The fake social media accounts were given depth through articles published under their names on websites that allow user-submitted content.
By LAHAV HARKOVIranian President Hassan Rouhani is seen during a public speech in the southern Hormozgan province, Iran, February 17, 2019(photo credit: IRANIAN PRESIDENCY WEBSITE/HANDOUT VIA REUTERS)
An Iranian disinformation campaign targeting Israelis exposed by The Jerusalem Post continues to be active, a report by the University of Toronto’s Citizen Lab released on Tuesday reveals.Citizen Lab – which researches digital security, human rights and global politics – tracked the Iranian campaign, which they nicknamed “Endless Mayfly,” for a year, doing extensive analysis of the operation and linking it to Iran.Citizen Lab said their conclusion that the campaign is aligned with Iran is “based on the overall framing of the campaign, the narratives used and indicators from overlapping data in other reports.”Endless Mayfly – a network made up of fake social media accounts that spread false news reports to amplify narratives critical of Saudi Arabia, the US and Israel – is still active. This is despite its activities being exposed by established news outlets, including the Post, over several years.One of the cases Citizen Lab researchers studied pertains to a story peddled to Post reporters and to Washington-based Saudi scholar Ali Al-Ahmed in November among others.Al-Ahmed was contacted by a Twitter account named Mona A. Rahman, posing as a critic of the Saudi government, while reporters at the Post were contacted by a Twitter account named Bina Melamed, claiming to be a human rights activist and freelance journalist, with a link to a website – disguised as the Belfer Center for Science and International Affairs at Harvard University – reporting that ex-Mossad chief Tamir Pardo accused Yisrael Beytenu head Avigdor Liberman of being a Russian spy in an address to the Belfer Center. The story was false.However, the page looked genuine based on the graphics and fonts it used. A closer look revealed typos, poor grammar and a URL of belfercenter.net, as opposed to the genuine Belfer Center website, belfercenter.org.The Post exposed the fake site the day it received the links, on November 14, and other news sources have reported on stories falsified by the network, including Buzzfeed and the Belgian periodical Le Soir.But Citizen Lab identified at least three cases where stories by Endless Mayfly made it into the mainstream media, including a June 2017 Reuters report that six Arab countries called for Qatar to be stripped of hosting privileges for the 2022 World Cup. Several other media outlets republished the news wire’s article, and Reuters later retracted the story.Another was a falsified Haaretz story claiming that Azerbaijani President Ilham Aliyev invested $600 million of his personal wealth into the Israeli stock exchange.
Armenian news site Armenpress republished the story claiming Haaretz published and then deleted it, implying a cover-up by the Azerbaijani government.The report’s strongest hypothesis is that Endless Mayfly’s activities come from Iran or an Iran-aligned actor, in that it fits Iranian interests, and none of the content is critical of Iran.“The extensive content concerning Saudi Arabia fits with themes that are regularly observed in Iranian public statements and propaganda,” the report states, pointing to Iranian Foreign Minister Mohammad Javad Zarif and others accusing Saudi Arabia of supporting global Islamic terrorism, a common theme in the network’s content.Citizen Lab notes that there was early speculation on some of the network’s stories that they were being promoted by Russia, but the researchers found that this was unlikely.“Not only is the content heavily focused on issues of concern to Iran, but some of the content is detrimental to Russian relationships and foreign policy,” the report reads.Endless Mayfly has been active since 2016, spreading 135 false articles via 11 social media personas and 73 domain names, the vast majority of which mimicked established media outlets in English, French and Arabic. Some of the news sources Endless Mayfly impersonated were The Guardian, Haaretz, Le Soir, Bloomberg and Breaking Israel News, a site targeting an Evangelical Christian audience.When the content gains traction on social media, the Endless Mayfly content is deleted and links are redirected to legitimate websites being impersonated, giving an appearance of the content coming from a legitimate source while obscuring the origin of the false narrative. The network’s accounts used screenshots of the articles, so that the message continues to be sent even after the web pages are deleted.Of 118 false articles with still-accessible content – mostly through cached content, since the pages were deleted – 61 are about Saudi Arabia, 21 are about the US and 18 are about Israel. Of the articles about Israel, 14 are about growing relations between Israel and Muslim-majority countries, with an emphasis on Saudi Arabia. For example, an article impersonating the website Israel in Arabic claimed that Sephardi Chief Rabbi Yitzhak Yosef said that condolences sent by Arab states for the death of former president Shimon Peres were a sign of Israel-Arab rapprochement.The articles are mostly about international relations and name specific politicians. Their release was often timed to correspond with real world events, such as a falsified Breaking Israel News article using Prime Minister Benjamin Netanyahu’s visit to Azerbaijan in December 2016 as the context for fake quotes by Mossad Chief Yossi Cohen.The fake social media accounts were given depth through articles published under their names on websites that allow user-submitted content, like Buzzfeed Community, Medium, China Daily and others. One of the ways the fake accounts operate is to privately and publicly engage with journalists, political dissidents and activists.“We see Endless Mayfly as part of a trend towards more complex, multi-narrative, multi-platform efforts that evolve over time,” the Citizen Lab report explains. “Such campaigns cannot be fully understood or countered without using a wide range of tools that cut across traditional disciplinary silos, such as information security, political science, journalism and education.”
