This is part of a series of investigative reports published in collaboration with Daraj media

Arabi Facts Hub 13.06.2023

In conjunction with threats from officials of the Revolutionary Guard to the Iraqi government to control Kurdish armed groups, a coordinated cyber campaign emerged within Iraq, amplifying the demand for better control of the borders with Iran. Scrutinizing the networks of accounts involved in this campaign, which aligned itself with the discourse of the Revolutionary Guard, revealed their affiliation with Iraqi militias loyal to Iran.

____________________________________________________________________________

Last May, the Iranian Revolutionary Guard issued threats to the Iraqi government, stating that it would resume targeting armed Kurdish groups in the Kurdistan region of Iraq if Baghdad did not commit to disarming these groups.

Iraq and Iran signed a security agreement on March 19, with the purpose of enhancing the security of the border region with Iraqi Kurdistan. Tehran perceives the region’s armed Kurdish opposition as a threat to its security.

But Iran remains dissatisfied. The commander of the Revolutionary Guard's ground forces, Mohammad Pakpour stated that "we are waiting for the Iraqi government to fulfill its commitments, and we have given it a chance. If nothing happens, the Iranian Revolutionary Guard's attacks on those sites will continue." In conjunction with statements from Revolutionary Guard officials, a coordinated cyber campaign has emerged, aligned with the same discourse, aiming to amplify the "border control" demand with Iran. Scrutiny of the network of accounts involved in the campaign revealed their affiliation with Iraqi militias loyal to Iran.

Trending in Kuwait: what happened?

Iran has been accustomed to launching missile strikes on sites in the autonomous Kurdistan region of Iraq, targeting Kurdish=Iranian groups that demand the establishment of an independent state or autonomous rule in Iranian territories. Tehran accuses the authorities in Iraqi Kurdistan of turning the region into a hub for the activities of the Israeli Mossad, using it to plan and carry out operations inside Iran.

In 2022, the issue of border security gained more attention when the Iranian Revolutionary Guard carried out missile attacks and launched drones to target Iranian Kurdish groups based in northern Iraq. Iran accused these groups of inciting the protests that erupted after the death of the Iranian Kurdish young woman, Mahsa Amini, in police custody.

With the recent threats from the Iranian Revolutionary Guard to Iraq, an Arabic hashtag supporting the tone of the threats emerged. Its main demand was enhanced control over the borders. The hashtag, #Our_demand_is_border_control, was prominently active, drawing over 16,000 tweets. It reached its peak on May 29th and 30th.

It is noteworthy that the hashtag topped the list of the most trending topics in Kuwait on May 30th. There is no definitive explanation for the appearance of the hashtag among the popular topics in Kuwait, but it is possible that the entity managing this cyber activity and the network of accounts participating in the campaign were in Kuwait.

An illustration of the periods of activity for the hashtag #Our_demand_is_border_control - Get Today Trends tool.

The Arabiya Al-Hadath Channel tour

Accounts participating in the campaign supplemented their tweets with images while using the same hashtag. The majority of these were snapshots from the footage of the "Al Arabiya Al-Hadath" channel in the camps of the armed Iranian Kurdish opposition near the borders with Iran.

The channel aired the report on February 1. its correspondents met with the military leaders of five Iranian Kurdish nationalist parties, led by the Iranian opposition Democratic Party of Iranian Kurdistan. The party's history extends back to the last century, and it seeks to establish self-rule for Kurds under in Iran.

There was never a Kurdish state. But the aspiration of establishing one emerged after the defeat of the Ottoman Empire in World War I in 1915. Kurds are spread across mountainous regions on the borders of Iran, Iraq, Syria, Turkey, and Armenia. There were two attempts to establish a Kurdish state. The first took place in 1926, when the short-lived Ararat Republic was founded in southern Turkey. The second, is the Republic of Mahabad that was established in western Iran in 1946. Each of these attempts lasted only a few months as well.

Repeated messages and quotation 

Tweets reflect a concerted effort to support the Iranian position by discussing the threats posed by Kurdish opposition groups to Tehran. In addition to demonizing these groups, the posts direct criticism towards the leaders of Iraqi Kurdistan, accusing them of turning the region into a "breeding ground for terrorists and criminals." Tweets including the hashtag repeated these messages. Different accounts used the same phrases and texts in their tweets.

Among these repeated texts: "Masoud [Barzani, former governor of the Kurdistan Region] made the north a safe haven for terrorists. Iran's security is Iraq's security, and the Iraqi government should listen to the voice of the Iraqi people demanding the expulsion of all terrorist elements. Masoud is using terrorists to push his deals. The Iraqi people are seeking complete stability, and this cannot be achieved with external terrorist groups."

