweets prior to 2017, one of which, from
2011, was in Persian and of a personal nature. Subsequently in 2017,
@AlexRyanNY claimed in a tweet to be “an Iranian who supported
Hillary” in a tweet directed at a Democratic political strategist.
This account, using the display name “Alex Ryan” and claiming to be a
Newsday correspondent, appropriated the photograph of a genuine
individual also with the first name of Alex. We note that it is
possible that the account was compromised from another individual or
that it was merely repurposed by the same actor. Additionally, while
most of the accounts in the network had their interface languages set
to English, we observed that one account had its interface language
set to Persian.

Impersonation of U.S. Political Candidates

Some Twitter accounts in the network impersonated Republican
political candidates that ran for House of Representatives seats in
the 2018 U.S. congressional midterms. These accounts appropriated the
candidates’ photographs and, in some cases, plagiarized tweets from
the real individuals’ accounts. Aside from impersonating real U.S.
political candidates, the behavior and activity of these accounts
resembled that of the others in the network.

For example, the account @livengood_marla impersonated Marla
Livengood, a 2018 candidate for California’s 9^th
Congressional District, using a photograph of Livengood and a campaign
banner for its profile and background pictures. The account began
tweeting on Sept. 24, 2018, with its first tweet plagiarizing one from
Livengood’s official account earlier that month:

Figure 2: Tweet by suspect account
@livengood_marla, dated Sept. 24, 2018 (left); tweet by Livengood’s
verified account, dated Sept. 1, 2018 (right)

The @livengood_marla account plagiarized a number of other tweets
from Livengood’s official account, including some that referenced
Livengood’s official account username:

Figure 3: Tweet by suspect account
@livengood_marla, dated Sept. 24, 2018 (left); tweet by Livengood’s
verified account, dated Sept. 3, 2018 (right)

The @livengood_marla account also tweeted various news snippets on
both political and apolitical subjects, such as the confirmation of
Brett Kavanaugh to the U.S. Supreme Court and the wedding of the UK’s
Princess Eugenie and Jack Brooksbank, prior to segueing into promoting
material more closely aligned with Iranian interests. For example, the
account, along with others in the network, commemorated the United
Nations’ International Day of the Girl Child with a photograph of
emaciated children in Yemen, as well as narratives pertaining to the
killing of Saudi journalist Jamal Khashoggi and Saudi Shiite child
Zakaria al-Jaber, intended to portray Saudi Arabia in a negative light.

In another example, the account @ButlerJineea impersonated Jineea
Butler, a 2018 candidate for New York’s 13^th Congressional
District, using a photograph of Butler for its profile picture and
incorporating her campaign slogans into its background picture, as
well as claiming in its Twitter bio to be a “US House candidate,
NY-13” and linking to Butler’s website, jineeabutlerforcongress.com.

Figure 4: Suspect account @ButlerJineea
(left); apparent legitimate, currently inactive account
@Jineea4congress (right)

These and other accounts in the network plagiarized tweets from
additional sources beyond the individuals they impersonated, including
other U.S. politicians, about both political and apolitical topics.

Influence Activity Leveraged U.S. and Israeli Media

In addition to directly posting material on social media, we
observed some personas in the network leverage legitimate print and
online media outlets in the U.S. and Israel to promote Iranian
interests via the submission of letters, guest columns, and blog posts
that were then published. We also identified personas that we suspect
were fabricated for the sole purpose of submitting such letters, but
that do not appear to maintain accounts on social media. The personas
claimed to be based in varying locations depending on the news outlets
they were targeting for submission; for example, a persona that listed
their location as Seattle, WA in a letter submitted to the Seattle
Times subsequently claimed to be located in Baytown, TX in a
letter submitted to The Baytown Sun. Other accounts in the
network then posted links to some of these letters on social media.

The letters and columns, many of which were published in 2018 and
2019, but which date as far back as 2015, were mostly published in
small, local U.S. news outlets; however, several larger outlets have
also published material that we suspect was submitted by these
personas (see Appendix 2). In at least two cases, the text of letters
purportedly authored by different personas and published in different
newspapers was identical or nearly identical, while in other
instances, separate personas promoted the same narratives in letters
published within several days of each other. The published material
was not limited to letters; one persona, “John Turner,” maintained a
blog on The Times of Israel website from January 2017 to
November 2018, and wrote articles for the U.S.-based site Natural
News Blogs from August 2015 to July 2018. The letters and
articles primarily addressed themes or promoted stances in line with
Iranian political interests, similar to the activity conducted on
social media.

Figure 5: Sample letter published in
Galveston County’s (Texas) The Daily News, authored by suspect
persona Mathew O’Brien

We have thus far identified at least five suspicious personas that
have had letters or other content published by legitimate news
outlets. We surmise that additional personas exist, based on other
investigatory leads.

“John Turner”: The John Turner persona has been active since at
least 2015. Turner has claimed to be based, variously, in New York,
NY, Seattle, WA, and Washington, DC. Turner described himself as a
journalist in his Twitter profile, though has also claimed both to
work at the Seattle Times and to be a student at Villanova
University, claiming to be attending between 2015 and 2020. In
addition to letters published in various news outlets, John Turner
maintained a blog on The Times of Israel site in 2017 and 2018
and has written articles for Natural News Blogs. At least one
of Turner’s letters was promoted in a tweet by another account in the network.

