A Thoughtful, Analytical Approach to NGO Security

Twitter and disinformation in Iran

Over the past week there has been a lot of media coverage of the relationship between Twitter, the hybrid online/mobile communication service, and its impact on post election events in Iran. The argument that Twitter service in Iran is a critical opposition activist tool is already over-hyped so I won’t rehash them here. Rather, I think its worth shedding some light on how Twitter is being used to spread disinformation and who is doing it.

Twitspam has a continually updated list of suspected fake accounts that may have connections with Iranian security. I used some of these account names as a starting point for a quick and dirty analysis of their networks.

Suspected AlJazeera English producer impersonator “AJE_Producer” appears to be trying to lure Twitter users in Iran into communicating with him directly through email or telephone with the intent of entrapping them. The diagram below illustrates how easily the suspected impostor was able to disseminate his requests for contacts. It shows only recent ‘active’ direct connections between AJE_Producer and twenty Twitter users and the recent active connections between those twenty users and their contacts. It does not show retweets nor does it reflect how many people may have simply read a message from AJE_Producer.

AJE Producer Twitter connections
AJE_Producer network

Although some of the connections are from people trying to challenge AJE_Producer’s methods there were a surprising number of people who took AJE_Producer at face value including some who actually appeared to be residing in Iran. Given the current level of violence in Iran this is alarming to say the least.

Expanding the network of connections one iteration further gives a somewhat rosier picture. The chart below shows AJE_Producer’s (center of chart) deception being overshadowed by a number of well connected Twitter users (top of chart) who appear to be trying to out AJE_Producer and other fake Iran election Tweeters.

AJE Producer tertiary connections
AJE_Producer extended network

Analysing the Twitter networks of other disinformation purveyors from Twitspam’s list highlights some developing tactics. Iransource and iransource45 are likely the same person. The content of the tweet streams is remarkably similar and composed mostly of overt propoganda. These two entities dominate the chart below because they send tweets directly to other Twitter users and reply to queries. Their relatively innocuous names may be an attempt to reassure potential followers. It is interesting to see the cluster of five anti-spammers trying to counter them.

Centrality view of Iranian Twitter disinformation network
Iranian Twitter disinformation network overview

If we take a closer look at the network on the bottom left we can see a different tactic developing. Ebrahim Ansari (AKA Persian_Guy) uses fake retweets to spread disinformation and confusion. Essentially he is putting his words in the mouths of other users, both real and imagined. The AhmediNej accounts are primarily used to retweet Ebrahim’s content, probably in an attempt to bypass users trying to block obvious proganda. They don’t have a lot of active connections, likely because the account names themselves are so obviously inflammatory.

Twitter disinformation closeup view
Close-up view showing AhmedNej and Ebrahim Ansari networks

For the moment it appears that activists in Iran have the edge when it comes to making use of Twitter to get their message out . However the propagandists are trying to close the gap. They hope to trap gullible users, spread disinformation, and create distrust.

If you want to counter them I suggest you go to Twitspam and block the those on the “
Obvious Disinfo” list. Certainly you should not retweet anything from these people.

Other Stuff

Subscribe to Patronus in a feedreader
Subscribe to Patronus Analytical RSS Feed by Email

Low on bandwidth? Try this low graphics version


Lijit Search

Bloggers' Rights at EFF Global Voices: The World is Talking, Are You Listening?



Support CC - 2007

Creative Commons License
This work by Kevin Toomer is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 2.5 Canada License.
Jun 2008
May 2008
Apr 2008
Mar 2008
Feb 2008
Jan 2008
Dec 2007
Nov 2007
Oct 2007
Sep 2007
Aug 2007
Jul 2007