Twitter suspended on Wednesday an account impersonating a New York Post reporter after it sent out a series of fake stories pumping out pro-Iranian regime propaganda and attacking adversaries of the Islamic Republic.
The account was also linked through retweets and shared articles to another account impersonating a reporter—one from Israel. It too was taken down after sharing pro-Iranian regime propaganda.
In recent years, Iran has beefed up its online disinformation activity, meddling in American politics and attempting to spread pro-Iranian regime narratives around the world. It’s uncertain as yet who was behind the account. But if the account was run from the Islamic Republic, it would be consistent with a growing Iranian disinformation effort by the country’s propaganda organs.
ADVERTISEMENT
“Iran has readily embraced the use of online information operations to support its geopolitical objectives over the past few years, and has refined a vast array of tactics and sophisticated methods that it continues to hone and leverage today,” Lee Foster—a senior manager for FireEye Intelligence’s information operations analysis shop—told The Daily Beast. “The U.S. should expect that Iranian influence efforts surrounding the U.S. will increase over the coming days or weeks as political developments evolve.”
The New York Post account, @MarkMooreNYPost, stole the identity of a legitimate reporter who had no idea his identity had been hijacked and had nothing to do with the effort.
Both the Post and the real Mark Moore declined comment for this story, but he confirmed to The Daily Beast that the @MarkMooreNYPost account and a number of the stories it tweeted were fake and not authored by him. Moore’s actual account, @markmoore111, has not been used in years. The bio in the fake account is also wrong, according to Moore, and includes outlets like the New York Times, The Sun, and Fox News for which Moore has not written.
The account tried to pass itself off as a legitimate New York Post reporter in part by tweeting out links to the real Mark Moore’s stories that touched on Iran. But in addition to Moore’s actual work, the account also published fake stories published on open platforms like Medium and The Odyssey Online throughout December 2019.
The stories included fake news about traditional targets or Iranian foreign policy, including the dissident cult group the Mujahideen-e-Khalq (MEK) and Israel. One story posted to The Odyssey included a fake quote from the French ambassador warning pro-Israel lobbyists in Miami about “extremist movements in Jerusalem” trying to reclaim the tomb of the kings, an archaeological site in Jerusalem owned by France and considered sacred by Jews. A spokesperson for the French embassy confirmed that the quote and story were fake.
Another story took aim at a frequent target of Iranian covert operations, the MEK, which set up a headquarters in Manez, Albania in 2016. In an article posted to Medium.com, the fake Moore wrote that the presence of the MEK in the country “could be a good cover for hiding money laundering, corruption and financial and economic scandals from the Albanian authorities” and jeopardize the country’s prospects for integration with the European Union.
At least one story from the fake Moore persona strayed outside traditional Iranian foreign policy targets and lent support to Russian narrative. An article posted to The Odyssey in December included a fake quote from a member of the U.S. Anti-Doping Agency board claiming that Russia’s expulsion from international sports competitions for its state-backed campaign of doping was instead a possible “punishment from the United States for Russia's destabilizing actions in the international arena.”
Officials from the U.S. Anti Doping Agency confirmed to The Daily Beast that the quote was fake.
Twitter also shut down an account using similar tactics on Wednesday after it mimicked a legitimate Israeli reporter from the left-leaning Ha'aretz newspaper.
“According to reports received by Haaretz, a US aircraft carrying American soldiers wounded by Iran's missile strike on Ain Asad Air Base, landed in Tel Aviv hours ago. Based on informed sources, 224 soldiers were taken to Tel Aviv Sourasky Medical Center Hospital,” the account, running under the handle @KhJacki_E, wrote.
The account impersonated veteran Israeli reporter Jack Khoury and tweeted out pro-Iran propaganda, including one of the stories published by the fake Moore account. And like the Moore account, it made use of open platforms like Medium to host its fake stories pushing Iranian regime-friendly propaganda.
Twitter suspended the fake Khoury account Wednesday and in a statement to the Daily Beast said the account “was permanently suspended for violating our platform manipulation policy."
The Daily Beast reached out to the real Jacki Khoury, a legitimate reporter whose identity was stolen by the fake @KhJacki_E and had nothing to do with its hoaxes, but did not receive a reply in time for publication. In a statement on Twitter, the real Khoury wrote that “A fake account impersonating me was pushing fake news with my name on it.
Israeli reporters first flagged the account as inauthentic on Wednesday. It has since been suspended by Twitter.
