Likely falsified Iranian Islamic Revolutionary Guard Corps document claiming to organize pro-Palestine protest circulates online
11 July 2024
Information operations aimed at influencing US voters or government policies have increased in significance since the 2016 US elections. These operations often involve online content, such as images generated with Artificial Intelligence (AI), disinformation campaigns, and falsified documents purporting to be from foreign governments. Unwitting influencers and outlets with large audiences have amplified these materials, garnering organic attention from individual users, increasing the potential for these users to be manipulated by false information.
A tactic called ‘hack and leak campaigns’ has been used ahead of other past major elections in order to influence public opinion by releasing “official” documents. One incident in April 2024 involving a purportedly “leaked” document reflects the role that falsified documents play in online information operations. The following case study reflects the potential for such tactics to be used in the context of upcoming US elections or other global events.
Summary of Incident
On 15 April, Vahid Beheshti – an Iranian opposition figure and self-described journalist based in London – posted an alleged “leaked top-secret letter” as proof that the Iranian Islamic Revolutionary Guard Corps (IRGC) was involved in organising and supporting the April pro-Palestinian A15 Action protests across US cities. After examining the claim, ISD assesses that the document is likely false (see below; figure 1). Regardless of the authenticity of the letter, or whether Beheshti was the victim of mis- or disinformation from his source, the incident serves as a useful case study on the impact potentially falsified documents can have. While the document had a relatively limited impact online, and it is unlikely it swayed public opinion, this incident reflects the potential ways in which state and non-state actors using falsified documents or media in information operations could target US audiences online.
Inconsistencies within the Document and Beheshti
In the initial post – and subsequent interviews – Beheshti never disclosed how he obtained the “top-secret letter,” raising suspicion about the provenance of such a sensitive document. ISD analysts were not able to identify any source beyond Beheshti’s post. Additionally, ISD and external experts[1] conducted an independent inspection of the letter which revealed multiple discrepancies with past documents that have been confirmed as originating from the IRGC. These included the use of English numerals, formatting deviations (e.g . signatures appearing in the center as opposed to on the left-hand side) and grammatical errors.
When the letter was shared, it was either by biased websites with reported ties to Saudi Arabia, or by websites that have previously disseminated conspiracy theories, false or misleading narratives, and/or propaganda. In general, these websites solely referred to Beheshti as their source and did not provide any additional insight into the letter’s authenticity.
Figure 1: Some of the inconsistencies in the alleged leaked IRGC letter are highlighted above (red boxes added by ISD).
Figure 2: A screenshot of Beheshti’s Instagram post.
Beheshti is known for public opposition to the Iranian regime and the IRGC. Prior to publishing the post featuring the letter, Beheshti attended anti-IRGC protests and set up an anti-IRGC campaign in the UK. He also sent multiple open letters to the British Prime Minister and Foreign Minister. Beheshti ends his X and Instagram posts with #IRGCterrorists. This hashtag trended on X on 16 April, a day after the widespread A15 Action protests, and may have contributed to ongoing pressure on the UK government to designate the IRGC as a terrorist organization.
Figure 3: A screenshot of Beheshti’s X post that ends with “IRGCterrorists.”
Online Reach and Circulation
Since the original post of the leaked document was first posted on April 15, it has garnered nearly 750,800 views on X and has been reposted over 1,000 times, according to the platform’s analytics. Beheshti also shared it on his Instagram profile, where the post received over 4,200 likes.
Despite this reach, the post was not promoted by high-reaching actors and did not make it to mainstream outlets. However, it was shared[2] on X and Telegram by users with a history of promoting anti-government conspiracy theories against the current US administration, as well as fringe outlets and websites that promote similar narratives, as noted in posts featuring the letter.
Figure 4: A screenshot of an X post by a senior editor at a news agency.
The letter also reached conspiratorial communities, as well as X accounts and Telegram channels previously known for manipulation of information and data. Fringe outlets such as Breitbart, Iran International and the Young America’s Foundation also shared the story on their websites to primarily US-based audiences. They received over 7,900 engagements collectively, according to the data from BuzzSumo that analyses media content, although the post was not discussed or cited by any mainstream press.
Figure 5: A screenshot of one of the conspiratorial Telegram channels that shared the alleged leaked document.
The spread of this letter through conspiracy communities shows how using a tactic of sharing falsified documents could be used to polarise and delegitimise protests or other political movements. In the US, some self-described policy experts and pro-Israel authors on X used the likely false document to push anti-government conspiracy theories that have gained traction in recent years. These include claims about illegal immigration in the US, or US funding of asymmetric warfare. On Breitbart, commenters used the allegations made within the document to discuss polarizing issues in the US such as immigration. One user wrote: “Identify as many non-citizen immigrants as possible in these protests and deport them forthwith. Sign the deportation order, put them in buses and haul their asses to the airport.” Others suggested that they believed the protests were funded by the current US administration.
Figure 5, 6, 7: Screenshots of the comments from the article about the IRGC document published by Breitbart.
Figure 8, 9, 10, 11 and 12: Screenshots of some of the most high-profile reposts of the alleged leaked document on X.
Implications & Conclusion
There was no extensive reporting about the likely falsified document by major news outlets in the US. As online conversation about the letter was confined to conspiratorial channels populated by individuals already likely to oppose pro-Palestine protestors, the wider impact appears to be limited. However, the conspiratorial or fringe sources which did engage with it legitimized the document to their audiences. This increased attention has the potential to heighten tensions around already divisive political topics such as pro-Palestine protests, and to revive or exacerbate conspiracy theories about the US government. Whether the information they share is verifiable information or not, the risk with incidents featuring “leaked documents” is that they can further fuel distrust in institutions which are typically believed to be responsible for making such information public.
Despite its limited success, this incident highlights how similar tactics could be deployed closer to the elections. A more successful information operation closer to the elections could cause major damage if it reaches and is legitimized by the mainstream media. This has the potential to further polarize society and sow distrust, especially in a year of important elections worldwide.
End notes
[1] The document was also reviewed by Sina Azodi, Professorial Lecturer at George Washington University’s Eliott School of International Affairs, and Arman Mahmoudian, Research Fellow at University of South Florida’s Global and National Security Institute.
[2] Individuals or groups that aim to delegitimize government institutions or government officials by amplifying conspiracy theories
