Narrative Threat Report — NPOV

Wikipedia as Iran’s Information Battleground

The Islamic Republic of Iran is not only suppressing dissent in the physical world. It is shaping how that dissent is recorded, retrieved, and understood globally.

Iran information operations case study image

NPOV is a narrative intelligence platform that makes manipulation visible. We investigate coordinated campaigns shaping information at the infrastructure layer- tracking threat actors, mapping networks, and connecting narratives as they travel through Wikipedia, Reddit, AI systems, and the wider information environment.

Impact Assessment

The Islamic Republic of Iran is not only suppressing dissent in the physical world. It is shaping how that dissent is recorded, retrieved, and understood globally.

Wikipedia sits at the center of this effort because it defines the baseline from which media, search engines, and AI systems derive their understanding.

What is at stake is not simply narrative framing, but the integrity of the historical record itself.

Operational Snapshot

Penetration Metrics

  • 10,000+ state media images and videos uploaded to Wikimedia Commons within weeks
  • 29,000+ citations to Iranian state media embedded across Wikipedia
  • 8,400+ citations to Hamas, Hezbollah, and PIJ-affiliated outlets detected
  • 400+ sources used on core protest pages during active events

Editorial Control Metrics

  • 49,000+ edits by a single high-volume actor across ~16,000 pages
  • 16,000+ pages influenced by one editor alone
  • 11,000+ edits by Mhhossein across 2,228 pages
  • 217 edits on the Khamenei page by a single account (top contributor)
  • 71% authorship control achieved on key political articles

Key Actors (Editorial + Media Layer)

  • Iskandar323
  • 49,000+ edits across ~16,000 pages
  • Up to 71% authorship on key articles
  • Demonstrated ability to rewrite entire sections of high-sensitivity pages
  • Mhhossein
  • 11,000+ edits across 2,228 pages
  • 217 edits on the Khamenei page (top contributor)
  • Focus on: leadership biographies; 1988 mass executions; nuclear program
  • 999real (Wikimedia Commons)
  • >1,000,000 edits on Wikimedia Commons
  • <1,000 edits on Wikipedia itself
  • Central to mass ingestion of state-produced media
  • Rapidly became a top contributor to Iran-related visual content

Media Pipeline Saturation

  • >1,000,000 edits by a single Wikimedia Commons account (999real)
  • Content sourced from: IRGC-linked Tasnim News Agency (U.S.-sanctioned), Khamenei.ir (official Supreme Leader platform), Mehr News Agency (state-linked)
  • Search results for: "Iran protests 2026", "Khamenei"

-> dominated by state-produced visual content

Structural Manipulation Indicators

  • Persistent use of "abrasive deletion" to remove: named officials; legal findings; casualty context
  • Systematic exclusion of dissident sources via reliability challenges
  • Replacement with state-aligned or proxy-linked sources at scale

Institutional Interface

  • 2018 documented meeting between: Persian Wikipedia senior figures; Iranian Ministry of Culture and Islamic Guidance
  • Discussion included: control of politically sensitive content; alignment with state media as reference standard

Assessment Snapshot

  • AES-5: 5 (Operational adversarial activity)
  • NIS-5: 4 (Systemic impact across content, sourcing, and media layers)

Risk Assessment

Adversarial editing

AES-5 Scoring: 5/5 (Operational) - Sustained manipulation to shape public perception

Narrative Impact Score

NIS-5: 4/5 (Systemic impact) - Cross-layer influence embedded across content, sourcing and media

Risk Factors

Sanctions violation: Tasnim News Agency Citation

  • Tasnim is on the United States Department of Treasury's Specially Designated Nationals and Blocked Persons

Material support violation (US, EU, Canada, Israel)

  • Outlets linked to U.S.-designated foreign terror organizations (FTO) Hamas, Hezbollah, Palestinian Islamic Jihad (and others) are systematically cited on Wikipedia

Why Wikipedia Is the Primary Battleground

The strategic importance of Wikipedia lies in its position within the information stack.

Unlike social platforms, where content is transient and contested in real time, Wikipedia operates as a persistent reference layer. Its articles are continuously updated but rarely revisited by readers once stabilized. The result is that small changes-especially those made after public attention fades-become embedded as historical record.

