Clemson students’ research could get Iranian election interference kicked off the web
It started with one tweet.
All Darren Linvill told his Clemson University class was that the post by a seemingly innocuous account was actually part of a coordinated attempt to sow disinformation ahead of the 2020 election. They just had to figure out how.
Before the end of the semester, the eight undergrads and a doctoral candidate had found a web of online accounts with fake photos and vague descriptions spreading false information and targeted propaganda across the web. All were tied to an Iranian preacher at a time the federal government says the Mideastern nation is stepping up its interference in next week’s presidential race.
“The way it works, we give them one thing that we knew was connected to other accounts, and said ‘go tell us how,’” said Linvill, a communications professor. “We teach them media forensics: Who registered the domain? What are the links with others on a platform? ... We’d seen a previous version of this, so we know the things they’re looking for, but they took the ball and knocked it out of the park.”
The tweet shows a photo from a riot that broke out in Minnesota this past summer after the death of George Floyd, who was in police custody in Minneapolis. But the Aug. 1 tweet places the image in Arizona — a swing state in November’s election. The user also addresses the tweet to Ali Khamenei, the supreme leader of Iran. She even addresses Khamenei with the respectful title “Seyed.”
Linvill’s students were able to tie this account and 100 other accounts — all with little individual identifying information, recycled profile pictures (most of them attractive young women) and “oddly consistent” tweet timing — to a coordinated effort to boost pro-Iranian content on the platform. All the accounts seem to be tied to the account of Iranian Shiite religious leader Muhammad Shojae, who had previously been kicked off of Instagram.
Assisting in the class is Steven Sheffield, a Clemson alumnus and doctoral candidate who brings skills to the class he learned as an Air Force captain and in his time in the intelligence community.
“I show them the ins and outs of social media analytics and give them a few pieces of open source technology,” Sheffield said. “But the students, you feed them one tweet, and they do really great work. The kids now are so much sharper than I was back then.”
Most of the content from the accounts the class identified is innocuous. It often contains motivational or inspirational messages, some of them derived from Shiite Islam, the state religion of Iran. But when called upon, the accounts would spread consistent messages Linvill described as “pro-Iran, anti-Israel, anti-Semitic, references to the war in Yemen, (and) support for Hezbollah.”
Clemson senior Hannah Abee of Simpsonville said a simple reverse image search was enough to find the account’s profile picture came from another source and wasn’t actually representative of who was operating the account.
“There was a pretty consistent pattern that raised a huge red flag,” she said. “They would post these inspirational messages with nice images, and two tweets later it would be graphic images of children injured in war. The messages would be pro-Shia, pro-Iran, but they would hashtag Black Lives Matter or Trump.”
The accounts the class was able to identify displayed a lot of common features. All were created within the past year. All tended to follow each other without following many legitimate accounts, and few legitimate accounts followed them — and all followed Muhammad Shojae’s account, which they retweeted often.
“They were like fan accounts,” Abee said.
Scott Moore, a Clemson freshman and Richland Northeast High School graduate studying political science and Middle Eastern studies, said the class gave him and his classmates the tools they needed to identify the network of accounts behind the messages.
“If you looked at their retweets and likes, they show the same post pattern, the same rhetoric and the same posts shared between them,” Moore said. “We were able to follow them back to this one individual, Master Shojae. If that account mentioned something, they would all start tweeting about certain events.”
Within a single day, the class identified 40 different networked accounts, their internet activity tightly connected to each other in a similar pattern to that seen among coordinated Russian web activity ahead of the 2016 election, Sheffield said.
“They’re digital natives, so they understand this stuff implicitly,” said the 2000 Clemson graduate, who also referenced the school’s football success. “Maybe they have a different caliber of student at Clemson today. Those national championships must have been good for recruiting.”
Abee started as a history major, but became interested in social media analytics when she took a course with the university’s Social Media Listening Center, which monitors activity on sites like Twitter. She believes better understanding of how online networks work will be critical to understanding how the world works in the 21st century.
“It is what it is, but it can be what we make it, if you learn about media literacy and how to use social media responsibly,” Abee said.
Linvill knows a fake account when he sees one. In 2018, he and fellow Clemson professor Patrick Warren published a large database of Twitter accounts they identified as Russian-backed accounts used to influence the 2016 presidential election, mapping connections between them and similarities in how they sought to engage with American voters. Since then, the two researchers have seen other countries step into the online disinformation game, including Iran.
Last week, the FBI identified Iran as likely being behind a series of threatening messages sent to voters in multiple states. The messages were sent from an account associated with the far-right group the Proud Boys, claiming the group had gained access to voting infrastructure and would “come after” voters who didn’t vote for President Donald Trump. National Intelligence Director John Ratcliffe said the Iranians’ intent was to “intimidate voters, incite social unrest and damage President Trump.”
Linvill said he can’t be sure whether the network they’ve established is ultimately acting at the direction of the Iranian government in spreading a pro-Iranian message. But he said the operations of authoritarian governments are often opaque. The Internet Research Agency in Russia, tied to much of that country’s social media activity ahead of the 2016 election, is technically run privately by a wealthy individual with ties to Russian President Vladimir Putin, Linvill noted.
“Iran is a theocracy, so where is the line between a religious leader (like Shojae) and the Iranian state?” Linvill asked. “He certainly has a lot of resources to spread his message.”
He’s also impressed with the amount of work his students were able to put into identifying the accounts.
“They grew up with misinformation and disinformation being part of everyday conversations,” he said, “So I’m happy they were able to put what they’ve learned into practice and do something about it.
“These accounts will be shut down because of their work,” he said. “Even if they get put back up two weeks later.”
.jpg)