Researchers: Iran-linked disinfo effort had personal touch

LONDON – When an attractive young Middle Eastern woman contacted Saudi dissident Ali AlAhmed over Twitter last November, he was immediately suspicious.
The Associated Press was on the verge of publishing a story about how AlAhmed, who is based in the Washington area, had been targeted by hackers posing as a female journalist. Now, just two days before the article was set to go live, another young woman had sidled up to him over the internet, trying to entice him to read an article and share it online.
"They will never stop," AlAhmed wrote in a Nov. 6 message to the AP. "They think a hot girl can lure me."
The AP flagged the exchange to Canadian internet watchdog Citizen Lab, which was already helping AlAhmed deal with the hackers. Citizen Lab quickly determined that the Twitter account, purportedly belonging to an Egyptian writer named Mona A.Rahman , was part of a separate operation. In fact, she wasn't even trying to hack AlAhmed — she was trying to enlist him in an ambitious global disinformation effort linked to Tehran.
In a report published Tuesday, Citizen Lab said A.Rahman was but a small piece of a yearsold, multilingual campaign aimed at seeding anti-Saudi, anti-Israel and anti-American stories across the internet. Citizen Lab, which is based at the University of Toronto's Munk School, said it believes "with moderate confidence" that the operation is aligned with Iran. The campaign is another indication of how online disinformation is being tested by countries well beyond Russia, whose interference into the 2016 U.S. presidential election was laid out in vivid detail in special prosecutor Robert Mueller's report .
"What this shows is that more and more parties are entering the disinformation game," said John Scott-Railton, a Citizen Lab researcher, "and they're constantly learning."
In London, Iranian Embassy press secretary Mohammad Mohammadi denied that his government had anything to do with digital disinformation, saying that Iran was "the biggest victim" of such campaigns and had called for international regulations to curb them. He referred further questions to the Iran's Communications Ministry, whose press contact did not answer calls after hours on Monday.
Scott-Railton and his colleagues ended up identifying 135 fake articles that were published as part of the campaign, which they dubbed "Endless Mayfly" because, like the short-lived insect, the bogus stories tended to disappear soon after they began to spread.
The article A.Rahman was trying to get AlAhmed to share — a claim that Israel's then-defense minister, Avigdor Lieberman, had been fired for being a Russian spy — was typical: The article had startling news, it was hosted on a fake version of a Harvard University website and had a host of spelling and grammatical mistakes. Articles shared by other fake personas followed a similar pattern. They made inflammatory claims about Israel, Saudi Arabia and the United States presented

touch