ALL NEWS

Report links vast online disinformation campaign to Iran

May 14, 2019, 5:23 AM | Updated: 5:24 am
FILE - In this Oct. 26, 2018, file photo Ali AlAhmed poses for a photograph in his office in Washin...
FILE - In this Oct. 26, 2018, file photo Ali AlAhmed poses for a photograph in his office in Washington. Citizen Lab says a fake Twitter account unmasked by The Associated Press was but one piece of a vast years-old and multi-lingual campaign aimed at seeding anti-Saudi, anti-Israel and anti-American stories across the internet. The Associated Press was on the verge of publishing a story about how AlAhmed, who is based in the Washington area, had been targeted by hackers posing as a female journalist. (AP Photo/Alex Brandon, File)
(AP Photo/Alex Brandon, File)

LONDON (AP) — When an attractive young Middle Eastern woman contacted Saudi dissident Ali AlAhmed over Twitter last November, he was immediately suspicious.

The Associated Press was on the verge of publishing a story about how AlAhmed, who is based in the Washington area, had been targeted by hackers posing as a female journalist. Now, just two days before the article was set to go live, another young woman had sidled up to him over the internet, trying to entice him to read an article and share it online.

“They will never stop,” AlAhmed wrote in a Nov. 6 message to the AP. “They think a hot girl can lure me.”

The AP flagged the exchange to Canadian internet watchdog Citizen Lab, which was already helping AlAhmed deal with the hackers. Citizen Lab quickly determined that the Twitter account, purportedly belonging to an Egyptian writer named Mona A.Rahman , was part of a separate operation. In fact, she wasn’t even trying to hack AlAhmed — she was trying to enlist him in an ambitious global disinformation effort linked to Tehran.

In a report published Tuesday, Citizen Lab said A.Rahman was but a small piece of a years-old, multilingual campaign aimed at seeding anti-Saudi, anti-Israel and anti-American stories across the internet. Citizen Lab, which is based at the University of Toronto’s Munk School, said it believes “with moderate confidence” that the operation is aligned with Iran. The campaign is another indication of how online disinformation is being tested by countries well beyond Russia, whose interference into the 2016 U.S. presidential election was laid out in vivid detail in special prosecutor Robert Mueller’s report .

“What this shows is that more and more parties are entering the disinformation game,” said John Scott-Railton, a Citizen Lab researcher, “and they’re constantly learning.”

In London, Iranian Embassy press secretary Mohammad Mohammadi denied that his government had anything to do with digital disinformation, saying that Iran was “the biggest victim” of such campaigns and had called for international regulations to curb them. He referred further questions to the Iran’s Communications Ministry, whose deputy minister did not immediately return a message Tuesday.

Scott-Railton and his colleagues ended up identifying 135 fake articles that were published as part of the campaign, which they dubbed “Endless Mayfly” because, like the short-lived insect, the bogus stories tended to disappear soon after they began to spread.

The article A.Rahman was trying to get AlAhmed to share — a claim that Israel’s then-defense minister, Avigdor Lieberman, had been fired for being a Russian spy — was typical: The article had startling news, it was hosted on a fake version of a Harvard University website and had a host of spelling and grammatical mistakes. Articles shared by other fake personas followed a similar pattern. They made inflammatory claims about Israel, Saudi Arabia and the United States presented on lookalike versions of respected news sites.

“Ivanka Trump says its unbelievable that women cannot drive in saudi arabia,” said one article posted to a site dressed up to look Foreign Policy magazine. “Saudi Arabia funds the US Mexico border Wall,” said another, hosted on a site imitating The Atlantic.

The campaign seems to have been largely ineffectual — Scott-Railton noted that “most of their stories got almost no organic buzz” — but a couple did break through.

In March 2017 a fake Belgian newspaper article claiming that then-French presidential candidate Emmanuel Macron’s campaign was being one-third funded by Saudi money was widely shared in French ultra-nationalist circles, including by Marion Marechal, the granddaughter of French far-right leader Jean-Marie Le Pen. A few months later another site mimicking a Swiss publication tricked the Reuters news agency and other outlets into publishing a false report that Saudi Arabia had written a letter to FIFA, soccer’s governing body, demanding that archrival Qatar be barred from hosting the 2012 World Cup. The report was later withdrawn .

Citizen Lab said it first got wind of the suspected Iranian disinformation campaign when a British web developer debunked one of the fake articles on Reddit two years ago. The developer pointed out that the story — which suggested that British Prime Minister Theresa May was “dancing to the tune” of Saudi Arabia — had been published on a website using the URL “indepnedent,” imitating the legitimate British news site, The Independent, and was linked to a network of other suspicious sites, including “bloomberq,” a clone of the news agency Bloomberg. A third site, “daylisabah,” was a fake version of the Turkish publication Daily Sabah.

“Did we just get an insight into a fake news operation?” the developer asked at the time.

Citizen Lab confirmed his hunch, later connecting the sites to an incident in which another Twitter user, Bina Melamed, tried to persuade Israeli journalists to share the same fake Harvard article that AlAhmed received.

When one of the reporters privately confronted Melamed about why she was pushing nonsense, the answer was unusually straightforward.

“I like challenging and controversial stories,” Melamed said. “Sometimes they are fake and sometimes they are not.”

Outside experts who reviewed Citizen Lab’s report gave a qualified verdict. Both FireEye and ClearSky Cyber Security, U.S. and Israeli companies respectively, said they recognized elements of the digital infrastructure flagged by Citizen Lab from their own reporting, but ClearSky researcher Ohad Zaidenberg said he wanted to see more evidence before attributing the social media personas to Iran.

