Russian disinformation: The network of fake foreign media

Wir haben diesen Artikel auch auf Deutsch veröffentlicht.

It is not often that a German news site publishes a report which then hits Russia like a bomb. „Abendlich Hamburg“ recently succeeded in doing so with an alleged investigative article about Alexei Nawalny. The Russian opposition politician is currently still recovering in Germany after being poisoned with the nerve poison „Novichok“. „Abendlich“ author Matthias Fritz claims to have found out that the West is now relying on his wife Julia instead of Alexei Nawalny. After returning to Russia, she wants to run for the Russian State Duma. So the article says.

Dozens of well-known Russian sites, including the online newspaper „Gazeta.ru“ and the tabloid „Komsomolskaya Pravda“, picked up the story from November. A journalistic success for „Abendlich Hamburg“, one might think. Instead, the site disappeared from the web.

In the meantime it has become clear that something is wrong with the allegedly Hamburg-based portal: the language of the articles sounds like a poor translation from Russian, most of the articles are copies from Russian propaganda channels. The official registration data leads to a false address in Gotha in Thuringia. The matter seems clear: Something very odd is going on. One seems to be confronted with an example of Russian disinformation. But the matter is somewhat more complicated, more comprehensive. A investigation by netzpolitik.org and WELT now makes this clear.

A joint analysis of the website uncovered clues about the people behind it, identified recurring patterns, and, finally, found more such websites. This brings to light a whole network of supposed news portals that give themselves serious-sounding names, but whose supposed journalists do not even exist. In reality, they are all puffed up fake news slingshots.

On these platforms, the Russian-speaking world backers place disinformation. Theses fake ‚foreign media‘ are designed to strengthen the credibility of the news when quoted within Russia. A second method has also been established: the masterminds also abuse reputabled European media to spread their conspiracy myths. In at least one case they have planted lies directly on a renowned French news site.

Behind all this is a controlling hand whose tracks lead to the separatist areas in eastern Ukraine and to a Russian-language propaganda channel with links to Russian intelligence services. It is one of the very rare examples of how Russian disinformation works. At the same time, one can see the sometimes crude means by which the information warfare against enemies at home and abroad is waged today.

A failed cover-up

Hardly anyone in Germany has heard of the website „Abendlich Hamburg“. It is the starting point of this investigation. The people behind the site have done a lot to remain unrecognised. To disguise who runs the portal, they used the service Cloudflare, which channels visitors through its own servers, so called proxies. By means of proxies the actual location of the originating servers is obscured.

However, Cloudflare has a serious weakness when it comes to remaining truly anonymous. This has to do with the Domain Name System (DNS), the phone book of the Internet. A DNS server stores the information of which Internet domain name should lead to which Internet address (Internet Protocol Address). Cloudflare operates thousands of such DNS servers. The service assigns two random DNS servers to new customers, which then remain identical for the websites of a user account.

Cloudflare has named the DNS servers, registered for the domain of „Abendlich Hamburg“, „Candy“ and „Zeus“. netzpolitik.org and WELT have searched for further domains which use this combination of „Candy“ and „Zeus“. This allowed conclusions to be drawn as to which websites could have the same operator.

Fake news portals in several European countries

The investigation leads to news portals allegedly from Germany, the United Kingdom, Spain, France, Hungary, Moldova and Russia. Articles in several languages also appeared on an international site. Their contents as well as technical features reveal a pattern that is familiar. „Abendlich Hamburg“ is apparently not alone. Dissimulating clones have been distributed, more or less obscured, to many countries.

netzpolitik.org and WELT have downloaded and examined the entire archives of several websites from this network. The evaluation shows how systematically the portals spread disinformation. It also uncovers the pretext of trustworthiness they establish. The publications are designed to help ensure that piecemeal disinformation is not noticed as such but perceived as true.

For years, the operators have been filling these websites with articles from other news portals. Often the operators also copied articles from reputable media such as the British „Guardian“ or the television channel „Euronews“. Occasionally, however, articles appear which are clearly out of the ordinary. In Spanish, one portal reported on alleged hatred spread by US media after Russia annexed the Crimean peninsula. The text ends with a threat: „Provocations against Russia will lead to a harsh military response from Moscow, which will be a real disaster for the Ukraine“. An alleged coup d’état by Ukrainian nationalists could „blow up the world“. Sometimes translations of the same articles appeared on various „European“ news portals of the network.

