Last month, the U.S. Senate Select Committee on Intelligence released volume two of its investigation into Russian interference, which details an extensive campaign that aims to sow division and undermine American democracy via social media. One of Russia’s key strategies is to target journalists. As the report describes, “Information warfare, at its core, is a struggle over information and truth. A free and open press — a defining attribute of democratic society — is a principal strategic target for Russian disinformation.”
By targeting journalists and news outlets in democratic countries, authoritarians weaken a key pillar of democratic societies. Ahead of the 2016 election, the Russian government and its proxies used a variety of tactics to target the U.S. news media, from directly contacting journalists to solicit coverage of stolen material to impersonating local news outlets. And Russia isn’t the only actor targeting news outlets. Other authoritarian regimes, including Iran and Saudi Arabia, have adopted similar tactics. With the 2020 U.S. election fast approaching, journalists may be exposed to a new wave of attacks seeking to undermine their credibility, distract their audiences, and weaponize their work.
Authoritarian governments and their relevant proxies use three primary tactics to attack news outlets: impersonating journalists and the outlets themselves to launder credibility; hacking and harassing reporters to inhibit or distract from negative coverage of the authoritarian regime; and engaging with journalists to solicit coverage of false or divisive narratives.
Impersonation and Mimicry
In the months leading up to the 2016 election, the Russian Internet Research Agency (IRA) infamously sought to impersonate U.S. news outlets to trick citizens into trusting inauthentic content. It was not the first time the IRA employed such tactics. In 2014, on the anniversary of the September 11 attacks, the IRA attempted to incite panic by spreading fake stories of a chemical plant disaster in Louisiana using websites that mimicked local news sources and counterfeit images of CNN reporting. The campaign sparked fear among citizens who were unsure how to respond to the news until local officials declared it a hoax. It was the first of several IRA operations that tested the group’s ability to generate viral stories and spread hysteria.
Officers from Russia’s military intelligence agency (GRU) deployed similar tactics in 2016 when they created an online persona for a fictitious journalist named “Alice Donovan.” The Donovan persona was used to publish plagiarized stories on several alternative news sites before becoming a key vector through which GRU officers leaked files and emails stolen from the Democratic National Committee.
Last month, Facebook revealed a more recent IRA operation using these tactics to influence new target countries across Africa. The exposed operation employed compromised and inauthentic accounts to create pages for phony local news sites to share content on key issues and drive web traffic to Russian state media sites.
Russia is not the only authoritarian actor employing these tactics. Others, including Iran, have deployed similar information operations — some of which pre-date Russia’s efforts. In August 2018, cybersecurity firm FireEye published a report revealing a suspected Iranian information operation had used faux independent news outlets and impersonated journalists to manipulate perceptions of key geopolitical issues in target countries around the world. In October, Facebook revealed it had removed three more Iranian-based inauthentic networks on its platforms that targeted populations around the globe using accounts posing as local news outlets. One of the Iranian networks even targeted Black Lives Matter activists in the United States with an issue-specific faux outlet “BLMNews.” Last year Reuters exposed another Iranian operation that included a network of Iranian websites impersonating news outlets to spread pro-Tehran narratives to foreign audiences. Some of these sites were active as early as 2012.
Other Iranian information operations have taken impersonation to a new level. One operation discovered this year, dubbed “Endless Mayfly” by the University of Toronto’s Citizen Lab, famously mimicked the official websites of several trusted Western news sites to spread fake articles. The targeted sites included The Guardian, Bloomberg, Foreign Policy, Al Jazeera, The Independent, The Atlantic, and Politico. Another suspected Iranian operation exposed this summer used inauthentic personas to publish letters, guest columns, and blog posts in legitimate U.S. and Israeli outlets. One persona, “John Turner,” maintained a regular blog on The Times of Israel’s site for nearly two years.
More governments in the region are beginning to follow suit. This summer, Facebook identified and removed a network of inauthentic accounts linked to the Saudi government that included pages that “masqueraded as local news organizations” in various Middle Eastern and North African countries to push pro-Saudi narratives. Similar operations that originated in Egypt and the UAE also included accounts impersonating news outlets to spread propaganda.
Authoritarian information operations impersonate news outlets and journalists because of the inherent trust that citizens place in media outlets to report fairly. In doing so, these operations not only launder that trust to spread falsehoods but also contribute to a declining faith in media amongst citizens. If news consumers cannot be sure if a source or article is authentic or not, they lose confidence in their ability to discern the truth — benefitting autocracies that rely on deceit for stability.
Hacking and Harassment
It is well known that authoritarian regimes go to great lengths to silence critical voices by arresting, intimidating, and even assassinating journalists that dare to investigate their corruption. Those regimes often also target foreign news sources through harassment and hack-and-leak information operations in order to undermine those outlets’ credibility.
While authoritarian regimes have deployed hack-and-leak operations most notably to target political figures, similar operations have also been used to silence and discredit critical voices in the news media. In 2016, operatives likely linked to Russia’s GRU targeted Russia-focused journalist David Satter with a hacking campaign, according to the University of Toronto’s Citizen Lab. The hackers successfully spear-phished Satter, a high-profile Kremlin critic, and then modified and selectively leaked stolen material to damage his reputation and credibility. The Citizen Lab connected the spear-phishing attack to a larger global operation that targeted even more journalists, as well as other key members of civil society and former politicians.