This persistence is compounded by distribution. Wikipedia consistently ranks at or near the top of search results for political topics, including queries related to Iran's leadership, protests, and sanctions environment . The platform is also deeply integrated into downstream systems. AI models draw heavily from Wikipedia-derived content, meaning that distortions introduced at the source level are reproduced across AI-generated answers at scale .

The consequence is a form of information laundering. Material that originates in state propaganda outlets can be incorporated into Wikipedia, stripped of its origin through citation layering, and then redistributed through search engines, media reporting, and AI systems as neutral knowledge.

Control over Wikipedia therefore provides leverage not just over one platform, but over the entire downstream knowledge ecosystem.

Background

While Iranian authorities killed tens of thousands of civilians in 2025-2026, a simultaneous campaign unfolded on Wikipedia systematically erasing the evidence. NPOV has led the investigation into this operation since January 2026.

This activity intensified during the 2025-2026 protest crackdown, when Iranian authorities killed tens of thousands of civilians while simultaneously restricting internet access and limiting the ability of journalists to report from inside the country. In that same window, a parallel campaign unfolded across Wikipedia and Wikimedia Commons: protest-related content was reframed, visual media was flooded into the system at scale, and key historical records were systematically altered.

Core Findings: Structure and Scale of the Operation

Editorial Control Through High-Volume Actors

A small number of high-volume editors function as long-term narrative gatekeepers across Iran-related pages.

Mhhossein, has conducted more than 11,000 edits across 2,228 pages, with concentrated activity on politically sensitive entries including the biography of Ali Khamenei, the 1988 mass executions, and Iran's nuclear program. On the Khamenei page alone, this account has made 217 edits, more than any other contributor .

Iskandar323, has made over 49,000 edits across approximately 16,000 pages, with activity spanning more than a decade. This account has demonstrated the ability to reshape entire articles. In one instance, following the October 7 attacks, thousands of words describing human rights abuses were removed and replaced with a single paragraph. On another page, the editor authored 71 percent of the total content, effectively controlling the article's framing .

These are not isolated contributors. They operate within an ecosystem in which a small number of persistent editors can maintain 80-90 percent authorship control over specific articles, reverting opposing edits and shaping consensus through volume and endurance.

Systematic Content Degradation ("Abrasive Deletion")

The most consistent pattern across these edits is not the insertion of false information, but the removal of true information in ways that are difficult to detect in isolation.

This process, identified in NPOV reporting as "abrasive deletion," unfolds over multiple steps. A specific detail-such as the involvement of named officials in human rights abuses-is first removed. In subsequent edits, surrounding context is trimmed. Once the remaining fragment appears disconnected or insufficiently sourced, it is removed entirely.

This pattern is visible across multiple high-sensitivity topics. On the Wikipedia page for the 1988 mass executions, key details indicating that women and minors were among those killed extrajudicially were deleted. References linking specific officials to the executions were removed. Information about the 2022 conviction of Iranian official Hamid Nouri for war crimes in Sweden disappeared from related entries. References to a 2018 bombing plot in Albania attributed to Iranian operatives were similarly scrubbed .

The cumulative effect is not overt falsification but context collapse. Events remain visible, but stripped of scale, attribution, and legal significance.

Source Suppression and Replacement

A second mechanism operates at the level of sourcing.

Editors systematically challenge the reliability of dissident or regime-critical outlets, leading to their removal from articles. Once a source is excluded, the information it supports becomes ineligible for inclusion under Wikipedia's sourcing rules.

In parallel, state-linked outlets are introduced and normalized. Iranian government media-including Tasnim News Agency and other affiliated outlets-appear extensively across articles. Across Wikipedia as a whole, there are more than 29,000 citations to Iranian state media, alongside 8,400+ citations to proxy-linked outlets associated with Hamas, Hezbollah, and Palestinian Islamic Jihad .

This creates an asymmetry: regime-aligned narratives remain citable, while critical reporting is structurally excluded.

Media Saturation via Wikimedia Commons

While editorial manipulation shapes text, Wikimedia Commons shapes the visual layer of the narrative.

During the 2025-2026 protest period, more than 10,000 images and videos tied to Iranian state media were uploaded to Wikimedia Commons within weeks . These files were primarily sourced from:

  • Khamenei.ir (official Supreme Leader site)
  • Tasnim News Agency (IRGC-linked, U.S.-sanctioned)
  • Mehr News Agency

The upload pattern was highly concentrated. A single account, 999real, with fewer than 1,000 edits on Wikipedia itself, carried out over one million edits on Wikimedia Commons and rapidly became a top contributor to key Iran-related pages .

