On the 13th of November, the Iranian news organisation Mizan News reported that a court in Tehran found a participant in the current protests against the regime was guilty of “moharebeh”, meaning “enmity against God”. The judgement led to the first sentence to death for an individual involved in the ongoing riots (tragically, more convictions came in the following days).
The charges followed the setting of fire to a government facility. They also included disturbing public order, conspiring to commit a crime against national security, and “efsad fil-arz” (“corruption on earth”), which carries the death penalty in Iran’s Sharia-based legal system.
The policy of the authorities is clear. The judiciary chief Gholamhossein Mohseni Ejei declared “key perpetrators” should be identified and sentenced, aiming to reach a deterrent effect on others.
In this framework, just after the first unrest in September, a Telegram channel appeared online and immediately disappeared: @setad114channel. It requested users to provide information about the people participating in the protests. Its story and the associated consequences reveal more about the Islamic Republic’s repression.
Setade114, a cyber investigation
Summary of contents
The Telegram channel and the IRGC
On the 22nd of September, @azizamtara tweeted that the Telegram channel @setade114 was “posting uncensored pictures and videos of protestors to identify them and have them arrested”.
PLEASE REPORT!! There’s 2 channels on Telegram, @setade114 & @setade114ir that are posting uncensored pictures and videos of protestors in order to identify them and have them arrested. #IranProtests #MahsaAmini #مهسا_امینی pic.twitter.com/M4G4S1FAlT
— Tara | تارا (@azizamtara) September 22, 2022
The demonstrations against the country’s clerical establishment erupted a few days earlier, after the 16-September death in custody of Mahsa Amini, a 22-year-old woman detained by the police for allegedly breaking the strict hijab rules.
Only a few trusted the official version claiming the natural death of the girl. The event awakened the feelings of many people (in Iran and abroad), including young women, that are challenging the authoritarian regime of Tehran.
The Islamic Revolutionary Guard Corps (IRGC) immediately intervened to crush the protests. IRGC is an Armed Forces branch founded after the Iranian Revolution in 1979. These Guards are intended to protect the political system, preventing foreign interference and coups by the military or other “movements”.
On the 23rd of September, Twitter user @mollaee_saeed shared the names of the Telegram account @setade114 and the related @setad114channel, linking them to the IRGC. Saeed’s tweet is still visible with Way Back Machine, a digital archive allowing visitors to go “back in time” and see how webpages looked in the past. Yet, the account @mollaee_saeed is no longer on Twitter.
Indeed, for the IRGC, social networks could be a way to set control over the widespread or unmonitored riots. Not surprisingly, they could have decided to reach out to people on Telegram. Mahsa Alimardani, a researcher and activist, based at Oxford University, told the website Atalayar, “Telegram is the third most used and second most important social networking app in Iran”. @setade114 had a predictable resonance.
TGStat, inside the channel
Both accounts @setade114 and @setad114channel also were on Twitter. They have been suspended on this platform for violating social media rules. Neither on Telegram, they aren’t visible anymore, and the usernames result in “not found”.
Yet, a tool could help recover their past activities. TGStat is a Telegram channel and group catalogue. You type an account name, and the website returns its statistics and activities.
Querying for @setad114channel, you can get its profile. The user’s description stated: “We deal decisively with those who disrupt the peace and order of the society. Link: @setade114”. According to TGStat, the channel was created on the 22nd of September, and it had the time to publish 11 posts before its disappearance. The catalogue shows 8 of them.
The posts
The posts were in Persian (Google Translate helps understand their meaning). Along with the texts, two of them contained videos, and four of them reported images. The multimedia contents are not visible on TGStat. But the words do.
The last post
The reported last post was published on the 22nd of September at 22:55. Originally, it contained a 1:46-minute video, but the clip is now “unavailable for watching”.
The text informed the readers of an arrest: “With the cooperation of people and intelligence measures, one of the vandals of Kerman’s public property was identified and arrested in less than 24 hours by the anonymous soldiers of Imam Zaman in the IRGC Intelligence Organization“. Indeed, the IRGC was distinctly mentioned.
The four posts series
Previously, at 21:34, the channel published four posts in a series, with images (now not visible) presumably showing individuals.
The text for all of them was the same: “Defendant number one. If you know this accused who played the role of a leader in the riots and you have information about him, send it to us via @setade114″. In the series, the four posts changed only the number of the defendants (and probably the images): “Number One” in the first post, “Two”, “Three”, and “Four”, respectively, in the following ones.
The vandals
At 21:19, another post had been published. “With the cooperation of people and intelligence measures,” the text read, “one of the vandals of Isfahan’s public property was identified and arrested in less than 6 hours by the anonymous soldiers of Imam Zaman in the IRGC Intelligence Organization”. Again the IRGC was mentioned. As before, the arrested was considered a “vandal”.
The channel mission
A few hours before, at 15:34, in a previous announcement, the channel had explained its mission. “We are living in the days when the enemy is targeting our unity”, the statement asserted, “and we are witnessing the maximum and destructive efforts of hypocrites, terrorist and anti-revolutionary groups in the virtual and media space of the country“.