Even more recently, in August 2019, open-source investigative outlet Bellingcat reported on a similar, ongoing spear-phishing campaign targeting Russia-focused journalists. Given the sophistication of the effort, the concentration on Russia-focused members of civil society, and some overlap in tactics and targeting with previous GRU operations, Bellingcat noted that hackers associated with GRU are the likely culprit. And in Saudi Arabia, a high-level official ordered a government cybersecurity unit to hack into the emails of foreign journalists investigating the 2018 murder of Jamal Khashoggi.
Apart from hack-and-leak attacks, authoritarian regimes have also used information operations to harass critical journalists. Operatives working for the Russian IRA launched a coordinated campaign to smear and harass Finnish journalist Jessikka Aro in response to her investigative reporting on the organization’s activities. IRA operatives mocked Aro’s writing and public appearances, dug through her online history, and falsely claimed she was a drug dealer.
By attacking journalists directly, authoritarian regimes seek to disarm what they see as a major threat to their hold on power. Hack-and-leak and harassment operations are intended to discredit critical journalists, shut down reporting that may prove damaging to the regime, and send a threatening message to the news media about exposing malign activity.
Solicitation and Engagement
Authoritarian information operations also seek to solicit coverage from news outlets to draw more attention to divisive and false narratives, which they achieve in part by engaging with specific reporters. Ahead of the 2016 U.S. election, Russian intelligence officers operating through the fake persona “Guccifer 2.0” contacted journalists to offer privileged access to stolen material, which facilitated negative news coverage of the Clinton campaign.
Operatives from the Russian IRA used similar tactics to attempt to interfere in the 2018 U.S. midterm elections. Acting through inauthentic personas, IRA trolls contacted several prominent journalists, claiming that a large-scale Russian interference campaign was underway. To back up their assertion, the operatives steered journalists to an IRA-controlled website with a list of inauthentic social media accounts that the group claimed to be behind. In this case, the IRA’s intention was not to drive a particular election outcome, but to spark uncertainty and undermine confidence in the electoral process itself by inciting sensationalist coverage of their interference efforts.
Iranian government-linked actors have made similar attempts to engage with journalists and media organizations. The “Endless Mayfly” operation used a range of inauthentic personas to try to solicit coverage from journalists in target countries. One such persona, “Bina Melamed,” sent journalists from The Jerusalem Post a link to a fake article on a website designed to mimic the site of Harvard University’s Belfer Center for Science and International Affairs. The article claimed that Israel’s former Mossad director had revealed that former Israeli Defense Minister Avigdor Lieberman was a Russian agent — a claim that is both startling and untrue. Melamed was just one of several fake personas the operation used to attempt to solicit coverage of fabricated articles.
Authoritarian regimes seek to engage and solicit coverage from journalists to weaponize citizens’ trust in the media and to insert false and divisive narratives directly into the public consciousness. Amplification of those narratives via mainstream media coverage is the ultimate goal of any information operation. In the past, journalists have fallen for the trap. Ahead of the 2016 election, U.S. news outlets amplified Russian information warfare efforts through their irresponsible coverage of hacked and leaked information.
Conclusion
With the 2020 election fast approaching, journalists will need to be wary of the ways that authoritarian regimes seek to target and manipulate them. In 2016, the U.S. news media played a significant role in amplifying and unknowingly aiding the Russian government’s interference campaign. An investigation by the Columbia Journalism Review revealed that, in the time leading up to and after the 2016 election, 32 out of 33 major U.S. news outlets cited Russian IRA trolls in their reporting. Journalists covering the 2020 election will need to reconcile with that fact and take steps to more responsibly report on the upcoming election. Specifically, journalists should contextualize their reporting on leaked or stolen material, and they should stop relying on social media posts as evidence of public opinion. They should also develop a strong cyber hygiene to protect themselves against foreign hacking and harassment.
And defending the information space is not just a job for journalists; tech companies and online news consumers must play a part as well. For tech companies, 2016 served as a stark wake-up call that their platforms have become a battlespace through which authoritarians pursue their agendas. While those companies have made progress in detecting and removing inauthentic behavior, improved information sharing mechanisms between the companies, government agencies, and online users remain necessary to facilitate more effective responses to malign activity. The average American should be vigilant when sharing articles and narratives online in order to build up societal resilience against foreign interference. Additionally, citizens and online platforms that consume or share news content should provide greater support for local journalism, which will help close off gaps in the information space that malign actors exploit.
Authoritarian regimes target journalists because they are the first line of defense for democracy. By inauthentically commandeering the credibility of trusted news outlets, silencing and distracting critical voices, and soliciting coverage of chosen narratives, malign actors can sow division and discord while weakening a key pillar of democratic societies. As more foreign adversaries prove willing and able to target U.S. politics through online information operations, newsrooms will need to learn how to defend themselves.
The views expressed in GMF publications and commentary are the views of the author alone.
