Capture the Flag

Iranian Operators Impersonate Anti-Netanyahu "Black Flag" Protesters, Amplify Iranian Narratives

On the night of November 5-6, Facebook announced that it had taken down a network of over 300 inauthentic Instagram accounts and a handful of Facebook assets that originated in Iran and targeted Israel, Saudi Arabia and the United States - all frequent targets of earlier Iranian operations. Many of the accounts impersonated activists from the so-called “Black Flag” protests in Israel. Facebook attributed the network to an Iranian IT company, EITRC. 

The fake accounts were created in batches and operated in separate phases of activity. In the first phase of the operation, in late 2019, they posted content in Arabic that criticized Saudi Arabia and then, from January 2020, the United States, following the killing of Iranian General Qasem Soleimani. Beginning in February 2020, the assets in this set criticized the Israeli government’s response to Covid-19. From July onwards, they posted in Hebrew about the “Black Flags” protest movement in Israel, supporting their campaign against Prime Minister Benjamin Netanyahu. 

Most of the operation’s accounts were thinly disguised fakes; one batch used profile pictures that were taken from Getty Images, with the Getty watermark still visible. The accounts do not appear to have gained a significant audience or to have spread to other platforms. 

The most remarkable feature about this operation was its kangaroo nature. Its targeting, including its use of language, jumped from attacking Saudi Arabia in late 2019, to defending Iran and focusing on Israel’s struggles to cope with Covid-19 in early 2020, to attacking Netanyahu and supporting the protests against him for the remainder of 2020. All have been the focus of Iranian influence operations at different times; the way this operation switched from one to the next showed the operators’ thematic flexibility, but also limited their ability to build an audience. Establishing a loyal audience for any operation, overt or covert, takes time. Switching country, topic and language every few months undermined this operation’s ability to build a persona.