Authors: Alexander Lopez, Moo Sun Kim, Jinpeng Li
Introduction
On September 16 2022, 22-year-old Mahsa Amini, known to her Kurdish family and community as Jina, was pronounced dead at the Kasra Hospital in Tehran. Three days earlier she had been detained by morality police officers for violating public veiling laws before allegedly being beaten and falling into a coma. Within days, citizens gathered in the streets and in the city centers of Tehran and her hometown of Saqqez to protest. They demanded the officers and the government be held accountable for her wrongful death. These demonstrations were met with condemnation from the government, who suppressed the unrest by deploying anti-riot squads upon the protesters, resulting in over 234 deaths during the intense clashes.
The clashes are reverberating throughout the internet, reaching people and places far removed from Iran. Traditional news publications, personal blogs, and social media allow anyone with an internet connection to receive and to discuss the information that escapes Iran’s government censors and periodic internet service blackouts. Naturally, as the topic reaches a growing number of digital communities the discussions diversify. During this process the topic is reconstituted with emergent layers of meaning that reflect the unique perspectives of the communities. It follows that influencing these discussions is in the interest of the Iranian government. So, does the Iranian state media take measures to promote their own narratives in English-speaking digital ecosystems? And if so, how could we track it?
Our analysis shows that search engine optimization (SEO) signals demonstrate promise in detecting anomalies in information spread and can be easily analyzed through marketing software like Ahrefs.
We can evaluate a digital community and user’s faction leanings by looking at what websites they promote to audiences through the SEO backlinks signal. State actors are enticed to attempt foreign digital narrative control through disinformation as websites and social media platforms have low barriers to entry, relatively quick operation scalability, and easy division of labor for operatives.
A 2021 Facebook report found that Iran is the second-largest source of influence operation networks after Russia. While the report highlights Iranian influence operations that stem from state media agencies, sometimes governments use more inconspicuous techniques like hiding behind an active comment section user. Iranian government agencies have been known to fabricate fake accounts to engineer how people talk about certain issues, as well as using fake websites to “spin” an issue in favor of the Islamic Republic. As such, even an innocuous interaction between a user and an article author can reveal how Iranian state media is spread.
Enter “USER A”. We stumbled upon an article called “Iran’s Protests Over Compulsory Hijab and the Death of Mahsa Amini” while using the digital marketing software Ahrefs’ backlink features to read through the comment sections of blogs and news websites citing Iranian state media. Here, Scott Lucas, author of this article, and “USER A”, an anonymous user, were duking it out in a protracted argument below the article. From the 17th of September to the 29th of October, “USER A” commented 52 times, while Lucas responded to these comments 14 times- abnormally active engagement for the site’s average commenter. Even when Lucas chose not to respond with his own individual comment in the thread, he made his presence known by editing “USER A”’s comments with the heading “Editor’s Note” in square brackets.
One can be tempted by the strong Iranian state media viewpoint, odd insistence, and compulsive commenting to declare “USER A” an Iranian state information operative at first glance. But how would we begin to even really know?
“USER A” cites Iranian state media and is skeptical of foreign sources, especially Saudi-backed sources of news on Iran, which he cleverly quotes out of context. Similarly, the user does not trust cited social media that he did not find on his own. The user doubts the authenticity of the links Lucas and other anonymous users provide leading to fights in the comments. Another user, “USER B”, complains to Lucas about “USER A”’s actions and calls for the user’s ban from the site. However, Lucas refuses, finding “USER A”’s viewpoint a useful tool for breaking down what are essentially the views of the Iranian state media.
While the accompanying commentary paints “USER A” as a hardline Iranian regime supporter, they eventually find conflict with the information on the authenticity of Amini’s CT scans and concede : “I don’t know what to make of this case anymore.”
However, this was not the end of “USER A” abnormally pushing Iranian state narrative.
The suspicious user continues to comment on the website’s other various articles concerning Iran, also pushing the Iranian government’s protest narrative while clashing with Lucas and fellow commenters. His modus operandi remains the same – to present Iranian state media in a favorable fashion with distinct tactics of citing foreign media out of context. The user even breaks down an Amnesty International report to support Iranian state views. As of October 29th, 2022 “USER A” still remains active, combating Lucas and anonymous commenters alike with narratives used by Iranian state media.
Methodology
There may be tens, hundreds, or even thousands of potential state-sponsored sharers or sincere supporters commenting on the internet in a given day. How can we tell if a narrative push is a sponsored Iranian agent, just a commenter looking for personal satisfaction, a well tuned AI bot, or other?