“Ed Sullivan”: The Ed Sullivan persona, which has on at least
one occasion used the same headshot as that of John Turner, has had
letters published in the Galveston County, Texas-based The Daily
News, the New York Daily News, and the Los Angeles
Times, including some letters identical in text to those authored
by the “Jeremy Watte” persona (see below) published in the Texas-based
outlet The Baytown Sun. Ed Sullivan has claimed his location to
be, variously, Galveston and Newport News (Virginia).

“Mathew Obrien”: The Mathew Obrien persona, whose name has also
been spelled “Matthew Obrien” and “Mathew O’Brien”, claimed in his
Twitter bio to be a Newsday correspondent. The persona has had
letters published in Galveston County’s The Daily News and the
Athens, Texas-based Athens Daily Review; in those letters, his
claimed locations were Galveston and Athens, respectively, while the
persona’s Twitter account, @MathewObrien1, listed a location of New
York, NY. At least one of Obrien’s letters was promoted in a tweet by
another account in the network.

“Jeremy Watte”: Letters signed by the Jeremy Watte persona have
been published in The Baytown Sun and the Seattle Times,
where he claimed to be based in Baytown and Seattle, respectively. The
texts of at least two letters signed by Jeremy Watte are identical to
that in letters published in other newspapers under the name Ed
Sullivan. At least one of his letters was promoted in a tweet by
another account in the network.

“Isabelle Kingsly”: The Isabelle Kingsly persona claimed on her
Twitter profile (@IsabelleKingsly) to be an “Iranian-American” based
in Seattle, WA. Letters signed by Kingsly have appeared in The
Baytown Sun and the Newport News Virginia local paper The
Daily Press; in those letters, Kingsly’s location is listed as
Galveston and Newport News, respectively. The @IsabelleKingsly Twitter
account’s profile picture and other posted pictures were appropriated
from a social media account of what appears to be a real individual
with the same first name of Isabelle. At least one of Kingsly’s
letters was promoted in a tweet by another account in the network.

Other Media Activity

Personas in the network also engaged in other media-related
activity, including criticism and solicitation of mainstream media
coverage, and conducting remote video and audio interviews with real
U.S. and UK-based individuals while presenting themselves as
journalists. One of those latter personas presented as working for a
mainstream news outlet.

Criticism/Solicitation of Media Coverage

Accounts in the network directed tweets at mainstream media outlets,
calling on them to provide coverage of topics aligned with Iranian
interests or, alternatively, criticizing them for insufficient
coverage of those topics. For example, we observed accounts
criticizing media outlets over their lack of coverage of the killing
of Shiite child Zakaria al-Jaber in Saudi Arabia, as well as Saudi
Arabia’s conduct in the Yemen conflict. While such activity might have
been intended to directly influence the media outlets’ reporting, the
accounts may have also been aiming to reach a wider audience by
tweeting at outlets with a large following that woud see those replies.

Figure 6: Sample tweets by suspect
accounts calling on mainstream media outlets to increase their
coverage of alleged Saudi activity in the Yemen conflict

“Media” Interviews with Real U.S., UK-Based Individuals

Accounts in the network, under the guise of journalist personas,
also solicited various individuals over Twitter for interviews and
chats, including real journalists and politicians. The personas appear
to have successfully conducted remote video and audio interviews with
U.S. and UK-based individuals, including a prominent activist, a radio
talk show host, and a former U.S. Government official, and
subsequently posted the interviews on social media, showing only the
individual being interviewed and not the interviewer. The interviewees
expressed views that Iran would likely find favorable, discussing
topics such as the February 2019 Warsaw summit, an attack on a
military parade in the Iranian city of Ahvaz, and the killing of Jamal Khashoggi.

The provenance of these interviews appear to have been
misrepresented on at least one occasion, with one persona appearing to
have falsely claimed to be operating on behalf of a mainstream news
outlet; a remote video interview with a US-based activist about the
Jamal Khashoggi killing was posted by an account adopting the persona
of a journalist from the outlet Newsday, with the
Newsday logo also appearing in the video. We did not identify
any Newsday interview with the activist in question on this
topic. In another instance, a persona posing as a journalist directed
tweets containing audio of an interview conducted with a former U.S.
Government official at real media personalities, calling on them to
post about the interview.

Conclusion

We are continuing to investigate this and potentially related
activity that may be being conducted by actors in support of Iranian
interests. At this time, we are unable to provide further attribution
for this activity, and we note the possibility that the activity could
have been designed for alternative purposes or include some small
percentage of authentic behavior. However, if it is of Iranian origin
or supported by Iranian state actors, it would demonstrate that
Iranian influence tactics extend well beyond the use of inauthentic
news sites and fake social media personas, to also include the
impersonation of real individuals on social media and the leveraging
of legitimate Western news outlets to disseminate favorable messaging.
If this activity is being conducted by the same or related actors as
those responsible for the Liberty Front Press network of inauthentic
news sites and affiliated social media accounts that we exposed in
August 2018, it may also suggest that these actors remain undeterred
by public exposure or by social media platforms’ shutdowns of their
accounts, and that they continue to seek to influence audiences within
the U.S. toward positions in line with Iranian political interests.

Appendices

Appendix 1: Sample Twitter accounts identified in this network,
currently suspended.

Table 1: Sample Twitter accounts identified in
this network

Appendix 2: Sample letters published in news outlets submitted by
personas identified in this network, August 2018 to April 2019.

Table 2: Sample letters published in news
outlets submitted by personas in this network

Source link

Tagged with: accounts • candidates • CandidatesLeverages • impersonates • interests • iranian • israeli • media • network • political • social • support • U.S.