Transnational network of fake accounts

Studying the accounts that participated in the campaign suggests that they are part of a network of fake accounts that are used to activate numerous political hashtags. Although these accounts carry Arabic names, which implies they may be operated by Iraqis, their activity extends to regional campaigns in Iran, Iraq, and Bahrain. This includes calling for #Cutting_ties_with_Jordan because it hosts the family and supporters of the former Iraqi president Saddam Hussein. These accounts also participated in supporting and amplifying Iranian hashtags in Persian language, expressing official Iranian positions through repetitive tweets.

Some of these accounts also participated in campaigns in Bahrain campaigns. The last of these is the recent #Bahrain_is_heartbroken campaign, which included tweets criticizing Saudi Arabia for executing two Bahrainis (Jaafar Muhammad Sultan and Sadiq Amin Thamir) in May, after being convicted of "joining a terrorist cell led by a wanted individual in the Kingdom of Bahrain, affiliated with a terrorist entity," according to the Saudi Interior Ministry. Numerous accounts, including accounts supportive of the Lebanese Hezbollah, tweet using this hashtag, as well as another, #No_to_execution, which propagates the same message.

Of the Iranian hashtags that were used by the accounts under investigation is #پيا_نكبت_حمالي.

For example, the account account @raftkhlyl5, named Raafat Khalil, participated in the wave of tweets using the hashtag #Our_demand_is_border_control, while being immersed in the promotional hashtag #پيا_نكبت_حمالي for the Iranian regime.

On the first hashtag, the account wrote, "Iran's security is Iraq's security, and the Iraqi government should listen to the voice of the Iraqi people demanding the expulsion of all terrorist elements."

In a mocking tone in one of his tweets on the second hashtag in Persian, he wrote: "Their attempt to overthrow the Iranian regime is artificial and an old trick."

These accounts first tweeted in October of last year. Their tweets included the Iranian hashtag #پيا_نكبت_حمالي. This indicates that a single network is directing the accounts towards organized and coordinated goals.

It is noteworthy that all campaign accounts were created in July 2022. They have a similar number of followers, which is slightly over 400.

It is also noteworthy that these accounts launched earlier campaigns that criticized both the authorities of Iraqi Kurdistan and the armed Iranian opposition groups that are active in the region. In these campaigns, they propagated several hashtags, attempting to present them as genuine expressions of Iraqi popular opinion, rather than slogans propagated by an orchestrated network of accounts. These hashtags include: #Expel_terrorists_from_our_North, #Kurdish_groups_threaten_our_land, and #Kurdish_opposition_is_terrorist. These hashtags were used in conjunction with the massive Iranian strikes in northern Iraq in November of last year, triggering negative Iraqi and regional reactions towards Iran.

At that time, the tweets posted under these hashtags included carefully crafted and appealing designs and graphics, conveying the desired message. They aimed to demonize the armed Iranian opposition and the Kurdistan Region of Iraq.

St. Lego... Supporting the Agenda of Iran-affiliated Iraqi Forces

The accounts involved in the campaign for border control played a prominent role in the propaganda machinery of pro-Iranian Shia forces in Iraq. They collaborated with other networks to promote their agenda and attack their adversaries.

These accounts appeared in hashtags targeting the leader of the Sadrist Shia movement, Muqtada al-Sadr. Al-Sadr is a political rival opposing the Iran-allied Coordination Framework Alliance, which leads the current Iraqi government. They supported the Alliance’s calls for amending the electoral law, a direct outcome of the influential protests in 2019.

Under pressure from the Framework's parties, the parliament passed the amended law, reverting Iraq to the "St. Lego" electoral system, which relies on a single electoral district for each province, eliminating the multi-district system that allowed independents and small parties to win more seats.

In the 2021 elections, the new electoral law allowed for 70 seats for independent deputies out of a total of 329.

In concurrence with the passage of the law last March, the same accounts were active with the hashtag #St_Lego_serves_the_people, attempting to portray the amendments as being in favor of the people. On the ground, people were protesting these changes in Baghdad and other cities, and independent lawmakers were expelled from sessions for opposing the amendments.

The accounts also participated in other campaigns, some of which called for expelling the American ambassador and US companies from Iraq, criticized Turkey, and targeted the Iraqi Parliament Speaker, Mohammed al-Halbousi. Hashtags such as #Ambassador_exceeds_her_mandate, #Central_Bank_is_held_hostage_by_US, #Electricity_occupation, #We_reject_Halbousi, #Sunni_strife_led_by_Halbousi, and #Turkey_is_thursting_us were regularly used. 

These accounts are intertwined with others that focus on promoting armed Shia factions, such as the Popular Mobilization Forces (PMF) and the Al-Nujaba Movement, which is classified as a terrorist organization in the United States.