The invisible side of manipulation: How the Iranian regime suppressed #mahsaamini on Persian Twitter

By Hossein Kermani, Principal Investigator at the BeyondCBA Project

Editor’s introduction

In September 2022, the death of Mahsa Jina Amini marked a major turning point for Iran. The event sparked lengthy nationwide protests across socio-economic classes and population groups whose demands rapidly evolved from discarding controversial hijab regulations to calls for the overthrow of the Islamic Republic. The Iranian government responded with repression, killing over 400 protesters in late 2022 and early 2023, according to human rights groups. 

The Clingendael blog series ‘Iran in transition‘ explores power dynamics in four critical dimensions that have shaped the country’s transformation since: state-society relations, intra-elite dynamics, the economy, and foreign relations. This blog post analyzes online practices and innovations of the Iranian regime to suppress activism and dissent during the 2022-2023 protests.

Protesting offline and online

In September 2022, the largest anti-regime movement in the Islamic Republic's history – ‘Women, Life, Freedom’ - occurred in response to the murder of a young Iranian Kurdish girl, Mahsa (Jina) Amini when she was in the custody of the ‘morality police’ for violating hijab dress regulations. The protest was initially mainly focused on the systematic discrimination and injustice of women in Iran. However, it quickly turned into a nationwide movement comprising diverse political, social, professional, and ethnic groups that challenged the regime as a whole. Years of suppression, humiliation and discrimination added to a lack of socio-political freedom and rising economic burdens to pursue citizens to protest on Iran’s streets or social media. According to Khatam, over two million people protested across nearly 160 cities. In response, the regime took recourse to harsh violence to oppress street protests, leaving 525 dead including 71 minors. It also put 1,100 protestors on trial, and detained another 30,000.

The fight on Twitter (now X) was just as intense. Iranian users had published over 500 million tweets with the hashtag #MahsaAmini by December 9, 2022. The platform emerged as a major space for online dissent. However, authoritarian regimes have developed new repressive tactics to neutralize threats arising from such platforms and Iran’s government is no exception. Besides direct counter-tactics like internet shutdown, blockage and surveillance, authoritarian regimes also mount indirect counter-tactics to social media activism and dissent, such as co-optation and disinformation. Such tactics have a visible and a more invisible repressive dimension. Their visible side of suppression includes, for example, social media users that clearly support the regime and its disinformation agenda. Such users comprise social bots, i.e., algorithmic accounts designed specifically to interact with humans on social media or other communication platforms, but are not limited to them. These tactics are identifiable as they mostly involve sharing simple forms of fake news or conspiracy theories that can be disproved with relative ease. Consider, for example, tweets claiming that protesters have been killed by foreign intelligence services or that an entire movement is the ploy of Western governments. As the effectiveness of such tactics has decreased, authoritarian regimes have started to use more complex repressive measures to deal with online dissent, such as spreading unverified information and even fabricated stories. This essay discusses how the Iranian regime innovated its online response repertoire and eventually suppressed the hash tag #MahsaAmini on Persian Twitter. 

Beyond pro-regime social media users and social bots 

Many studies of online activism, counter-activism, and disinformation have focused on the role of social bots that distort the organic, true user-based flow of communication on social media by spotlighting or amplifying particular messages. Consider what happened during the U.S. 2016 presidential election or the Brexit referendum. Today, however, the problem of disinformation goes well beyond the use of social bots. Not only are many real humans, including state-coordinated users, involved in disinformation and pro-regime propaganda campaigns, but there are also social media accounts that infiltrate anti-regime online communities by faking anti-regime users’ behavior to cause confusion and mistrust (discussed further below). Such users cannot be identified easily. During the 2022-2023 protests, the Iranian regime mobilized such users to suppress #MahsaAmini on Twitter by distorting reality by mixing fact with fiction. I conducted a two-year longitudinal digital ethnography on Persian Twitter from April 2022 to April 2024. This was complemented by a critical discourse analysis of the authors and content of the most popular tweets shared during the first two months of the movement (15 September to 15 November 2022), comprising 36,255 tweets and 4,807 users. The dataset was coded by five human coders in three rounds.

The first category of ‘infiltrating users’ comprises anonymous political accounts, which mostly emerged or gained popularity during the protests. Since it is not clear who is behind such accounts, they cannot be fully trusted. During the #MahsaAmini movement, accounts like @anonymousopiran or @javanane_t became popular. The accounts regularly pronounced that regime overthrow was imminent published many calls for street protests. However, other Twitter users raised the possibility that these accounts were regime-operated. A crucial point here is that it is less relevant whether such accounts are authentic or part of a regime strategy, and more relevant that they contribute to confusion and mistrust by exhibiting questionable and suspicious behavior.