The team input “USER A”’s cited links into the SEO software suite Ahrefs to track and to find the other places the narratives are being discussed and by whom. The plethora of data returned by Ahrefs can be overwhelming to analysts. The suite is built for digital marketers and thus records and measures numerous variables that contribute to a site’s Domain Rating – AKA the SEO signal that determines how high a website can rank on a Google search result page. Since Google remains secretive about their ranking process and many of the necessary SEO signals, the suite is tailored to provide transparent third party data collected by their crawler to help marketers adjust their websites and rise through the search engine ranks.
One tool offered that is useful to the “USER A” investigation is the Backlink Profile, an index of web pages that link to, or reference, the link that was run through Ahrefs. We can use the Backlink Profile index to find anomalies, to trace references, to find the narrative factions, and to investigate who else is linking to the exact same URLs.
We chose to focus on English content primarily due to our language ability restrictions. However, a secondary reason is that the English language can showcase a possible desire for the Iranian state media to incite sympathy or garner favor from foreign groups otherwise excluded from the state’s original Farsi push.
We focus on analyzing three links shared by “USER A” we found interesting. These links encapsulate the following positions held by the Iranian government:
- The protesters are protesting against the practice of veiling, the hijab, and more generally Islam
- The protests are destructive acts of terrorism that damage the physical infrastructure of the city centers and encourage violence against the authorities
- Foreign governments, primarily the American and the Israeli, are funding/ supporting the protests, which most Iranians do not endorse, to further anti-Iranian/ Kurdish separatist goals
- Amini’s death was caused by a complications stemming from either a brain tumor or heart disease, and it was not a result of physical harm
Ahrefs users can track relationships between various domains and subdomains with the URL’s Backlink Profile. The Backlink Profile lists the web pages that currently, or previously, link to the target site. Researchers can then perform a qualitative analysis of the results page to determine if the community agrees with, or even promulgates, Iranian state media. To make this tracking more accurate, we can remove uninteresting subdomains (like Wikipedia, which cites Iranian state media quite frequently) or limit the range to backlinks made only in the past 30 days.
Our team’s qualitative analysis began by defining the possible reactions regarding the Iranian state media’s narratives: Agree, Neutral (no opinion signaled), and Disagree. We applied these categories to three forms of online content publishing analyzed: News Publication/Blog, Forum, and Social Media Platform.
Profile of Sources
S1: “US manipulates Mahsa Amini’s death to incite ‘regime change’ in Iran”
This article maintains that the United States and other “Western” entities are distorting Mahsa Amini’s death for ulterior motives. It was published on September 25th in an English and French news agency owned by the Islamic Republic of Iran Broadcasting called the Viewpoint on presstv[.]ir. The author, Dr. Marwa Osman, cites CCTV footage showing a woman purported to be Amini collapsing during her mandatory veiling education courses to assert that her death was not directly linked to the alleged physical harm. However, the article primarily focuses upon the protests, which it characterizes as “deadly riots” where innocent citizens and police officers are murdered indiscriminately by “a handful of thugs working for Western agencies”. Moreover, she claims that military grade weapons were seized from demonstrators proving that the United States championed and encouraged this foreign conspiracy. Osman locates a double standard between the coverage of fatal police shootings in the United States, the coverage of the alleged police brutality in Amini’s case, and the fatal police shootings during the protests in Iran. This article contains strong elements of narratives B, C, and D.
S2: “Response to Mahsa Amini’s death: peaceful protests or Islamophobic riots”
This article was published on the 27th of September to the Viewpoint section of presstv[.]ir as well. It questions the sincerity of the outrage at Amini’s death, and asserts instead that the outrage is fabricated to facilitate attacks on the Islamic faith. The author, Omar Ahmed, supports this argument by citing the aforementioned CCTV footage of Amini’s alleged collapse, which demonstrates that her death was not caused by physical harm. Moreover, he claims that “Western” coverage is uninterested in reviewing the reports from the autopsy because they show Amini died of natural causes. The article labels the protests in Iran as violent acts of vandalism. During these acts of violence, religious images and structures are defaced, namely hijabs are burned; which demonstrates that the protesters are also attacking Islam rather than just police force or Iranian government. It also cites reports of “Iranian monarchists and communists” attacking an Arabaeen procession, Shi’a ceremony, in London. These attackers abroad as well as the protesters active in Iran are grouped together as “secular – opportunists” that are exploiting Amini’s death to carry out Islamophobic agendas. The article contains strong elements of all four narratives A, B, C, and D.