The dissemination mechanism

The people behind this did not make much of an effort: most of the pages are sloppily designed. There is no imprint and the layout looks unprofessional. In the case of two news portals, intended to appear independent of each other and located in different countries, a technical flaw disclosed information about the web server behind them. This shows the allegedly independent sites are apparently operated through the same user account with the identifier „u0453810“.

The clumsy interfaces suggest that the pages are not designed for real readers in their respective countries. But even if they may be perplexing at first glance, they do not fail to have an effect: the individual pages are in fact the gears of a large transmission mechanism that has actually begun to move as evidenced by the following examples.

The opposition politician Alexei Nawalny is repeatedly the target of attacks from within this network. This was the case in an interview published by „The Capital News“ in October this year. In it, the US American Greg Butterfield sows doubt that the Kremlin could be behind Nawalny’s poisoning. The interviewee also speculates about alleged connections of Nawalny to the CIA — a common narrative used by Russian state media to discredit opposition politicians.

The alleged politician Greg Butterfield really does exist, but he is far from being the „famous American member of the opposition“ that „The Capital News“ portrays him to be. Butterfield, who did not respond to an inquiry about this investigation, is active in a niche Marxist-Leninist party in the United States and visited the Russian-occupied Donbass. It is possible that for the propaganda network, the American was merely a so-called useful idiot, a pawn used like a prompter to direct the narrative.

The interview Butterfield gave to „The Capital News“ made waves. The service „Inosmi“, which belongs to the state-owned Russian news holding „Rossija Sewodnja“, picked it up and translated the text into Russian. The German branch of the Kremlin-financed agency „Sputnik“ reported on it. Butterfield’s statements in ‚translation‘ are now more pointed. And Sputnik sold the speculations as facts.

This case demonstrates that the news portals of this network are surprisingly small. They only become effective when other media adopt their publications and give them credibility and attention, if necessary, with the aid of the state.

„Abendlich Hamburg“ repeated the gambit — apparently with success. The translation portal „Inosmi“ again served as the first propagator. In the news search of the Russian search engine Yandex, there are now approximately 40 articles from various Russian-language websites that refer to the Nawalny story of „Abendlich Hamburg“. In addition, there are articles and links in social networks that have been clicked and read thousands of times.

„Inosmi“ is intended to give Russians a view of their country from outside. The portal professionally translates primarily press from well known media houses, but also smaller blogs. When asked why it was promoting this unknown Hamburg portal of all places, it did not reply.

The traces lead to areas controlled by Moscow

This distribution mechanism is only the most obvious pointer to Russia. Technical details also reinforce the suspicion that „Abendlich Hamburg“ and the other portals in the network are jointly controlled from the Russian-speaking countries. The majority of the servers are located at the hosting provider REG.ru in Moscow. An analysis of the network also reveals numerous indications of the involvement of well-known pro-Kremlin actors.

Information registered by the DENIC, the German DNS registry, shows that the operator(s) of the sites are deliberately falsifying information to conceal the origin and extent of the network. The central registry administers all website names ending in the country code „.de“. In the case of „Abendlich Hamburg“ they lead to eight different addresses in the center of the Thuringian city of Gotha, as originally reported by the German weekly „Zeit“. The names of the responsible, however, cannot be found in the registration data.

They were not always so careful. Registration data for other domains, which can be clearly assigned to the network, contain a real name: Maxim G., whose family name is known to the authors. According to investigations by netzpolitik.org and WELT, Maxim is a 22-year-old from the East Ukrainian city of Luhansk, which is controlled by separatists. He also controls registered e-mail addresses. Several registrations even included a cell phone number linked to an account with the messenger service Telegram. The accompanying profile picture shows the photo of a young man.

And so, one calls Maxim G. On the other end a friendly young voice in Russian answers. If you ask him about „Abendlich Hamburg“ and the other websites, he surprisingly doesn’t beat about the bush, but admits his involvement. He was contacted via Telegram, he says, but he doesn’t know by whom. The idea was to set up pages that looked like news portals. He had done this rather quickly and sloppily „for a few kopecks“ — he claims to have received 11 euros per site. Maxim G. says that at the beginning there were ten websites — seven remain as of this publication.

