Iran’s Disinformation Ecosystem: A Snapshot

Sanctions, indictments & seizures reveal a formidable Iranian propaganda machine

The Kremlin interfered in election 2016, a bit in 2018, and again probed and prodded American voters in 2020. But Russian interference in election 2020, while again troublesome, overshadowed Iranian election interference, which in some ways may have been worse.

Iran’s propaganda and disinformation operations receive less attention than do the Russians’, but Tehran’s commitment to information warfare is substantial. Iran can’t move the opinions of American voters the way the Russians might—their reach into U.S. audiences remains too limited. But the Iranians can and at times have sewn chaos amongst European and U.S. audiences. Iran, despite being a regional power with limited resources, has created a significant information operations capability. In total, there’s public evidence that Iran programs in at least 32 languages and operates hundreds of websites and social media handles mixing true and false news. Here’s a snapshot of their election 2020 antics and their broader global social media machine.

Fear, Chaos, Panic - Iran’s tactics in Election 2020

In 2020, the Iranians tried to wreak havoc in America. In Florida, Americans received bogus emails warning that the neo-fascist Proud Boys organization planned to attack voters at the polls. In fact, the email wasn’t from the Proud Boys, but the Iranians. Then, after the election, a mysterious website called “Enemies of the People” sprang up purporting to target perceived opponents of then-President Donald Trump, releasing stylized images with crosshairs on the faces of American officials. Again, this turned out not to be Trump supporters, but the Iranians. Earlier in 2020, when rumors that Senator Tammy Duckworth was being considered as then-former Vice President Joe Biden’s Vice Presidential nominee, a forged letter surfaced (according to the Daily Beast) appearing to be on Duckworth’s letterhead seeming to blame alleged “black separatists” for a fire onboard a U.S. Navy ship. You guessed it: Iran.

Since Iran can’t shift votes, they instead seek to divide Americans, creating provocations designed to incite conflict based on social issues like race and religion. Their political targets in the 2020 election may seem strange, until you look at it from their perspective. President Donald Trump was a staunch foe of Iran, having killed Islamic Revolutionary Guards Corps-Quds Force (IRGC-QF) general Qassem Soleimani at the beginning of 2020 and repeatedly threatened war with the country. Senator Tammy Duckworth, an Iraq War veteran wounded in combat, had she risen to the position of Vice President, would have likely been adversarial to Iranian interests. Despite their provocations in the 2020 election, the U.S. is a small market for Iran’s information manipulation machine.

The three pillars of Iran’s global information machine

In the last year, through U.S. government sanctions, indictments, and domain seizures, we’ve learned a lot more about the scale of what the Iranian regime is up to in cyberspace. To assist in mapping this ecosystem, my colleagues and I have put together a chart to show how overlapping Iranian information networks feed hundreds of websites and social media accounts pushing Iran’s messages out to the rest of the world. 

We found that Iran's disinformation and propaganda network can primarily be attributed to three umbrella institutions: The Islamic Revolutionary Guard Corps (IRGC), the Islamic Radios and Televisions Union (IRTVU), and the Islamic Republic of Iran Broadcasting (IRIB). Combined, these organizations oversee the bulk of Iran’s overt and covert news outputs and influence campaigns, with each playing a specific role in targeting Iran's domestic population, its Middle Eastern neighbors and countries further afield.

IRGC - Iran’s frontline disinformation soldiers

In October and November 2020, the U.S. Department of Justice (DOJ) seized the domains of 119 outlets it said were owned or operated by the IRGC. The sites hosted on these domains varied greatly in size, scope, and sophistication. While some were half-baked websites rife with spelling errors, others showed an understanding of the audiences being targeted. Among those more sophisticated IRGC websites were the English-language American Herald Tribune (AHTribune) and Real Progressive Front (RPFront). These sought to take advantage of America's partisan politics, publishing articles such as "Trump's grandfather was a pimp and tax evader; his father a member of the KKK" and “Joe Is a Zionist and Kamala Panders to Jewish Donors.” Like AHTribune and RPFront, other IRGC outlets used a combination of seemingly well-funded web operations and coordinated social media campaigns to target American voters with disinformation. While the 13% of seized outlets messaging in English received the greatest press attention, 43% were primarily Arabic-language outlets in addition to 8% each in Persian and Urdu. This shows the disproportionate effect Iran feels its messaging might have with its immediate neighbors.

