Thread by @benimmo

BREAKING: Facebook just announced that it's taken down 82 pages, groups and accounts, originating in Iran, that targeted the US (and UK).

@DFRLab had a look at some of them just before the takedown. Thread coming on what we found.

newsroom.fb.com/news/2018/10/c…

Top line: this looked like an Iranian operation which learned from the Russian troll operations.

Divisive content and political agitation, especially against Trump and GOP, but attacks on Saudi Arabia and Israel thrown into the mix.

Analysis of the top takeaways from the @DFRLab team here:

medium.com/dfrlab/trolltr…

1. These accounts were aiming at the midterms, and election activity more broadly.

That's a change from earlier Iranian info ops, which largely tried to lead social media users to pro-regime websites so they could read the messaging.

2. Some of the accounts had significant engagement numbers.

Definitely more than the earlier Iranian operations, which were frankly clunky.

For example, this page had close on half a million follows.

Focus: race relations, police violence, US military engagement abroad.

3. The pages we looked at were mainly recent creations. The oldest was January 2016, two of the best performing were February and April 2018.

Again, masquerading as liberal / progressive groups.

4. They behaved the same way the Russian operation did, posting engaging content, including positive messaging consistent with the communities they were trying to infiltrate.

This from Voice of Change, on FB.

This one was from I Need Justice Now, on FB.

And from know_the_realities, on Instagram.

Note the way this one hashtags #zionism, not once, but twice.

(Comments anonymised to protect the users.)

5. These pages were heavily into posting divisive content. Much more than previous Iranian operations, and much more like the Russian operations.

Here's shut_racism, on Instagram, with its take on Trump.

Here's INeedJusticeNow, amplifying a less than flattering word portrait of the 45th president.

Some of the posts were explicitly partisan.

Here's shut_racism on the GOP.

Some hinted at violence.

Nazi punchers...

... and hand grenades.

But in the mix, there was content which was bang in line with the Iranian government's foreign policy narratives.

Palestinians, for example.

Israel, of course.

Saudi Arabia.

And US operations in the Middle East.

7. The Iranian operation took broadly from other internet users. Probably both trying to attract users from the community, and to mask its own origins.

Some of the content was harmless.

Some, again, matched Iranian narratives.

Interestingly, this was posted in 2018, but copied a cartoon from 2015. Hollande isn't the president of France any more, guys...

Some of the pages copied one another's content, like this.

A lot of the focus was on memes. A good way to try for virality, but also a good way to avoid linguistic errors...

... but not cultural ones.

This post talked about the sacrifice of U.S. GIs in WWII, and illustrated them with WWII soldiers ... of the Red Army.

This one was linguistically perfect, but only makes sense if you read it from right to left, like Arabic (or Japanese, of course).

9. Most of the posts were negative.

Trolls get more impacts when they troll. Sad, but true.

10. Some of the traffic had wildly high engagement numbers, suggesting artificial boosting.

Almost 800k shares here, for example.

Also worth noting that one of the accounts posed as a British liberal, and focused on Jeremy Corbyn. That's similar to the Iranian websites exposed by @FireEye this summer.

They were up to date on some of their reporting. Lots on Khashoggi, for example.

Upsum: this looked like an Iranian operation that learned from Russian ones. More based on social media, more engaging, more divisive (albeit one-sided, not playing both sides).

Trolls evolve.

Thread ends.