SPECIAL REPORT: ONLINE SITE THAT PAYS AMERICANS TO WRITE ARTICLES ORIGINATES IN IRAN

Sat 25 January 2020:

Although American Herald Tribune claims that it is a “genuinely independent online media outlet” paying Americans to write articles, multiple investigations by U.S. technology companies “point to “the site originating in Iran,” according to a CNN Business report on Friday.

A Facebook investigation into the site’s page on the social-media network found it linked to Iranian state media and removed it in 2018, a Facebook spokesperson told CNN Business.

Cybersecurity company FireEye determined with “moderate confidence” that the site originates in Iran and is part of a larger online influence campaign.

According to the report, “The articles on American Herald Tribune are largely in line with the views of Iran’s ruling establishment. It publishes stories criticizing American foreign policy and attacking [U.S.] President Donald Trump and Israel. Often, the criticism is not unlike viewpoints expressed on authentic U.S.-based independent websites, especially ones with an anti-establishment perspective.”

One of its most viral articles was published during the U.S. presidential election cycle in 2016 and made unfounded assertions about then-candidate Donald Trump’s father belonging to the Ku Klux Klan.

The author behind that article, Tim King, told CNN Business that Iran is “misunderstood” in the United States.

The sophistication described by these companies calls to mind recent US government warnings about Tehran’s capabilities in cyberspace in light of the killing of top Iranian general Qasem Soleimani in a US drone strike. Some US officials have raised concerns about a conventional cyber attack that could impact US infrastructure, but this type of information and influence campaign could represent another aspect of Iran’s cyber efforts, this one with the potential to impact US political discourse.

Google told CNN Business that it took down Gmail and Google ad accounts tied to American Herald Tribune, and Twitter removed American Herald Tribune’s account this month after being contacted by CNN Business.

In August 2018, Facebook shut down a network of 652 pages, groups, and accounts posing as independent organizations which were, it said, in fact linked to Iran state-backed media.

Independent researcher and social media sleuth Josh Russell publicly posted on Twitter in 2018 further evidence supporting American Herald Tribune’s alleged links to Iran. Even after the takedowns on Facebook and Google, the website remained active and ran a Twitter account.

Twitter removed American Herald Tribune’s account this month after the company was contacted by CNN Business. Twitter would not provide any information on where the account was run from, but said it was investigating.

An unsubstantiated story by the American Herald Tribune in 2015 was published under the headline, “Trump’s grandfather was a pimp and tax evader; his father a member of the KKK.” The story continues to circulate online.

The story’s byline belongs not to an Iranian, but to an American man who lives in Salem, Oregon.

That man, Tim King, a writer who has had, according to his social media profiles, a long career in media, told CNN Business he couldn’t recall how he first began working with American Herald Tribune. The people who run the website paid him a couple of hundred dollars for the article, he said.

King’s KKK story has, since it was first published, been fact-checked by Facebook’s fact-checking partners and people sharing it on Facebook are warned that the story is false.

King is a critic of American foreign policy and US ally Saudi Arabia. He says that Iran is “misunderstood” in the US.

“I’m always glad to find a website that’s willing to, you know, publish stories about Palestine and Israel and different subjects like that, that are so fully taboo here in the United States,” King said of his involvement with American Herald Tribune.

Although King said he has knowingly worked with Iranian media in the past, he said he doesn’t think American Herald Tribune is run by Iran. Instead he believes it is run by a man named “Sam” who lives in Brazil.When American Herald Tribune came online in 2015, website records show that it was registered under King’s name. But false names and identities can easily be used to register websites and King denied setting up or registering the website.

Whoever set up American Herald Tribune, it seems, may have also used King’s and Roberts’ identity in an attempt to cover their tracks.

False impression of legitimacy

While American Herald Tribune pays some contributors like King for original content, it also republishes articles from elsewhere and then lists the people who wrote those articles as contributors to its site.

The practice gives the false impression that a long list of Americans, including some prominent public figures, write directly for the website.

American Herald Tribune’s administrators did not respond to multiple requests for comment from CNN Business.

American Herald Tribune’s complicated origin story, and people involved with the project not knowing for sure who is behind it, fits into a broader trend of online foreign interference seen in the US in recent years. It will be familiar to those who followed Russian interference in the 2016 US presidential election.

Using fake websites and fake activist groups, Russian operatives targeted and co-opted often unwitting Americans to contribute to their disinformation campaigns online and offline. Those real Americans were used to shield the origins of the campaigns and lend them legitimacy.

Empire of fake news and Citizen Lab research

Last year in May, 2019 Researchers uncovered a vast disinformation network which they say is being backed by Iran. The Canadian Citizen Lab research group, which is part of the University of Toronto, in a report published Tuesday claimed that Iran is behind the programme, which it dubbed Endless Mayfly.

The trolls created 72 lookalike domains, and 153 fake news articles, with one fake article designed to look like a Bloomberg report suggesting that the CIA would award Saudi Arabia’s crown prince with a “medal of honour.”