S3: “Twitter army and terror squads: Iran’s latest ‘revolution’ shows its true colors”
Published on the 29th of September to the Investigator section of presstv[.]ir, this article organizes Amini’s death and the subsequent unrest into five subsections: How it all started, Symbolism, Political Context, Who are the violent ones?, and The greater context. Julia Kassem, the author, provides in these subsections a highly developed and comprehensive narrative that positions the Iranian government as a target for a multitude of international conspiracies. She claims that the United States and Israeli governments helmed the collusion to exploit Amini’s death, which to her was cardiac arrest, in order to weaken Iran in preparation for renewed negotiation of the 2015 Iran nuclear deal. Kassem argues that anti-hijab and anti-Islamic Republic of Iran rhetoric are conflated to streamline Islamophobic campaigns in Western markets. This process is termed “manufactur[ing] consent”, and the goal is the destruction of both Iranian republic as well as the institution of Islam, according to Kassem. These campaigns are encouraged and facilitated by large tech companies, namely Twitter. She adds that military and financial offenses are also contributing to this process. The article references “troops of Baku”, an Israeli and Turkish-backed militant group, ISIS and Komala terrorist detachments, and Mossad agents provoking conflict along the Azerbaijan-Iran border in Northern Iran and at the protests, respectively. Financially, international sanctions continue to cripple the economy of Iran. Kassem states foreign spectators should decry the negative effects of sanctions upon the population of Iran, rather than the treatment of Amini and the protesters, if they are concerned about protecting human rights. This article contains strong elements of all four narratives A, B, C, and D.
S4: “Some rioters funded by foreign states, received cash every 15 minutes: Iran’s interior minister”
This article is a press release posted to the Politics section of presstv[.]ir on October 14, 2022 and copied onto numerous other sympathetic websites. It relates Iranian Interior Minister Ahmad Vahidi’s claims that among the demonstrators are detachments of “organized Zionist regimes” as well as other foreign trained agents that are financially compensated for inciting violence and “indulging in vandalism” at the protests. In these protests Vahidi reports dozens of lives have been lost. He also characterizes the “Western” news coverage of the case and protests as “replacing truth with untruth” by inundating the internet with a high volume of sensationalist disinformation. Additionally, he claims that among the 3.2 million university students in Iran only 18,000 participated in the most populated demonstration. This article does not explicitly agree with or disagree with the report put forward by Vahidi, but the report itself contains strong elements of narratives B and C.
S5: Status Update from Twitter Account of Seyed Mohammad Marandi
The status update retweets a video of a fire at a protest in Iran to the official account of Dr. Seyed Mohammad Marandi. Marandi is a professor specializing in English literature and North American studies at the University of Tehran. He is also regarded as an unofficial spokesperson for the Iranian government for English news services. “USER A” links to Marandi’s Twitter account twice, first to retweet the CCTV footage of Amini’s collapse on September 18th and again to the homepage on the 26th. Lucas also cites Marandi in the article as an appendage of the Iranian government seeking to assuage outrage over Amini’s death. The Twitter account is updated multiple times per day with original tweets as well as retweets that put forward all four narratives, among others. However, the tweet investigated for this case study is a status update from September 26th, 2022. Marandi’s update provides commentary over a low quality video that claims “Western media ” is encouraging violence and chaos in Iran. This status update contains strong elements of narrative B and C.
S6: “Huge crowds of people hold rallies in Tehran to denounce riots, acts of sacrilege”
This article was published on September 25th, 2022 to the Politics section of presstv[.]ir, and it was cited by “USER A” on the same day. It claims that millions of counter-protesters demonstrated support for the police force and called for the punishment of the “rioters” who took to the streets across cities in Iran. Embedded within the article are three videos of the counter-protesters filling the streets of Tehran holding Iranian flags, portraits of security personnel allegedly killed by rioters, as well as Qur’ans. Two videos also provide commentary that characterizes the “reality of Iran” as “overwhelmingly religious and overwhelmingly supportive of [the Islamic republic of Iran]”. The article also claims that rioters have burned mosques and Qur’ans, and forcibly removed the headscarves of innocent women. These rioters are labeled “a handful of mercenaries serving foreign enemies”. Source 4 is also cited to characterize the rioters as “rabble-rousers”; however, it does not reference the cash transactions reported by Minister Vahidi. The article ends with quotes from a neurosurgeon reporting that Amini had a brain tumor removed when she was eight years old. This article contains strong elements of narratives A, B, C, and D.
Analysis
The total number of English web pages that link back to our six sources is 48. Of these 48 web pages, 31 agree with the pro-Iranian state sources while 17 provided the links in a neutral capacity. The smallest category of web pages that remained neutral to the linked source is News Publication/ Personal Blog, which contains a backlink to 1 news page. Alternatively, the smallest category of web pages that agree with the sources is Social Media, which contains backlinks to 2 Twitter pages.