He had heard that there was something going on with „Abendlich Hamburg“. He became scared and disabled the site. „The hosting is registered to me, but I have nothing to do with the content,“ he says. „I am simply a freelancer. I have no responsibility otherwise.“ But it is obviously not that simple, as the investigation shows.

A well-known Russian propaganda channel

On the web Maxim G. offers his services as a developer. The services in his portfolio also include the development of bots, i.e. automatically working computer programs. On his profile at the developer platform Github, he uploaded the source code for software, which shows that he has been working on programs that automatically collect and distribute content. According to the description, he also developed „Tools for working with News Front“ and a News Front extension for the internet browser Chrome.

News Front is anything but an ordinary news site. The origin of the portal goes back to the fall of the pro-Russian Ukrainian president Viktor Yanukovych and the Crimean annexation in the spring of 2014. In the beginning, articles about the war in the Donbass dominated the site. In the meantime, News Front has grown into a multilingual media company based in Crimea, which disseminates the Russian world view in other languages, including German.

According to a former employee, a large part of the budget comes from the Russian secret service, as reported by „Zeit“ in 2017. The US government’s Global Engagement Center (GEC) called the site a „disinformation and propaganda medium“ in an analysis published in August. No secret is made of its own inclinations: „We, the News Front news agency, are voluntary fighters in the information war,“ the website states.

What does Maxim G. have to say about this?

That he had developed the extension software for the portal was „a coincidence“, explains G. when asked. A News Front employee he knows asked him to write it. He had not received any compensation for it.

Shortly after this phone call, the software repository disappeared from his publicly viewable profile on Github.

In addition to the programs that Maxim G. wrote, there is a further indicator that the disinformation network that has now been uncovered has close ties to News Front.

Republic of Moldova in focus

The trail leads into the Republic of Moldova. There, following the break-up of the Soviet Union, the Transnistrian region on the eastern edge of the Republic declared itself independent. Transnistria is under Russian influence and Russian troops are still stationed there today. Russia’s strategic interest is therefore significant. This may explain why the Republic is home to the most sophisticated sites of the network.

The Russian-language site „Pravdorub“ from Moldova, for example, seems much more sophisticated than „Abendlich Hamburg“ or „The Capital News“. „Candy“ and „Zeus“ have also been assigned as its DNS servers — the same DNS servers that „Abendlich Hamburg“ used. The newly elected president Maia Sandu, who distances herself from Russia, is sharply attacked at „Pravdorub“.

Our investigation also leads via a digression to the portal „Moldova’s Echo“. In December 2019, the Moldovan „Institutul de Politici Publice“ discovered an associated Facebook group had originally been founded as a News Front group.

A few weeks before the presidential elections in the Ukraine in the spring of 2019, „Moldova’s Echo“ published a Russian-language report accusing incumbent Petro Poroshenko of corruption. Days later, the same article appeared in English on channels operated by News Front. Even diagrams, previously in Cyrillic script, were translated.

This scheme fits: The copying of articles from one website to another is common to the disinformation network around „Abendlich Hamburg“. In part, the news portals look like the extended arm of News Front. For example, an English-language article about the shooting down of Malaysia Airlines flight 17 in the Ukraine appeared on the „Britisherald“ in June 2019. It is meant to cast doubt on the work of Western investigators. On the same day, „La tarde republicana“ also published a Spanish version of the text. The original article had been published five days earlier on a sister website of News Front. It seems that someone subsequently scattered it within the network.

In October of the same year, „La tarde republicana“ and „The Capital News“ took another article on the same subject from a News Front website, which even included a reference to the source. An analysis of the source code also revealed that „La tarde republicana“ included graphics that were loaded directly from the News Front server when visitors accessed an article.

It is becoming increasingly clear that it is not just a few voices, but a choir.

A detailed catalogue of questions about the disinformation network, which netzpolitik.org and WELT sent to News Front, actually obtained a reply. The accusations, however, were dismissed as „fantasy“.