An example of a dispute between anonymous political accounts sheds light on how uncertainty can be manufactured. A user, @a_baby_hamster, shared a thread on X arguing that the slogan ‘Man, Homeland, Prosperity’ was initiated by monarchists, i.e. pro-Pahlavi users. This slogan was defined in opposition to the slogan ‘Women, Life, Freedom’ of Iran’s homegrown social movement. The user then accused monarchists of dividing protestors as ‘Man’ suggests Reza Pahlavi should be the future king, which is a divisive statement. Several days later, another self-styled ‘monarchist user’ (i.e. that might also be a regime cyber agent), @Hunter_of_57s, argued that @a_baby_hamster is a regime agent. Next, @a_baby_hamster deactivated his account and his tweets are no longer available. Subsequently, many opponents of the monarchists supported @a_baby_hamster in their tweets because of his earlier pro-Pahlavi statement and counter-inquired whether @Hunter_of_57s himself was not a regime agent instead. Since both users were anonymous, we cannot be sure if they are authentic accounts or not. However, in a highly charged environment that is rife with suspicion, accusations of being an agent of x or y are made easily. The result is that online waters are muddied, tweets and campaigns lose focus or are interrupted, and online activism is stifled. 

The second group of ‘infiltrating users’ is not anonymous and belongs to real individuals, including famous activists and journalists. Such accounts show no sign of supporting the regime, but they share disinformation and change their political attitudes, which makes them suspicious. Even this does not necessarily mean they work for the regime, but their behavior does contribute to mistrust and confusion, which eventually benefited regime objectives. For instance, Pouria Zeraati, a TV host at Iran International shared instances of fake news during the protests. Ali Javanmardi, an activist and journalist, did the same. The unverified information they shared included claims about Khamenei’s death and authorities fleeing the country. 

For instance, Zeraati shared on 25 Sep 2022: “An informed source: Over the past three to four days, a large wave of families affiliated with the regime has arrived in Vancouver, Canada. Most have settled in the northern Vancouver area.” None of this turned out to be true. As to Javanmardi, he wrote on 27 September 2022: “Has the pillar of the tent of the regime of corruption collapsed? Exclusive medical sources report that Khamenei has undergone open-heart surgery at Rajaei Hospital in Tehran, in the “Enghelab” (Revolution) ward, and has fallen into a coma. During the operation, personnel from the cardiology and diplomatic sections of the hospital were completely evacuated, and access for other hospital staff was strictly prohibited”. While this story proved to be entirely fabricated, he repeated such unverified information in several tweets. 

While it is possible that such individuals made honest mistakes by sharing information with low credibility, their behavior can also raise accusations of being regime agents. Because their stories and claims turn out to be false, their messages reduce popular confidence in the quality of news reporting across the board, which negatively impacts online activism against the regime. Such messages also increase suspicion, which makes concerted action online against the regime more difficult. 

The final group of ‘infiltrating users’ includes everyday user accounts, i.e. users who tweet mainly about everyday routines and topics. Regime-supporting, everyday users are mainly tasked with depoliticization of online discourse, activism and dissent. Given the fact that everyday users who tweet honestly and those that are part of the regime’s cyber army behave in a similar manner, it is difficult to distinguish between them. Even though focusing on the timing of their tweets or the composition of their network of followers can help, identifying them remains rife with uncertainties. For instance, @__zahramz, an everyday user, shared a ‘normal’ tweet like: “Me being single is a waste of God's blessing! I don’t know what’s wrong with you all. Why aren’t you hitting on me? :))))” This user could be part of a broader campaign to return online discourse during protests to more mundane topics like dating. If so, it would probably be organized by the regime. One could for example check who liked and retweeted his original tweet, and find out many other users (i.e. accounts with female identities and pretty profile pictures) posted the same message (see Figure 1 below for an example).[1] 

Figure 1: Highly identical messages circulated by similar user profiles

There is a sub-category of such ‘everyday users’, namely seasoned operatives who act like ghosts. These accounts are activated/deactivated on particular occasions to share specific disinformation and hence give it greater volume in terms of traffic. This makes identifying them problematic. Such accounts, can nonetheless be found by analyzing their account and network data, e.g., date of creation. Furthermore, these accounts delete all their tweets, so it is almost impossible for other users to know their intentions and true nature. For instance, on the night when Mohammad Ghobadlou was executed – a political prisoner condemned by the regime – a number of seasoned operatives tweeted in what seemed to be in protest against his execution, but while mentioning the name of an incorrect prison. The aim was to prevent any public gathering in front of the prison where Mohammad was actually jailed.

Fake news +

However, the complexity of online suppression beyond surveillance and bots extends beyond the problematic account categories discussed above. The Iranian regime also introduced new forms of fake news beyond simple forms of falsehood. Two innovations of such novel practices stand out: unverified information and fabricated stories. 

Planting unverified information during the protests by the regime and having it amplified by online users, was possible by playing on the beliefs and hopes of protesters. For instance, a major example of unverified information raising hope among protesters were tweets indicating that Oshnavieh (Persian: اشنويه) was freed by demonstrators. Oshnavieh is a city in Iran’s West Azerbaijan province. The credibility of tweets claiming that an entire city had actually been wrested from government control was unclear at the time. Nevertheless, many anti-regime users, including journalists, shared it, and so amplified it. This gave protesters hope that they were close to overthrowing the entire regime. However, the ‘news’ became a major setback to morale once it turned out to be untrue. Several such instances of unverified information first being amplified and then being disproven in a short time caused huge waves of disappointment and skepticism about protest prospects – precisely what the regime intended. 