With double the amount of backlinks, the category neutral Forum/ Nofollow contains 4 backlinks to posts in forums that are not conclusively aligned or unaligned with the source as well as comments made by users unaffiliated with the host site. This is contrasted by the category Forum/ Nofollow backlinks that agree with the source. It contains nine backlinks to forums and commenters that conclusively align with the source.
The two largest categories of backlinks are News Publication /Personal Blog and Aggregator, with News Publication/Personal Blog linking to sources that agree with the source and Aggregator linking to mainly neutral content. There are 20 backlinks to articles and blog posts that agree with the source and 12 backlinks to news aggregator websites that do not conclusively align with the source.
These totals make evident the diverse range of information streams that traffic Iranian state media in English speaking spaces. Examining these trends can give insight into the users and the communities that are likely to either participate in or be targeted by Iranian influence operations. Separating the data by source we can examine the trends with more specificity, treating the tracked backlinks in-depth.
S1 contains 14 backlinks to English web pages in its Backlink Profile. Of these 14 web pages, seven agree and seven are neutral. Five of the backlinks that lead to agreeing users and communities are forum posts and comments (Forum/ Nofollow). All Iranian state affirming forums surveyed discuss an American conspiracy manufacturing the unrest. Most colorful among them, is the rooshvforum[.]com, which is the official discussion board of Daryush Valizadeh, an American pickup artist of Iranian descent who is described by the Southern Poverty Law center as a misogynist who advocates for predatory sexual behavior.[7] The original posters that shared the link to the articles explicitly endorse the pro-Iranian state narratives. The subsequent commenters largely express tacit confirmations of the plausibility of said narratives. In contrast, four neutral backlinks to forum posts and comments are discussed with cautious skepticism. The three news aggregator web pages also lack the colorful sentiments and dispositions found in the agreeing forums. However, the two backlinks to agreeing news publications and blogs expose positions against foreign collusion and intervention in Iran.
S2 differs from S1 due to the great disparity between agreeing and neutral backlinks. All 11 links, except one, actually link to an article from thecradle[.]com, an alternative news outlet, which asserts that the United States is conducting influence operations in Iran. The exception is the article itself that contains a backlink to S2; thus, the backlink is duplicated across the pages. Of the 11 total backlinks, nine agree. Seven of those in the agreeing category are news publications or personal blogs. These seven web pages promote a mixture of alternative news sources, anti-imperialist activism, and conspiracies of foreign interference in Iran. In fact, handsoffiran[.]com cites both S1 and S2.
Only one backlink from an agreeing forum post was found. It leads to a forum on Pakistan Defence (defence[.]pk) discussing conspiracies of American interference in Iran. The three neutral web pages either offer a disclaimer stating that the cited article from thecradle.com does not reflect the host pages views or they offer the article in conjunction with an aggregate collection of other related articles of inconclusive alignment.
S3, S4, and S5, on the other hand, all show an atypical opinion distribution. To reiterate, the pattern most commonly seen until now has been that backlinking domains that agree with the source outnumber the domains that were neutral. However, for S3, neutral backlinks outnumber the agreeing backlinks by 2 to 1. The irregular pattern is seen in S4, as there are the same number of agreeing and neutral backlinks- two. S5 is the outlier of these sources as it returns to the usual pattern seen in S1 and S2 with 4 agreeing backlinks. But, S5 had no neutral backlinks. The atypical results of these sources could be accounted for by the small sample size. The number of backlinks for other sources (S1, S2, and S6) was three times as large as the number seen in these “atypical” sources. Therefore, it wouldn’t be difficult for neutral backlinking domains to outnumber agreeing ones, given the small number of domains in general.
S6, returns to the pattern shown by other sources mentioned in this analysis. It has a higher number of backlinks that agree with the site compared to neutral backlinks. Of the 12 backlinking domains that link back to S6, nine of the backlinks lead to agreeing domains and three lead to neutral domains. Looking at both domain type and agreement, the same pattern from the total sample can be seen. The News Publications/ Personal Blogs have a majority agreeing backlinks with 8 out of 9 backlinks showing affirmation. These agreeing backlinks, interestingly enough, usually had the same anchor text which indicates a potential attempt to manipulate the SEO signals.
Limitations of Research
The above analysis shows that Ahrefs can be a powerful tool to track the spread of state media online and the validity of using SEO signals to detect information spread anomalies. However, this research is not without its limitations. One is its reliance on English-only domains. In data collection, we limited ourselves to analyzing only English-language backlinks, mainly because it is harder to discern the stance of domains in other languages that we are unfamiliar with. While this decision proved efficient and practical, we lost a number of interesting examples of backlinks, including an instance that showed the same backlink structure as S6. The link, when run through Ahrefs, showed that there were 6 different articles in Spanish that shared the same anchor text amongst themselves, originating from a site called olanoticias[.]com. Another two websites also shared anchor texts amongst themselves, but in Portuguese.