The Russian Federation Embassy in Berlin also disavows any involvement. With regard to the disinformation of „Abendlich Hamburg“ and „24-7news.eu“ about Alexej Nawalny, the embassy responded it does not comment on „unofficial media coverage“.

Even established Western news sites are manipulated

News Front has had years of experience with this strategy of spreading its own propaganda contributions as widely as possible. This investigation shows that the organisation not only uses its own channels for this purpose. In order to spread disinformation, the portal also misuses websites of renown.

On April 4, 2017, 87 people died in a chemical weapons attack in the small Syrian town of Khan Sheikhun. The West blamed the regime of Bashar al-Assad, but the dictator denied responsibility, and Putin also defended him.

A few days after this incident, someone calling herself Kate Matberg published a first article on the website of „Mediapart“. The French portal is known for its investigative journalism. Matberg listed allegations to underline that film footage of Khan Sheikhun was fake and that the attack may not have taken place at all. But Matberg was not a journalist of „Mediapart“ at all.

The article appeared in „Le Club“, a section of the website where readers post articles written by themselves. To notice this distinction, one would have to understand French. Matberg’s texts, however, appeared in English. To date she has published 115 articles in the blog.

One article is about a hacker attack on the private e-mail account of a US diplomat who, according to a report by the news magazine „Foreign Policy“, was responsible for the work of the US secret services in Russia. Matberg linked to a website where anyone could download the contents of the email account. News Front copied the post on its own portal, with a note that was probably intended to give it additional credibility: This article „first appeared on Mediapart“.

According to an investigation by netzpolitik.org and WELT, the author Kate Matberg herself was just an invention of News Front. Almost one in five of her articles contained clear references to News Front or her sister websites, again graphics had been integrated directly from servers in Moscow.

When asked, „Mediaparts“ editor-in-chief Edwy Plenel said that they knew nothing about all this. On Sunday, he had all posts in the account deleted and ordered an investigation of the user account. „The subscription was in the name of a person responsible for the ‚News Front‘ website,“ said Plenel. He did not want to comment further on this — for data protection reasons.

The reader’s blog on the „Mediapart“ website is not an isolated case, nor is Kate Matberg the only pseudonym under which News Front distributed its articles on the web. Some of the same texts appeared under the moniker Anastasia Frank on the Cypriot news website „The Duran“.

„We never were aware of this,“ Alexander Christoforou, one of the managers of the site, writes by e-mail. Anyone could post articles on „The Duran“. The website is considered to be Russia-friendly and has already attracted the attention of fact-checkers in the past because of disinformation. After our enquiry all 42 articles by Anastasia Frank were deleted.

Such articles, allegedly from Matberg or Frank, also appeared in the network to which „Abendlich Hamburg“ belonged.

Dual strategy of authoritarian states“.

According to Konstantin Kuhle, spokesman for domestic policy of the FDP parliamentary group in the Bundestag, „Abendlich Hamburg“ shows „in an exemplary way how targeted disinformation works“. Yet this case is relatively transparent. „The fact that comparable portals are recognisable in other states and in other languages illustrates how big the problem is“, said the member of Parliment.

In view of these findings, Kuhle assumes that authoritarian states are pursuing a dual strategy: On the one hand, disinformation campaigns are used to exert a targeted influence on decision-making processes in democratic states. On the other hand, the states concerned try to use the open media landscape in Germany to influence opposition members in their own states.

„The response of European states must be a joint action against such campaigns. In doing so, states like Germany must also think about a more active use and expansion of their own communication channels,“ Kuhle said to netzpolitik.org and WELT.

Regarding this investigation, Tiemo Wölken, Member of the European Parliament for the SPD, said: „Targeted disinformation campaigns such as these are often part of hybrid operations from third countries.“ The dissemination of false information is a targeted attempt to influence public discourse in Europe in order to capitalise on it.

„Many false reports in connection with COVID-19 can be traced back to campaigns from Russia and China, for example“, said Wölken. Recognising this is an important first step: „It is like the story of the Wizard of Oz, in which it turns out that the powerful, impressive wizard is just an elderly man operating a machine hidden behind a curtain.

„Abendlich Hamburg“ is down. The disinformation, however, lives on.

This investigation was done in cooperation with WELT which also published this article.