Another example of the effects that unverified information can have was the murder of Nika Shakarami – a 16-old girl who became a symbol of bravery during the protests. On 20 September 2022 many rumors circulated about how she was kidnapped, tortured and murdered. However, as there were no video or other forms of proof available while the regime was in full control of news flow and media, it could deny murder and muddy the waters. The news of her murder remained unverified and was even used by regime supporters to discredit protesters. Even some moderate pro-regime journalists like Vahid Ashatri shared a thread  rejecting narratives of rape and murder, arguing she had fallen from a roof. Only months later did BBC investigative reports uncover how Nika Shakarami was arrested and murdered. Because such information was not available at the time of the tragedy, disinformation could help limit indignation among ordinary people and thus the appeal of protest.

Users that probably are regime agents – rather than merely active victims of misinformation – but try to come across as someone else, shared unverified information with malicious aims in a number of cases. For instance, @Sibzaminizogali falsely tweeted that Khoda Nour Lejei, who was killed by regime forces in Zahedan, had killed six officers before his death. The aim of such information was to encourage violent behavior among protesters to give the regime an excuse to repress them. While ‘real dissident users’ could of course also advocate for violence, the frequency of messages calling for violence (indirectly or directly) in the community of ‘suspicious users’ was much higher.

Yet another innovative regime tactic to disseminate unverified information was to create ‘false connections.’ Here, agents of disinformation take two true incidents and make a false connection between them. The case of Hadis Najafi, a young girl among the protesters, offers an example. It was claimed that she had been killed by regime forces a video went viral of a girl who had tied her hair and joined a group of protesters in the street. This video quickly became a symbol of bravery among protesters. Then, some online users claimed that the girl in the video was Hadis Najafi and met her untimely end while demonstrating. The message being one of discouragement: death might well follow protest participation and disobedience. The truth only came to light when the girl that was really depicted in the movie sent a video to BBC Persian to reject the false claims about Hadis Najafi featuring in the clip instead of her. 

Fabricated stories are incidents with a variable extent of falsehood that seem to be true at the time of their presumed occurrence. It may take months before the truth behind them is revealed, or it may never happen. They are hard to detect, and their development and use by the Iranian regime arguably represent the peak of its covert information campaign. Many authentic anti-regime users shared fabricated stories during the protests, as they seemed entirely believable. The case of Hossein Rounaghi offers an example. Hossein Rounaghi is a prominent anti-regime figure living in Iran. He was arrested in October 2022. Several days later, it was reported that regime forces had broken his legs. The source of information were his family members and friends, so it seemed reliable. Credible media also featured his story. However, when photos of him were shared once he was in a hospital, it became clear that the news about his broken legs had been incorrect. This enabled pro-regime media and users to mock Rounaghi and the media that had shared this story. After his release, Rounaghi recounted how his interrogators had made his family and friends believe the falsehood without having allowed him to clarify that he had been injured and beaten, but his legs had not been broken. But the damage, i.e., discrediting Rounaghi among other activists, had been done. Once the false story had taken hold, its subsequent falsification enabled the regime to discredit activists and media, sowing doubt over future reporting and creating cover for future incidents of torture. 

Disinformation vertigo 

During the protests, the Iranian regime used visible disinformation practices to dominate the narrative, such as mobilization of pro-regime’s online users and propaganda. Failing that, regime use of invisible disinformation practices intended to discredit competing narratives so that no believable narrative remained. The main difference between ‘invisible’ actors and practices and more ‘visible’ ones is that details of the former are hard to ascertain. It is possible that users spreading disinformation are part of the regime’s cyber army. It is also possible that they are not. The truthfulness of unverified information and fabricated stories is difficult to ascertain as well. In this space, each user and every narrative can be authentic or part of the regime’s disinformation campaign. Which is exactly the point since the resulting uncertainty causes people to give up on assessing the reliability of news. It creates a low-trust environment in which no claim can be fully proven or denied. When anti-regime forces cannot trust each other, no online unity is possible. 

This dynamic was on full display in the months after the ‘Women, Life, Freedom’ movement, when supporters of different anti-regime figures like Reza Pahlavi, Masih Alinejad and Hamed Esmailion accused each other on Twitter of cooperating with the regime. It became clear that opposition to the regime can only be effective once the actors and movements involved have devised successful countermeasures that prevent them from falling into regime disinformation traps. Transparency of connections and activities can for example offer a starting point to bring the invisible dimension of online manipulation to the light.
 

[1] It is a tactic used by regime cyber forces to create profiles with fake female names and sexually appealing photos in order to gain as many followers as possible. During times of crisis, these accounts are then used to manipulate discussions and redirect debates. Such accounts may also be employed to identify anonymous anti-regime users.

Read earlier blogs in this series