Mohessen Jalalpour, the five-day blackout cost the Iranian economy $1.5 billion (Kalbasi, 2019). Electoral Campaigning The presidential elections in May 2017, in which incumbent reformist President Hassan Rouhani was opposed by conservative Ebrahim Raeisi, saw attempts of manipulation by political forces. On Instagram, both reformist and conservative accounts produced a high volume of content, for example the pro-Rouhani account @nedayeeslahat appears to have been automated, posting fifty-two times between 13 and 17 May, including seven posts within forty seconds. Campaining occurred on Twitter during the 2016 parliamentary elections, as analysed in the report #IranVotes 2016, which found evidence of botnets and sock-puppet accounts (Marchant et al., 2016). Messaging Apps Telegram has forty million Iranian users (Sardarizadeh, 2019). Mahsa Alimardani, a researcher at the Oxford Internet Institute, said that “the regime has spent most of its time trying to manipulate or control the narrative on Telegram,” and that pro-Iranian government narratives have spread across Persian-language Telegram channels (Gallagher, 2020). Telegram was used in the 2017 presidential election, with both major campaigns deploying automated accounts to disseminate political messages (Freedom House, 2019). Conservative activists deployed a fake Rouhani bot with a very similar handle to the official account to spread anti-Rouhani content including cartoons, news from conservative news' agencies, Qur’anic citations and hadiths, and miscellaneous apolitical memes (Marchant et al., 2016). However, there is no indicator of the number of users or the impact of this account, and Telegram bots are distinct from the behaviour of Twitter bots. In December 2016, Iran’s Supreme Cyberspace Council announced that Iranian-owned Telegram channels with more than five thousand members must obtain a permit from the Ministry of Culture and Islamic Guidance (Center for Human Rights in Iran, 2017). Authorities moved to ban Telegram altogether in April 2018, and it has been subject to temporary blocks in response to protests in the past (BBC Monitoring, 2018). Pavel Durov, CEO of Telegram, wrote in a blog post that the company had complied with Iranian government requests to shut down Telegram channels that called for violence during the protests (Frenkel, 2018). Media Outlets Social media accounts amplify state-sponsored narratives that are disseminated by media outlets. For example, IRIB is directly involved in the dissemination of disinformation and propaganda (Nimmo, Eib, et al., 2020). Following the August 2018 takedown of Iranian statelinked accounts by Twitter, Ben Nimmo stated that whilst other nations’ operations engage people and use sophisticated messaging, the Iranian operation used social media to message people and amplify links to disinformation websites. While there was a high number of tweets, they were of limited impact as the accounts simply shared links to pro-Iranian websites rather than creating personas to engage with audiences (Leprince-Ringuet, 2018). Approximately a third of the one million Iranian tweets released by Twitter contained links to AWDnews.com, part of the network of sites exposed by FireEye. One inauthentic news website discovered by FireEye was ‘Liberty Front Press’ (www.libertyfrontpress.com) which publishes political news related to the USA (Figure 1). Liberty Front Press has also maintained social media accounts on Twitter, Facebook, Instagram, Google Plus and YouTube (FireEye, 2018). 196