Citizen Lab said that a the people behind the posts also made fake social media profiles to spread the posts, some of which went as far as sending messages to journalists and activists whom they hoped would repost the material, lending it legitimacy.

Fake articles contained made-up quotations from a US senator alleging Saudi complicity in terrorism. Articles also claimed that Saudi Arabia was funding Trump’s wall on the US-Mexican border and tried to stir tension among Arab Gulf states.

Once an article was pushed out by fake social media profiles and received a certain degree of “amplification” by being retweeted and shared online, the link to the fake website was deleted, Citizen Lab said. It would then be replaced by a link to the legitimate site of the website imitated.

The report found that the disinformation has close links to a republishing network found by previous investigations to be an “Iranian government-backed disinformation operation.”

The Iranian embassy in London told the Associated Press it had nothing to do with the disinformation campaign. It said instead that it was “the biggest victim” of disinformation campaigns, and backed international regulation to curb them.

“Our investigation identifies cases where Endless Mayfly content led to incorrect media reporting and caused confusion among journalists, and accusations of intentional wrongdoing,” say the researchers.

“Even in cases where stories were later debunked, confusion remained about the intentions and origins behind the stories.”

The stories concerned fall into three main categories. More than half aim to stir up doscord between Saudi Arabie and its neighbours and allies, including the United Arab Emirates, Qatar, France, the United Kingdom and the United States.

Some imply that Israel and Saudi Arabia are in cahoots, and others that Saudi Arabia is involved in terrorism. In at least three cases, fake articles were picked up by the mainstream news.

“Based on the evidence gathered from our investigation, we conclude with moderate confidence that Iran or an Iran-aligned actor operating the Endless Mayfly network systematically attempted to influence global perceptions, presumably to achieve geopolitical outcomes, using a stream of false and misleading content,” say the authors.

“The campaign was neither strikingly clever nor particularly sensitive to the culture of the intended audience. However, it eluded blocking and detection for years, generated some social media engagement, and achieved a few successful cross-overs into mainstream news.”

How it works

The Citizen Lab at University of Toronto have released a case study of Endless Mayfly, “an Iran-aligned network of inauthentic websites and online personas used to spread false and divisive information primarily targeting Saudi Arabia, the United States, and Israel.” Here’s how the “disinformation supply chain” worked:

Step 1: Create personas: Endless Mayfly personas establish social media identities that are used to amplify specific narratives and propagate Endless Mayfly content.

Step 2: Impersonate established media sites: Using typosquatting and scraped content, sites are created to impersonate established media outlets, such as Haaretz and The Guardian, which then serve as platforms for the inauthentic articles.

Step 3: Create inauthentic content: Stories combining false claims and factual content are published on the copycat sites or as user-generated content on third-party sites.

Step 4: Amplify inauthentic content: Endless Mayfly personas amplify the content by deploying a range of techniques from tweeting the inauthentic articles to privately messaging journalists. Multiple Iran-aligned websites also propagate content in some instances. In one case, Bot activity was observed on Twitter.

Step 5: Deletion and redirection: After achieving a degree of amplification, Endless Mayfly operators deleted the inauthentic articles and redirected the links to the legitimate news sites that they had impersonated. References to the false content would continue to exist online, however, further creating the appearance of a legitimate story, while obscuring its origins.

One of the fake articles created was purportedly by The Atlantic. The articles were fake and it wasn’t too hard to tell if you’re a savvy news reader, though that doesn’t mean that some legitimate media outlets weren’t fooled. WhatsApp has tried to fight the spread of fake news by adding app controls that limit the number of times a message can be forwarded to five. But recently Reuters reported how easy it is to get around those controls:

“WhatsApp clones and software tools that cost as little as $14 are helping Indian digital marketers and political activists bypass anti-spam restrictions set up by the world’s most popular messaging app.”

Key Findings

• Endless Mayfly is an Iran-aligned network of inauthentic personas and social media accounts that spreads falsehoods and amplifies narratives critical of Saudi Arabia, the United States, and Israel.

• Endless Mayfly publishes divisive content on websites that impersonate legitimate media outlets. Inauthentic personas are then used to amplify the content into social media conversations. In some cases, these personas also privately and publicly engage journalists, political dissidents, and activists.

• Once Endless Mayfly content achieves social media traction, it is deleted and the links are redirected to the domain being impersonated. This technique creates an appearance of legitimacy, while obscuring the origin of the false narrative. We call this technique “ephemeral disinformation”.

• The investigation identifies cases where Endless Mayfly content led to incorrect media reporting and caused confusion among journalists, and accusations of intentional wrongdoing. Even in cases where stories were later debunked, confusion remained about the intentions and origins behind the stories.

• Despite extensive exposure of Endless Mayfly’s activity by established news outlets and research organisations, the network is still active, albeit with some shifts in tactics.