Another limitation is Ahrefs’ speed and ability to index all webpages on the internet. The Internet is large and must be constantly indexed or else Ahrefs will miss relevant websites. For example, the article titled “Iran: the revolution that never was” by the Lucas-alleged “anti-imperialist” author Asa Winstanley did not show up in our results despite it linking back to one of the sources we used. We believe this could be attributed to Winstanley’s site not being indexed yet by Google. Additionally, some links could appear and disappear on a whim when running Ahrefs. For example, for S1, the Reddit (and other “alternative interfaces” for Reddit) backlinks did not show up the first time we ran Ahrefs on that link. But, the second time we ran it, the links did show up.
A similar issue is with the way Ahrefs handles “alternative” interfaces of social media platforms, like Reddit or Twitter. Going back to the example of S1, even though the backlinks were from one subreddit, r/EndlessWar, the domains that linked back to S1 were split into three, with two instances of libreddit and one instance of teddit. These instances of Ahrefs referring to the same website in different domains may have artificially bolstered some of our results. While there were only 3 affected links out of a total of 48, these findings may mean that our data is not as externally reliable.
Conclusion
The SEO signals behind even a commonplace interaction on a relatively unknown blog can expose inauthentic information travel and state narrative pushes. While the persistence of “USER A” and Lucas’ tolerance of them may seem innocuous, albeit odd, the link structure uncovered shows how pro-Iranian state talking points often enter new conversations and expose foreign audiences to propaganda.
The results show that it is not users that mostly spread these pro-Iranian state narratives but instead individual blog posts and news outlets. The backlink findings show that the classic image of individual users sharing useful links and information for genuine conversation does not apply to the Iranian state media narratives. Instead, blog posts and news articles are the main drivers of Iranian pro-state conversations within our dataset. However, our team notes that these findings may have merely been a byproduct of sources of news selling their articles to other sources of news, or copycat posters.
These results show that blog posts and news outlets also spread state narratives, not just individual users on forums and comment sections. Not only that, but the number of links posted on blog and news outlets vastly outnumber those posted on comment sections and forums. SEO signal analysis can address both information streams, News Publications/ Personal Blogs as well as Forum/ Nofollow for a more comprehensive overview of the spread, especially when supplemented with qualitative analysis.
We find this research sample analysis shows promise in using marketing software like Ahrefs to track the scale and the spread of government narratives – especially for established media outlets like The Cradle or Sputnik News, content farms that sell the same articles to other outlets, and copycat posters. These tactics are inadvertently (or perhaps deliberately!) spreading narratives while also drawing in traffic to their community faction. Furthermore, this research also shows that sentiment mining could be used in tandem with backlink analysis to track narratives. While we used manual sentiment analysis in this exploration, future work on the issue could digest the source material through tokenization before employing either R or Python to run sentiment analysis packages.
Our exploratory case study was small. These 48 backlinks could only represent a fraction of the traffic linking back to Iranian state media. However, we believe the case study provides insight into the usefulness that SEO signals may have for disinformation research and attribution. It is our hope that this article inspires researchers to use new interdisciplinary angles to track how state media and content is being spread.
Moreover, it is our sincere hope that the case of Jina Mahsa Amini, the civil unrest, and the voices of Iranians are treated with respect and nuance in the form of more concerted and professional research endeavors. The Amini family continues to bravely vocalize their discontent with the government’s treatment of the case despite the risks related to civil disobedience in Iran.
If the government is truly misrepresenting the facts of the case, then the narratives analyzed in this study are dangerous and unjust as they distort reality and block the Aminis from attaining their deserved justice. The English-speaking digital ecosystems play pivotal roles in the transmission of Iranian perspectives as they offer an alternative avenue to representation separate from those overseen by the government. When deployed in conjunction with the aforementioned internet blackouts, inauthentic information serves to erase the voices of the Iranian people.
Websites Used as Data Sources:
(1) https://www.presstv.ir/Detail/2022/09/25/689825/US-manipulates-Mahsa-Amini-death-regime-change-Iran
(4) https://www.presstv.ir/Detail/2022/10/14/690918/Some-rioters-received-cash-every-15-minutes
(5) https://twitter.com/s_m_marandi/status/1574331112930873344
(6) https://www.presstv.ir/Detail/2022/09/25/689823/Iran-Tehran-rallies-riots-vandalism-sanctities-