Although the DOJ's takedowns were cheered in the U.S., they appear to have had little effect on IRGC operations. Within days of their seizure, many of the sites had sprung back to life under the aegis of Syrian and Iranian-controlled top-level domains (TLDs). Other outlets simply continued their messaging efforts on social media exclusively. One such example is the Dari News Facebook page, which provides a steady stream of articles to over 200,000 followers.

IRTVU - Iran’s growing soft power conglomerate

Launched in 2007, The Islamic Radios and Televisions Union (IRTVU) is a Tehran-based multimedia conglomerate designed to fund, train, or advise affiliate outlets in promoting state narratives both in Iran and abroad. IRTVU is purportedly controlled by Iran's Ministry of Islamic Guidance and has been described by the U.S. Treasury Department as the "propaganda arm" of Iran's Islamic Revolutionary Guards Corps-Quds Force (IRGC-QF). According to an archival copy of IRTVU’s now-seized website, it comprises more than 200 members from 35 countries on five continents.

IRTVU’s membership and programming is incredibly diverse and ranges from children’s television outlets to provincial Iranian radio stations, to satellite channels owned and operated by Iranian-aligned paramilitary groups such as Hezbollah. While not all IRTVU member outlets are likely to be pure instruments of Tehran’s influence, the body is nevertheless a key vector for Iranian messaging, especially through outlets connected to powerful military forces such as the Iraqi Popular Mobilization Units (PMU) affiliate Kataib Hezbollah’s al-Etejah and Asaib Ahl al-Haqq’s al-Ahad,Palestinian Islamic Jihad’s Palestine Today, and the Yemeni Houthi Movement’sal-Masirah.

In June, the DOJ seized 33 domains affiliated with IRTVU, citing the body’s labelling as a Specially Designated National (SDN). Seized domains included those affiliated with Iraq’s Da’wa, Hikma, Fadhila, and Iraqi National Congress parties, Palestinian Hamas, Yemen’s Houthi Movement, and Afghanistan’s Jamiat-e-Islami party. Like those IRGC-affiliated domains seized in 2020, at least 21 have re-hosted their websites on a combination of Iraqi, Afghan, and Iranian domains, while all others maintain at least some presence on social media.

IRIB - Iran’s state broadcaster and media enforcer

​​Formed shortly after the Iranian Revolution, The Islamic Republic of Iran Broadcasting (IRIB) is the constitutionally-mandated (Article 44) sole TV and radio broadcaster in Iran. IRIB’s role in Iran is to ensure that Iranian outlets promote state narratives and that media properties adhere to government-mandated standards. The head of IRIB—Abdul-Ali Ali Asgari—was appointed by Iran’s Supreme Leader, Ayatollah Ali Khamenei. Both Ali Asgari and IRIB have been sanctioned by the U.S. Treasury Department for airing forced confessions.

Not only does IRIB play a critical role in suppressing free speech in Iran, but it also manages some of Iran’s most prolific Western-facing outlets, all of which are designed to lionize Iran and its allies. Take, for example, IRIB’s notorious English-language outlet, PressTV. PressTV has repeatedly been suspended from various social media platforms for spreading disinformation, ranging from debunked COVID origin conspiracy theories to articles that imply Israel was responsible for the Sandy Hook school shooting.

Meanwhile, IRIB’s Spanish language outlet, HispanTV, has been banned from YouTube for promoting disinformation suggesting Israel was conducting medical experiments on Palestinian prisoners, while Twitter also banned HispanTV’s account in October 2020. Even some of IRIB’s newer or smaller outlets, such as Pars Today and Hausa TV, were booted from Facebook for interfering in West African Facebook pages.

Iran might only be a regional power militarily, but globally they remain an information manipulation machine that should not be underestimated.  What’s not discussed in this article and should not be overlooked is how this information ecosystem operates in concert with other authoritarian regimes to maximize their reach and increase their content generation. Russia, China and Iran routinely collaborate and cooperate to amplify each other’s disinformation.

Finally, while we’ve diagrammed Iran’s global information ecosystem here in this post, it’s important to note that Iran is currently experiencing internal turmoil. In the coming months, we’ll be watching to see if this Iranian propaganda system maintains its global campaigns or if their focus shifts or content output wanes while internal political competition ensues. Only time will tell.

Thanks to Jacob, Colin, Max and all of my research team for their hard work, analysis and graphic design skills in this post.