MEK member Hassan Heyrani said that there were several thousand accounts managed by about 1,000-1,500 MEK members in Tirana. They posted pro-Rajavi and anti-Iran propaganda in English, Farsi and Arabic on Facebook, Twitter, Telegram, and newspaper comment sections with fake accounts (Merat, 2018). Marc Owen Jones, an academic who investigates political bots, found that thousands of suspicious accounts emerged in early 2016 located in Iran, and posting in support of Trump and the MEK. Most accounts tweeting the hashtags #FreeIran and #Iran_Regime_Change from December 2017 to May 2018 were created within a four-month window, suggesting automated activity (Merat, 2018). Table 1: Organizational Form and Prevalence of Social Media Manipulation in Iran Initial Government Politicians Private Civil Society Citizens & Report Agencies & Parties Contractors Organizations Influencers 2009 IRIB, IRGC MEK Media (IUVM, Liberty Front Press TV) – level of state coordination unknown Source: Authors’ evaluations based on data collected. Blank spaces indicate no evidence was found. Strategies, Tools, and Techniques Political Control Iran has made repeated attempts to control the free flow of information on the Internet. This has been seen in Internet crackdowns during moments of political significance, such as the blocking of Facebook and Twitter during the 2009 elections, and internet shutdowns and throttling in the aftermath of the 2009 and 2013 elections. Social media as a tool for political control came to public attention during the 2009 Green Movement protests, when the rich and active blogosphere—that had for a decade been indirectly political—became explicitly used as a political tool for mobilization against the regime. Social media was dominated by proopposition users and reformists who shared images of the Green Movement to the outside world. Iran began systematically monitoring social media activity to demobilise protests, and criminalised online activism in 2010, legislated through the Computer Crimes Law (Article 19, 2012). During the January 2018 protests, dozens of Twitter bots used tactics that ranged from calling widely shared videos of rallies fake to discouraging potential protestors from joining. Accounts were created by pro-regime users to guide protestors to the wrong locations and give the impression that the protests were on a small scale. One account posted in response to a video from a protest in Rasht, Gilan, “I just arrived here, there is nothing going on”. The exact same messages by the same accounts could be seen commented on many videos between 1 and 4 January. The hashtag most associated with the events, #nationwide_protests has been used more than 470,000 times, but an analysis shows a large number of posts in favour of the demonstrations originated from Saudi Arabia (BBC, 2018). Anti-regime protests broke out in November 2019 following a decision to triple the price of fuel overnight (Kadivar, 2019). This was met with a country-wide Internet shutdown, which some observers called the largest internet shutdown ever observed in Iran (Qiblawi, 2019). Communications apps such as WhatsApp, Telegram and Skype were unavailable—whilst Iranian messaging apps worked, many avoided them as they are controlled by state agencies or partly state-owned companies. According to former head of Iran’s Chamber of Commerce, 195