Speaking generally, he said the apparent clumsiness of the online disinformation should not be a reason to dismiss it.

“It gets better each day,” he said.

Most of the personas mentioned in Citizen Lab’s report — such as A.Rahman and Melamed — have been suspended. Messages left with a handful of surviving accounts — sent via Twitter and Reddit — elicited no response. Emails sent to half a dozen addresses used to register several bogus websites — including bloomberq, daylisabah, foriegnpolicy, theatlatnic and indepnedent — either weren’t returned or bounced back as undeliverable.

AlAhmed said he was intrigued to hear that A.Rahman had been tied to the Iranian government. Despite knowing from the start that the whole thing was a charade, AlAhmed struck a wistful note in a recent interview about his interactions with the attractive-looking A.Rahman. At one point, she had written to him inviting him to stay at an apartment she claimed to have in London.

“A small part of me thought, ‘I hope this is real,'” AlAhmed said.

He quickly made clear that he was kidding.

“I told my wife,” he said.

___

Online:

Citizen Lab’s report: https://citizenlab.ca/2019/05/burned-after-reading-endless-mayflys-ephemeral-disinformation-campaign

___

Raphael Satter can be reached at: https://raphaelsatter.com

We want to hear from you.

Have a story idea or tip? Send it to the KSL NewsRadio team here.

Today’s Top Stories

All News

Police arrested a man in Washington County on suspicion of human trafficking a child on Thursday. ...
HUGO RIKARD-BELL, MARK JACKSON

UHP arrests man suspected of trafficking New England teen

Court documents show that the UHP pulled over Tevon Jarrell Cullors-Tillman after his car was spotted driving erratically.
10 hours ago
Follow @SimoneSeikaly...
Simone Seikaly

Elk herd again on the move near Foothill Drive and Parley’s Canyon

Drivers near Foothill Drive and Parley's Canyon were warned to remain vigilant as officials worked to move the herd.
10 hours ago
A high altitude balloon floats over Billings, Mont., on Wednesday, Feb. 1, 2023. The U.S. is tracki...
Oren Liebermann, Haley Britzky and Michael Conte, CNN

Pentagon tracking suspected Chinese spy balloon over the US

(CNN) — The US is tracking a suspected Chinese high-altitude surveillance balloon over the continental United States, defense officials said on Thursday, a discovery that risks adding further strain to tense US-China relations. Pentagon spokesman Brig. Gen. Patrick Ryder said the US government has been tracking the balloon for several days as it made its way over […]
10 hours ago
quit their jobs...
PAUL WISEMAN AP Economics Writer

US added a strong 517,000 jobs in January despite Fed hikes

The Fed is aiming to achieve a "soft landing" — a pullback in the economy that is enough to tame high inflation without triggering recession.
10 hours ago
A federal law that prohibits people subject to domestic violence restraining orders from possessing...
Tierney Sneed, CNN

Court says gun law targeting domestic violence suspects is unconstitutional

 (CNN) — A federal law that prohibits people subject to domestic violence restraining orders from possessing firearms is unconstitutional, a conservative-leaning appeals court ruled Thursday. The ruling is the latest significant decision dismantling a gun restriction in the wake of the Supreme Court’s expansion of Second Amendment rights last year in the New York State Rifle & Pistol Association, Inc. […]
10 hours ago
Mountain America Credit Union will pick 
 up the tab for the adoption of all larger dogs this weeke...
Mark Jackson

Credit union will pay for larger dog adoptions this weekend

Mountain America Credit Union will pick up the fees for the larger dog adoption from Friday, Feb. 3 through Sunday, Feb. 5.
10 hours ago

Sponsored Articles

Banner with Cervical Cancer Awareness Realistic Ribbon...
Intermountain Health

Five Common Causes of Cervical Cancer – and What You Can Do to Lower Your Risk

January is National Cervical Cancer Awareness month and cancer experts at Intermountain Health are working to educate women about cervical cancer, the tests that can warn women about potential cancer, and the importance of vaccination.
Kid holding a cisco fish at winterfest...
Bear Lake Convention and Visitors Bureau

Get Ready for Fun at the 2023 Bear Lake Monster Winterfest

The Bear Lake Monster Winterfest is an annual weekend event jam-packed full of fun activities the whole family can enjoy. This year the event will be held from January 27-29 at the Utah Bear Lake State Park Marina and Sunrise Resort and Event Center in Garden City, Utah. 
happy friends with sparklers at christmas dinner...
Macey's

15 Easy Christmas Dinner Ideas

We’ve scoured the web for you and narrowed down a few of our favorite Christmas dinner ideas to make your planning easy. Choose from the dishes we’ve highlighted to plan your meal or start brainstorming your own meal plan a couple of weeks before to make sure you have time to shop and prepare.
Spicy Homemade Loaded Taters Tots...
Macey's

5 Game Day Snacks for the Whole Family (with recipes!)

Try these game day snacks to make watching football at home with your family feel like a special occasion. 
Happy joyful smiling casual satisfied woman learning and communicates in sign language online using...
Sorenson

The Best Tools for Deaf and Hard-of-Hearing Workplace Success

Here are some of the best resources to make your workplace work better for Deaf and hard-of-hearing employees.
Team supporters celebrating at a tailgate party...
Macey's

8 Delicious Tailgate Foods That Require Zero Prep Work

In a hurry? These 8 tailgate foods take zero prep work, so you can fuel up and get back to what matters most: getting hyped for your favorite
Report links vast online disinformation campaign to Iran