The effect on search visibility was immediate. Queries such as "Iran protests 2026" returned overwhelmingly state-produced content, with only a small number of non-regime images appearing in results.

These media assets are not neutral documentation. Their titles, framing, and content consistently depict protesters as violent actors while presenting pro-regime rallies as expressions of national unity. Once uploaded, they are licensed for reuse and embedded into Wikipedia articles across languages, shaping visual understanding of events at scale.

Institutional Interface with State Authorities

The relationship between Wikipedia contributors and the Iranian state is not limited to content patterns.

In 2018, senior figures from Persian Wikipedia participated in a recorded strategy session with Iran's Ministry of Culture and Islamic Guidance, the body responsible for media regulation and censorship. During this meeting, participants discussed how politically sensitive content should be handled and compared the authority of Wikipedia administrators to that of the ministry itself .

The ministry offered support, including assistance in establishing an institutional presence for Wikipedia contributors. While there is no public evidence that this offer resulted in formal integration, the meeting demonstrates a level of direct engagement between platform actors and state authorities.

Real-Time Narrative Pressure During Crisis Events

During the December 2025 protests, Wikipedia pages became active sites of contestation.

The page covering the 2025-2026 protests drew from more than 400 sources, with relatively distributed authorship in its early stages. However, the associated Talk Page reveals attempts to reshape framing in real time. Editors disputed casualty figures, challenged the reliability of critical outlets, and debated whether the term "regime" should be used at all .

Newly created accounts appeared to participate in these discussions, including one account created just hours earlier that challenged reporting from major international outlets before being deleted.

This phase is transient. Based on observed patterns, once public attention declines, the editing dynamic shifts from contested debate to post hoc historical revision.

Operational Timeline

The activity observed in 2025-2026 follows a recognizable sequence.

Initial groundwork is laid over years through the accumulation of high-volume editors and gradual alignment of sourcing practices. This is followed by periods of institutional interaction, including direct engagement with state-linked bodies.

During moments of crisis, such as the 2025 protest wave, editing activity intensifies. At the same time, media pipelines are activated, flooding Wikimedia Commons with state-produced content. This ensures that visual and textual narratives are shaped simultaneously.

In the aftermath, once external scrutiny diminishes, a slower process of revision takes place. Content is trimmed, sources are re-evaluated, and the record is stabilized in a form that reflects the cumulative effects of earlier interventions.

Reporting Timeline

January 2026

February 2025

Appendix — NPOV Scoring Framework

Adversarial Editor Score (AES-5)

Measures how adversarial an editor is in behavior and intent.

  • 0 - Neutral editing
  • 1 - Mild bias
  • 2 - Patterned bias
  • 3 - Persistent adversarial behavior
  • 4 - Highly adversarial, dominant editor
  • 5 - Operational actor shaping narratives at scale

Narrative Impact Score (NIS-5)

Measures the degree to which an operation alters the information ecosystem.

  • 0 - No impact
  • 1 - Minimal, localized impact
  • 2 - Fragmented impact across pages
  • 3 - Entrenched narrative influence
  • 4 - Systemic impact across content, sourcing, and media layers
  • 5 - Dominant control of the narrative environment

Interpretation

  • AES-5 evaluates actor behavior
  • NIS-5 evaluates system-level impact

Score Methodology Wording

Adversarial Editing Score — methodology text:

NPOV Adversarial Editing Scale (AES-5)

  • Neutral - Routine maintenance; no narrative impact
  • Biased - Selective framing or emphasis
  • Agenda-Driven - Repeated edits pushing a viewpoint
  • Coordinated - Patterned activity across pages and users
  • Operational - Sustained manipulation to shape public perception

Impact Score — methodology text:

NPOV Impact Scale (IS-5)

  • No Impact - Activity exists but produces no visible or durable effect
  • Minimal - Localized, low-level influence; easily reversible
  • Limited - Multi-point but fragmented; a user may encounter it but not consistently
  • Entrenched - Sustained narrative influence; a user is likely to encounter the influenced narrative
  • Systemic - Cross-layer influence embedded across content, sourcing and media; a user encounters the influenced narrative by default
  • Dominant - Full-spectrum narrative control; a user almost never encounters an unmanipulated version of reality