Revealing User Identities Under the Pretext of 'Kotlet'; Mahdi Sarmifar's Explanations on Security in Cyberspace

As the identification and exposure of Iranian users who write about 'kotlet' or share pictures of this dish on social media during the anniversary of Qassem Soleimani's death has become a threat to accounts with pseudonyms, Mahdi Sarmifar, a journalist and researcher in internet technologies, has provided recommendations regarding user safety in an interview with Voice of America. Recently, reports have emerged about threats and the exposure of private information of some users in cyberspace who use the term 'kotlet.' According to the Legal Advisors Group of Dadban, 'a number of users affiliated with the intelligence agencies' of the Islamic Republic are engaged in 'systematic exposure of user identities' and revealing images or private information attributed to those who have 'statements contrary to the imposed narrative of the regime regarding the Kerman explosions.' 'Kotlet' is the name of a dish and a term that opponents of the Islamic Republic attribute to Qassem Soleimani due to the manner of his death, using phrases like 'Qassem Kotlet' to refer to the former commander of the Islamic Revolutionary Guard Corps. According to some users, including Ali Karimi, a well-known sports figure opposing the Islamic Republic, kotlet has become a 'red line' for the regime. Regarding how users can protect themselves from being identified by government forces, Mahdi Sarmifar told Voice of America: 'Users should first refrain from providing any additional information to any application or internet service. Especially mobile users should pay attention to the permissions of any application they install and not allow any actions to other applications.' He added, 'Although security forces [at least in this case of pursuing users opposing Qassem Soleimani] find their targets from social media like Twitter (X), they use all available resources (even data from hacks like Tap30 and Snapp) to discover more details about user behavior. This issue includes writing text on X or posting images on Instagram that reveal the time, location, and identity of the individual.' Sarmifar also recommended: 'Always keep operating systems and antivirus software updated. However, be aware that since the Islamic Republic owns the infrastructure, using government-specific systems like Siam, Hemta, and Shamsa, and backdoor access to servers with orders issued by the Deputy of Cyber Space of the Attorney General's Office, they can focus on a specific target user and discover their identity. This requires a lot of resources and is not feasible for all users, but they can discover a prominent user that can also serve their propaganda apparatus.' This expert explained about the benefit of reporting government affiliates who seek to expose user identities, and also referred to the mushrooming growth of bots affiliated with the Islamic Republic's cyber forces on social media, stating: The cyber forces of the Islamic Republic have various definitions and classifications. A small group of them are regime-affiliated hackers, which cybersecurity companies' investigations show are divided into two main categories: those affiliated with the Ministry of Intelligence (Cotton Sandstorm) and those affiliated with the IRGC (Mint Sandstorm). Another group consists of security forces who investigate people's lives on social media. They have a dirty file, with the name Sattar Beheshti at the top. Sarmifar added, 'However, the vast majority of cyber forces are engaged in 'Jihad Tabyin' in virtual networks. After the success of the Cambridge Analytica operation in the 2016 US elections, methods for distributing misinformation and fake news in cyberspace were transferred to the Islamic Republic through the Russians. These methods are essentially digital versions and 2.0 of Soviet propaganda for implementation in cyberspace. The methods of countering them by users are generally referred to as media literacy.' According to Sarmifar, 'The Islamic Republic, which once dominated minds through the monopoly of radio, television, and press, now needs the 'user' in user-driven platforms to impose its discourse based on misinformation and fake news. These users have varying degrees, from those who produce keywords and give directions (whether openly on Twitter or more privately in Telegram channels) to users who like and share.' This network security expert emphasized: 'It should be noted that firstly, each user is not equivalent to each individual in the real world, secondly, this structure has been designed and implemented by the government and is supported by the material and logistical backing of the government.' He stated that this is 'the most significant effect of the mushrooming growth of bots affiliated with the Islamic Republic' and that 'they have both budget and the fatwa for Jihad Tabyin' and 'the most important operation that this cyber army has carried out, in my opinion, is fragmenting the opposition abroad.' Sarmifar emphasized that 'accurate reporting and numerous reports are definitely beneficial,' adding, 'No platform owner or business like Twitter (X) and Instagram wants their platform to become a bad and inappropriate space that users have no interest in being present in. Their income depends on users' enthusiasm for being in this space. Therefore, if Jihad Tabyin ultimately turns this environment into a dumpster, they will certainly take action against it.' He noted that 'Elon Musk and Zuckerberg are not exempt from this rule' and 'it should be noted that we are facing a coordinated and integrated structure from the Islamic Republic, so alongside collective reporting, this specific structure of repression, control, and surveillance of citizens, which has an explicit human rights role, should be clearly understood by platform owners, especially on the West Coast (West America). Managers and shareholders of companies like Meta, X, Google, and Telegram should be well aware of how the Islamic Republic uses the tools they have created for monitoring, identifying, and suppressing Iranians. This, in addition to reporting, requires lobbying in the information technology businesses. This is specifically the responsibility of the opposition organizations abroad, particularly those based in Washington.' Following the Kerman explosions that resulted in the deaths of over 100 attendees at the government ceremony commemorating Qassem Soleimani, cyber forces affiliated with the Islamic Republic have threatened to take legal action against users for writing about 'kotlet' or holding the Islamic Republic responsible for the Kerman explosions by publishing private information including names, workplaces, residences, educational backgrounds, phone numbers, and photos of some of these pseudonymous users. The Legal Advisors Group of Dadban stated that the aim of these actions by government cyber forces is 'to create terror and fear' and 'to maximize the atmosphere of repression in cyberspace,' emphasizing that 'mentioning the dish kotlet or presenting different narratives about the explosions is by no means a crime and has not been criminalized in any of the current criminal laws in Iran.' This human rights group emphasized that 'the exposure of citizens' private information on social media is a clear violation of citizens' privacy and is considered a crime,' advising citizens to 'use their real identities as little as possible for activities on social media' and to 'keep their personal information secure.' Meanwhile, some users have warned about the creation of a large number of bots with similar usernames on the social network X. In recent days, Iranian officials arrested a specialist doctor for posting a photo of kotlet, and last year, on the anniversary of Qassem Soleimani's death, a chef was arrested for teaching how to cook kotlet.