“The enemy, with ISIS-like behaviour, has no other purpose than disrupting the security of the society, and to achieve this sinister goal, they use every tactic, even terrorist actions and hitting people’s property, lives, and honour, creating unrest and dissatisfaction,” the post continued. Finally, a call to action: “Therefore, all users are requested to send us any news and information, including photos, videos, personal details, etc., of the troublemakers”.
The First Post
The first post of this channel was published minutes earlier, at 15:29, with a few words opening the account activities: “in the name of God”.
The disappearance
Active for only 8 hours, this channel reached tens of thousands of users. But it has been immediately blamed for its methods by many, including the activist Nima Fatemi.
Iranian authorities have created a snitch line on telegram to identify and harm protestors. And while this has been reported to @telegram, the channel and account remains active with +10k subs.
This has been reported. No action has been taken. Real harm is being done#مهسا_امینی pic.twitter.com/pDSCeehTpX
— Nima Fatemi (@mrphs) September 22, 2022
On the 23rd of September, a message from the Telegram channel @emmawatson (unofficial Iranian profile of the British actress and activist) stated: “Telegram blocked and removed the channel of the Ministry of Information of Iran due to infringement of the platform rules! Also, the management and the admins completely deleted their accounts: @setade114 @setad114channel. This channel was removed due to violation of privacy laws and publication of pictures of protesters“.
However, throwing the rock in the pond had immediate effects.
The imitators
As of the 21st of November, a search for “setad114” on Telegram showcases a lot of channels with tiny name differences and similar profile pictures or descriptions.
Many replicate the same logo as the deleted @setade114 account. Among them are @channel_setad114, @setad114chanelllll, and @setad114s. Others have the Iranian flag as a profile picture. But one of them stands out for the profile image of a man wearing a moustache and a uniform: @setad114channell (with an ending double “l”). Should this channel be worrying?
Telemetr.io, the profile statistics
Telemetr.io is another analytics tool for Telegram. If you query a profile, the service returns all the statistics, the history of the channel, and the mentions by other users. Searching for @setad114channell, there are two mentions: one from @werner_selection (dated the 23rd of September) and one from @sniffffi (dated the 24th of September). Both shared concerns because the account allegedly spied on the protesters.
The actor Farhad Aslani
But who is the person in that profile picture? Google Reverse Image is a search tool that displays the origin of an image on the web. Querying for the @setad114channell photo and its source, you can discover it doesn’t relate to the police, secret services, or politics. The image comes from the Facebook fan page of the Iranian actor Farhad Aslani, shot while recording the “Shahgoosh” tv series, where he played a relevant character.
Indeed, the channel seems unauthentic. Certainly, it was created on the 28th of December, 2021. Telemetr.io allows you to view its history. The account avatar changed several times, and it acquired the Aslani picture only on the 23rd of September.
The name of the channel
Also, the name of the channel changed. On the 3rd of January 2022, it was: the “Night Blue Nissan series” (the title of another Iranian series). It changed to the “Blue Nissan Jeeran series” in February. On the 22nd of April, it swapped to the “Open book program”. Finally, on the 23rd of September, it has become “Setade114”.
The account is not so active, despite over 33,000 subscribers. Among its recent messages, one appears relevant.
On the 22nd of September, @setade114channell posted a screenshot of a tweet by @alikarimi_ak8. “Never mind the banks. Don’t do anything to women in chador and hijab; anything to the Quran, the holy book; anything to those who are not with you in these protests. Whoever entered the above matters, do not go with them. These are part of their plans for you, my dear people”.
به بانکها کاری نداشته باشید،
به زنان چادری و با حجاب کاری نداشته باشید،
به قرآن کتاب آسمانی کاری نداشته باشید،
به کسانی که همراه شما در این اعتراضات نیستن کاری نداشته باشید.
هر کسی به موارد بالا ورود کرد با وی همراه نشوید که اینها گوشهای از نقشههایشان برای شما مردم عزیزم است— ali karimi (@alikarimi_ak8) September 22, 2022
The Intelligence Control
The situation is concerning. Authorities don’t seem to tolerate any interferences to their policies. Still, citizens are requesting a change in the attitude of the Republic toward people. Many are even pressing for an ultimate revolution to substitute a liberticidal regime.
The role of online networks is ambivalent. On one side, they became a means for inspiring and activating individuals. On the other hand, “social media attacks can also serve as a precursor” to retaliation, as written by the Columbia Journalism Review contributor Pesha Magid.
Following the disorders, impersonators, imitators, and pretending-to-be agents also are spreading on the net. This trend is increasing. On the 26th of October, Telegram even launched an auction for rare names. “This will enable handles, comprising both usernames and channels, to be bought and sold”, a press release explained. It is possibly adding to the confusion.
Detecting fake identities is a looming challenge for protesters and ordinary people. Different users are all but the same.