American intelligence officials are monitoring a social media disinformation campaign that attempted to falsely implicate the White House National Security Adviser in a global money laundering and drug trafficking operation.
On Monday, a Twitter user claiming to be a high-ranking Canadian law enforcement official posted records supposedly showing a $350,000 wire transfer from a Canadian children’s apparel company to a Swiss bank account owned by National Security Adviser John Bolton’s daughter. “Police investigations show [the company] and its CEO are accused of laundering and transferring dirty money between Canada and some European countries, Turkey, the United Arab Emirates and the United States,” the Twitter account claimed.
The claims are clearly fabricated, and the effort does not appear particularly sophisticated. But a U.S. official familiar with the apparent disinformation campaign said intelligence community officials were aware of the effort. And Lee Foster, an information operations intelligence analyst at the cybersecurity firm FireEye, told The Daily Beast that the hoax’s techniques are “consistent with what we've seen with previous pro-Iranian influence operations.”
ADVERTISEMENT
Foster emphasized that there wasn’t enough information to attribute the Bolton hoax to Iran or any other specific party yet, but said the incident did share some similarities with other campaigns documented by FireEye.
The Twitter account at issue impersonated a high-ranking Toronto police officer named Donald Belanger. Twitter suspended the fake Belanger account and Toronto Police Service spokesman Alex Li confirmed to The Daily Beast that it was “a fraudulent” persona. The real police official the account had impersonated has never had a Twitter account and Toronto’s Police Service does not tweet out information naming witnesses, victims, and other sensitive information in the course of criminal investigations, Li said.
The tweet from the fake police official also made another mistake when the supposed wire transfer record in “Belanger’s” tweet misspelled Bolton’s daughter’s name.
The operator of the account first registered it in 2013 and appears to have originally tweeted in Arabic before repurposing the account into a fake Toronto police service official. The account, under the now defunct handle @BelangerPolice, retweeted an unremarkable stream of content from Canadian police accounts and mentioned nothing about Iran or Bolton until Monday.
A Twitter spokesperson did not respond to questions about the “Belanger” account.
Bolton is among the Trump administration’s most aggressive critics of the Iranian regime. The U.S. official, while not commenting on this week’s disinformation campaign specifically, said Bolton has been the target of state-sponsored influence operations designed to weaken his standing in the administration.
Though Twitter quickly removed the tweet on Monday and suspended the account, it had already been picked up and covered by a handful of websites with editorial positions sympathetic to the Iranian government. News outlets such as Iran Front Page blared “Belanger’s” claims that a Canadian business had supposedly transferred the funds at issue had been caught smuggling “a significant amount of opium” and “has close ties with the Mujahedin Khalq Organization (MKO) terrorist group.”
The outlet attributed its story to a tweet from a “senior Canadian law enforcement agent from the Toronto Police Drug Squad”—the fake police account—but has not updated or corrected its story to reflect the account’s suspension or the Toronto Police Service’s confirmation that the account was fake.
“John Bolton,” the “exclusive” article added, “is a fervent supporter of MKO terror group,” using one of several acronyms for the Mujahideen-e-Khalq organization, or MEK.
Bolton has earned tens of thousands of dollars in speaking fees for appearances at MEK conferences. The MEK participated in the 1979 revolution which installed Iran’s theocratic government, but eventually sought exile in Iraq, where it carried out terrorist attacks in Iran on behalf of Saddam Hussein’s government. The United States removed the MEK from its list of designated terrorist groups in 2012, but critics claim the organization, which has paid influential former American officials thousands of dollars to speak at events, is a cult bent on pushing the U.S. to war with Tehran.
In May, FireEye assessed with “low confidence” that a series of fake Twitter accounts impersonating U.S. and Israeli political candidates and reporters “was organized in support of Iranian political interests.” The fake accounts published content in line with Iranian foreign policy, but FireEye was unable to pinpoint the identity or location of those behind it.
In other cases, FireEye has found more direct ties between social media influence campaigns and Iran. An August 2018 report from the company cited a network of interconnected fake news websites and Facebook pages echoing “anti-Saudi, anti-Israeli, and pro-Palestinian themes” tied to Iranian state-run media outlets.
Foster noted that one of the Iran-linked fake news websites identified in that FireEye report, “US Journal,” published a story based on the fake account’s tweet. In contrast to the other stories, which summarized the fake Torono police account’s tweet, U.S. Journal also claimed to have “other documents we got our hands on,” in addition to the @BelangerPolice tweet.
The apparent disinformation campaign comes as the feud between Iran and the Trump administration over U.S. sanctions and a 2015 nuclear agreement have grown increasingly personal. In late July, the Trump administration sanctioned Iranian foreign minister Javad Zarif “because Zarif acted or purported to act for or on behalf of, directly or indirectly, the Supreme Leader of the Islamic Republic of Iran.” Zarif has spent the past few months blasting Bolton as part of a so-called “#B_team” bent on war with Iran and undermining President Trump’s attempts at diplomacy with the Islamic Republic.
The Daily Beast was initially alerted to “Belanger’s” tweets by a Twitter user claiming to be a U.S.-based freelance journalist covering the Middle East. The Twitter account was created in June, and has posted numerous tweets in broken and grammatically incorrect sentences consistent with someone whose first language is not English.
Of the account’s 63 tweets, 47 were devoted to promoting the “Belanger” story. Another 11 attacked Bolton by name.
The Daily Beast could not identify any bylines by the purported Middle East freelance reporter.
