How a suspected Iran-based campaign tried to get Canadian media to spread fake news

An online disinformation campaign believed to originate from Iran tried to get Canadian media to amplify fake news, a CBC/Radio-Canada analysis has found. And in at least one instance, it was successful.

The campaign was first discovered by researchers at the University of Toronto's Citizen Lab, who detailed their findings in a report published last week. Dubbed Endless Mayfly, the campaign relied on short-lived fake news stories that disappeared after being propagated by unwitting targets.

CBC downloaded thousands of Endless Mayfly tweets identified by Citizen Lab researchers and searched for references to Canada. CBC also inspected each account mentioned in the tweets to identify Canadian Twitter users. This revealed that while the campaign targeted thousands of Twitter users around the globe, a slice of the effort specifically focused on Canadian accounts.

Throughout 2016 and 2017, some of these accounts targeted 12 Canadian media outlets, including the CBC, to drum up attention for a fake story claiming the CIA backed a failed coup in Turkey.

Another tweet tried to get Le Journal de Montréal, a French-language daily, to cover a false story that claimed Saudi Arabia was supporting then-presidential candidate Emmanuel Macron in the 2017 French election. The article was hosted on a fake version of Belgian news site Le Soir and was eventually shared on Twitter by far-right French politician Marion Maréchal-Le Pen.

• All of the tweets analyzed by CBC News can be found in a publicly available document here.

In a few instances, this media-baiting worked. Reuters, for example, reported on a fake story cooked up by Endless Mayfly which said that six Arab countries had asked FIFA to disallow Qatar to host the 2022 World Cup. The story had been published on a dummy mock-up of a Swiss news site.

Global News picked up the Reuters story and later corrected it.

While the Citizen Lab researchers cannot definitively point a finger at the Iranian government, they wrote that they "find with moderate confidence that Iran or an Iran-aligned actor is the most plausible explanation" based on evidence gathered. Their analysis shows that the pieces of fake news pushed by the network closely align with Iranian interests.

"It's hard to definitively pin down what their objective was, but I think it was to get their stories into mainstream media," said Gabrielle Lim, lead author of the report. "I think the objective was to sow geopolitical division between traditional adversaries of Iran, like Israel, Saudi Arabia and Western countries like the U.S."

The role of social media

Another component of Endless Mayfly was attempting to get false stories published by alternative media outlets around the globe. Twitter users posing as independent reporters tried to contact several outlets, offering to collaborate. One of these outlets was The Rebel, a far-right Canadian news and commentary site run by the outspoken Ezra Levant.

There's no indication that anyone using The Rebel's Twitter account responded to the fake account associated with the name Brian H. Hayden, described in his profile as a "freelance journalist."

However, Montreal-based website Global Research did. The site publishes stories promoting theories that have been debunked, such as chemtrails. In 2017, Global Research published two articles purportedly written by Hayden, both identified by researchers as stemming from Endless Mayfly.

One article claimed that Israel and Turkey were trying to sow division in the Middle East by supporting an independent Kurdistan in Iraq. The other claimed that former Pakistani prime minister Nawaz Sharif was a stooge of Saudi Arabia.

CBC reached out to Global Research for comment but has not yet heard back.

The Endless Mayfly campaign partially relied on creating false web pages of real media outlets, often copying their layout and hosting them on URLs similar to those of the targets. For example, articles were published on "theguaradian.com" rather than The Guardian's real website, theguardian.com.

Two domains very similar to Canadian media outlets — nationalepost.com and theglobeandmail.org — were also registered by the people behind the campaign. Researchers were not able to determine if content was ever posted to these websites and no traces of any articles remain. But their URLs are almost identical to those of the National Post and the Globe and Mail. These sites were later deleted.

Along with targeting Canadian media outlets and specific reporters, the campaign focused some of its energy on jailed Saudi blogger Raif Badawi, who was arrested in 2012 and later sentenced to 10 years in prison for "insulting Islam through electronic channels."

Canada became embroiled in the fight for his release after Badawi's wife, Ensaf Haidar, and the couple's children came to Canada as refugees in 2013. Haidar, in particular, was targeted by the disinformation network. Twitter accounts linked to Endless Mayfly mentioned and retweeted Haidar 21 separate times in three different languages — more than any other single Canadian target.

'There are multiple players in this game'

The Citizen Lab researchers said they could see Endless Mayfly's tactics evolve in real time.

Early in the campaign, several media outlets in different countries realized that someone was pushing fake news using copycat versions of their own websites. To evade further detection, the actors behind the disinformation campaign would delete articles after a few hours, then redirect traffic to the actual website of the media that was impersonated. That way, a skeptical user might think the article had been legitimate.

Some parts of Endless Mayfly are still online and researchers believe the campaign might still be active.

"They've evolved so much from past mistakes, it's so much harder for researchers to track this stuff," said Lim. "It's likely we'll see more interesting approaches to disseminate disinformation. It's a good reminder that there are multiple players in this game; it's not just Russia. Iran also has a long history of information controls."

The fact that disinformation campaigns are constantly evolving will make it harder to spot fresh attempts to sway political discourse as we head into a federal election, said Fenwick McKelvey, an associate professor of communication studies at Concordia University.

"That's why it's important to pay attention to this, because these are always experiments. It's not as though we're going to see this exact same type of technique or these same accounts," McKelvey said. "It's a cat-and-mouse game."

Send tips on this or any other fake news story to kaleigh.rogers@cbc.ca or send us files securely and anonymously using SecureDrop.