The phony missile casualties story tweeted out by @KhJacki_E is consistent with Iran’s attempts to portray its missile strike in revenge for the U.S. killing of Islamic Revolutionary Guard Corps commander Qassem Soleimani as more lethal than it actually was. Defense Department officials have confirmed that no U.S. personnel were injured in the attack but state-linked Iranian propaganda outlets have consistently tried to claim otherwise.“80 US army personnel have been killed and nearly 200 more wounded” in the attack, read one such claim, from the Islamic Revolutionary Guard Corps-linked Fars News agency.
Iranian official media have pushed the fake story of U.S. casualties because “the regime has boxed itself in,” said Ariane Tabatabai, a Rand political scientist who studies Iran. “It came out immediately and talked about casualties, so it’s not going to go back now and say it made a mistake and that there weren't any. Second, it serves its interest to promote this narrative that there were casualties. It can tell to its domestic audience that it showed strength, while clearly staying at a level of violence where the U.S. doesn't feel pressure to respond accordingly. It’s win-win.”
@KhJacki_E has been pushing pro-Iran propaganda for months. In November, the account tweeted a fake story about a fake assassination attempt on the Israeli president. “According to reports from trusted sources, President Rivlin's #assassination attempt was foiled a few hours before the election and a state of emergency has been declared around the presidential palace,” the account tweeted.
The bogus story claimed that Israeli Defense Force officers were part of the phony assassination plot inspired by rabbi Yitzchak Ginsburgh and in support of Israeli Prime Minister Benjamin Netanyahu. In another absurd twist to the fake storyline, the account claimed that a recent visit by U.S. Joint Chiefs Chairman to Israel was "related to Americans' concern about some of the #IDF’s moves” in connection with the plot.
The assassination attempt never took place and no state of emergency was ever declared. Nor did it succeed in getting much traction beyond the small network of followers.
The @KhJacki_E also participated in an apparent Iranian campaign to spread a fake story about the MEK. In a similar use of tactics, a fake account impersonating a real person, an aide to French President Emmanuel Macron, claimed that France had decided to expel the leader of the MEK, Maryam Rajavi, from her home in France. The tweets briefly fooled legitimate news outlets into thinking that France, engaged in talks with Iran over its nuclear program, was taking a harsher line on the cult as a concession to Tehran.
The account was quickly suspended and MEK followers denounced it as a fake on Twitter.
But the @KhJacki_E account followed up on the fake French official’s tweets with a short post on Medium.com’s self-publishing platform. "MEK leaders' lack of presence in France would allow EU pressure on Iran during talks to half Iran's nuclear and missile activities,” it wrote.
“It looks like the operation was dedicated against MEK and Israel—what Iran sees as two main threats,” said Kanishk Karan, a researcher at the Atlantic Council’s Digital Forensic Lab, which tracks online disinformation. “This was also a shift from their strategy of setting up websites to now using online publishing platforms to disseminate false information easily without raising suspicions, as newly setup websites raise alarms on authenticity and background.”
But while the messaging is consistent with Iranian aims and precedent, it’s still as yet unclear whether the fake account was in fact run from the Islamic Republic.
“We've seen Iranian operations impersonate journalists before. A lot of the time what they've been doing is creating fake personas just to spread regime propaganda,” Ben Nimmo, director of investigations at the disinformation-tracking firm Graphika told The Daily Beast. But Nimmo cautions that “content is only ever a weak signal” for attribution. “What this accounts appears to have been doing aligns with one part of Iranian messaging but without technical evidence to support that, that's all you can say. It looks like an operation. The messaging would match an Iranian option but there are other options as well.”
The Daily Beast first began tracking a network of pro-Iranian trolls impersonating real officials following an Iranian propaganda attempt to implicate the family former National Security Advisor John Bolton in a bizarre fake money laundering scheme.
In July, an account impersonating a real Toronto police officer interrupted a months-long streak of tweeting everyday news about Canadian police affairs with a wild allegation that Toronto police had begun an investigation into allegations of drug trafficking and money laundering involving Bolton’s daughter and the MEK and published purported screenshots of bank records in support of the claim. The claims were clearly fake and quickly disproven.
Trump administration officials told The Daily Beast that the effort was monitored by U.S. intelligence and attributed to Iran. Administration officials said that Iran had been engaged in a concerted effort to weaken Bolton’s standing in the Trump administration during his tenure there.
