Saudi Arabia’s crown prince promised Trump help in cracking down on protests against police violence. The United Arab Emirates made secret, illegal campaign contributions to the Trump campaign. American chicken McNuggets will give you COVID.
These are just a few of the articles that three “journalists”—Shadia Ben Yousef, Rumaisa Hanaoui, and Ahlam al-Shumayli—have published in dozens of periodicals and news websites since May 2019. But the stories are all fake. They’re all based on spoofed websites, forged screenshots, or nonexistent events. And as Facebook announced on Tuesday, a number of them were hyped by trolls based in Iran using fake accounts.
A joint investigation by The Daily Beast and Mandiant Threat intelligence identified dozens of these fake articles published at 35 different Arabic news outlets in a nearly two-year-long disinformation spree that pushed pro-Iranian narratives critical of the U.S., Israel, and Saudi Arabia laundered into legitimate news outlets by the fake reporters.
ADVERTISEMENT
After The Daily Beast reached out to Twitter about Hanaoui and al-Shumayli's accounts in October, the company suspended them for violating Twitter’s spam and platform manipulation rules. The Daily Beast was unable to find any social media accounts in Ben Yousef’s name.
In a report on coordinated inauthentic behavior released on Tuesday, Facebook said it identified four accounts as part of a network of accounts from Iran that “targeted primarily Arabic, French and English-speaking audiences globally” and “centered around off-platform typo-squatting domains” after reviewing information from The Daily Beast and Mandiant. The company wrote that automated anti-spam systems stopped the “vast majority” of the accounts activity when they were active in 2020.
It’s unclear who was behind the fake content the personas used for their articles. But the raw material for their stories displayed similar tactics to those seen in the Iranian-aligned Endless Mayfly disinformation activity first identified by researchers at the University of Toronto’s Citizen Lab.
Content produced as part of Endless Mayfly’s activity frequently relied on spoofed news websites that mimicked real news organizations to push narratives discrediting the U.S., Israel, and Saudi Arabia.
Shadia Ben Yousef, the most active of the three personas, posted an article posted on a misspelled version of the American outlet Defense One, which focuses on military matters. The article, formatted to look like the real site, hyped a fake claim that the head of the Mossad had visited an Iraqi military base where U.S. troops were stationed.
Impersonations on social media also proved a fertile source of content for the personas. Ben Yousef relied on a host of user impersonated Twitter accounts, including ones in the name of a U.S. diplomat at the American embassy in Baghdad, a former senior French intelligence official and member of parliament, and a fictitious Yemeni jihadi splinter group which threatened an Arab-Israel peace conference in Bahrain.
Shortly before the 2020 presidential election, someone also registered a Facebook account to impersonate an Israeli cybersecurity official and claim that the royal family of the United Arab Emirates “made a generous donation of 200 million USD to Trump's campaign hoping to keep him in power.” Hanaoui published a story about the forgery at the Algerian daily El Wamid that alleged a grand conspiracy by Israel and the UAE to keep Trump in power.
The fake Israeli Facebook account was also shared by a Twitter account that impersonated Corey Lemley, a real antifa activist in Tennessee. It was an apparent attempt to spread a false story of Middle Eastern election-meddling to a left-wing, English-speaking audience. Lemley confirmed to The Daily Beast that the account was a fake and not in any way associated with him.
Facebook and Twitter suspended the accounts involved when The Daily Beast shared examples of the content but were unable to determine who was behind them.
The personas published their work in predominantly legitimate Arabic news outlets, but a few also appeared on fake news sites set up by Iran’s Islamic Revolutionary Guard Corps. At least two stories appeared on Nilenetonline and Libya Al Mokhtar—IRGC-run fake news sites pretending to be Egyptian and Libyan outlets, which the Justice Department later seized and attributed to the IRGC.
The personas stuck to similar themes as the Endless Mayfly activity—criticism of the U.S. and its allies Saudi Arabia and Israel—but also added a new focus in response to events in the Middle East: the United Arab Emirates and the Arab normalization process it spearheaded in the Middle East.
As the UAE moved closer to diplomatic recognition with Israel, the personas sought to tarnish the country’s image and sow division between the Emirates and its allies. The Ben Yousef persona ran fake stories claiming that the UAE had turned its back on Saudi Arabia and embraced a rapprochement with the Kingdom’s Gulf rival, Qatar, plotted with Israel to take control of the al-Aqsa mosque in Jerusalem and carry out a “false flag” attack with Israel on tankers in the Gulf to blame Iran.
The Emirati ambassador to the U.S., Yousef al Otaiba, told The Daily Beast that while he wasn’t familiar with the specific disinformation effort, he didn’t view it as surprising. “This was something we obviously knew was going to happen. We knew where it was going to come from. We all knew what the messages were going to be,” Otaiba said.
Despite the apparent effort to sway minds against normalization, Otaiba says the propaganda campaign hasn’t had any impact on public opinion. “In the UAE, it hasn't affected what our approach is with Israel. We're full steam ahead.”
The personas also seized on the global pandemic as an opportunity to use the coronavirus as a propaganda weapon against the U.S. The Ben Yousef persona wrote fake stories about Americans and symbols of America acting as infection vectors in allied countries. One story cited a fictitious cluster of coronavirus infections among American troops in Iraq and another used a forged Twitter screenshot of a French member of parliament to claim that a four-piece box of McDonald’s chicken McNuggets may have given him the virus.
Throughout the nearly two-year fake news campaign, the personas appeared to garner little critical attention from the public until a story by Ben Yousef victimized a grieving Lebanese woman. When Najwa Qassem, a popular Al Arabiya broadcaster, passed away suddenly of a heart attack in January 2020, her friend Rima Najm, a Lebanese journalist and author, wrote of her horror discovering a fake quote about the incident attributed to her in a Ben Yousef story. The story, published in Egyptian news outlets, used a fake quote from Najm to frame the death as somehow suspicious and related to an attempt to leave for a job at another network.
Najm did not respond to requests for comment from The Daily Beast but wrote about the experience in a piece shortly after the incident.
"It’s painful that some put you in a position that you don't belong. So you end up being associated with an act that you didn't do and a saying that you didn't speak,” she wrote.
--with additional reporting by Kelly Weill
