At first glance, the Twitter user “Canaelan” looks ordinary enough. He has tweeted on everything from basketball to Taylor Swift, Tottenham Hotspur football club to the price of a KitKat. The profile shows a friendly-looking blond man with a stubbly beard and glasses who, it indicates, lives in Sheffield. The background: a winking owl.
Canaelan is, in fact, a non-human bot linked to a vast army of fake social media profiles controlled by a software designed to spread “propaganda”.
Advanced Impact Media Solutions, or Aims, which controls more than 30,000 fake social media profiles, can be used to spread disinformation at scale and at speed. It is sold by “Team Jorge”, a unit of disinformation operatives based in Israel.
Tal Hanan, who runs the covert group using the pseudonym “Jorge”, told undercover reporters that they sold access to their software to unnamed intelligence agencies, political parties and corporate clients. One appears to have been sold to a client who wanted to discredit the UK’s Information Commissioner’s Office (ICO), a statutory watchdog.
On 18 October 2020, the ICO ruled that the government should reveal which companies were awarded multimillion-pound contracts to supply PPE after being entered into a “VIP” lane for politically connected companies. “This is politically motivated, it’s clear!” Canaelan lamented on Twitter two days later.
That comment was part of a chorus of disapproval generated by the bots, who seemed aghast. “Information Commissioner tries everything to destroy the government,” one said, while another described the ruling as a “desperate act”.
All of the “replies” under that and other tweets were united in their outrage at the ICO, which they described as “a waste of time” and “lame”. As the replies continued, they became more trenchant, making wild and false accusations against the ICO about bribes, corruption and links to the far right.
Others just seemed nonplussed by the ICO’s insistence on transparency over the government’s pandemic procurement. “This is so typical from the UK …” one bot opined, “focusing on the wrong things.”
It is not known who commissioned Team Jorge to unleash the bots on the ICO, or why. Hanan did not respond to detailed requests for comment but said: “To be clear, I deny any wrongdoing.”
The ICO campaign appears to have been relatively short-lived compared with others around the world that reporters have been able to link to Team Jorge’s Aims software, which is much more than a bot-controlling programme.
Each avatar, according to a demonstration Hanan gave the undercover reporters, is given a multifaceted digital backstory.
Aims enables the creation of accounts on Twitter, LinkedIn, Facebook, Telegram, Gmail, Instagram and YouTube. Some even have Amazon accounts with credit cards, bitcoin wallets and Airbnb accounts.
Hanan told the undercover reporters his avatars mimicked human behaviour and their posts were powered by artificial intelligence.
Using the Aims-linked avatars revealed by Team Jorge in presentations and videos, reporters at the Guardian, Le Monde and Der Spiegel were able to identify a much wider network of 2,000 Aims-linked bots on Facebook and Twitter.
The Guardian and Observer have partnered with an international consortium of reporters to investigate global disinformation. Our project, Disinfo black ops, is exposing how false information is deliberately spread by powerful states and private operatives who sell their covert services to political campaigns, companies and wealthy individuals. It also reveals how inconvenient truths can be erased from the internet by those who are rich enough to pay. The investigation is part of Story killers, a collaboration led by Forbidden Stories, a French nonprofit whose mission is to pursue the work of assassinated, threatened or jailed reporters.
The eight-month investigation was inspired by the work of Gauri Lankesh, a 55-year-old journalist who was shot dead outside her Bengaluru home in 2017. Hours before she was murdered, Lankesh had been putting the finishing touches on an article called In the Age of False News, which examined how so-called lie factories online were spreading disinformation in India. In the final line of the article, which was published after her death, Lankesh wrote: “I want to salute all those who expose fake news. I wish there were more of them.”
The Story killers consortium includes more than 100 journalists from 30 media outlets including Haaretz, Le Monde, Radio France, Der Spiegel, Paper Trail Media, Die Zeit, TheMarker and the OCCRP. Read more about this project.
Investigative journalism like this is vital for our democracy. Please consider supporting it today.
We then traced their activity across the internet, identifying their involvement in what appeared to be mostly commercial disputes in about 20 countries including the UK, US, Canada, Germany, Switzerland, Greece, Panama, Senegal, Mexico, Morocco, India, the United Arab Emirates, Zimbabwe, Belarus and Ecuador.
The analysis revealed a vast array of bot activity, with Aims’ fake social media profiles getting involved in a dispute in California over nuclear power; a #MeToo controversy in Canada; a campaign in France involving a Qatari UN official; and an election in Senegal.
One of the Aims-backed campaigns targeted a Monaco-based superyacht company, accusing it of having direct links to several Russian oligarchs who were subject to sanctions.
We also identified real-world events that appeared to have been staged to provide ammunition that could be leveraged in social media campaigns. One case involved a fake protest staged outside a company headquarters on Regent Street, central London.
Three masked activists in baseball caps, sunglasses and masks filmed themselves waving placards. A similar leafletting campaign was staged near the Eiffel Tower in Paris, before being circulated on social media by Aims bots. It is not possible to know who the clients were in any of the campaigns, or even what their objective was.
However, what seems clear is that the avatars peddling propaganda are doing so with the help of stolen photographs of real people.
The photo of a beaming man on Canaelan’s Twitter bio, the Guardian has established, was taken from the real Twitter page of Tom Van Rooijen, 25, a freelance Dutch journalist living in the Netherlands.
Informed about the identity theft by the Guardian, Van Rooijen said he felt “quite uncomfortable” seeing his face beside a tweet expressing views he disagreed with. “I give a lot of workshops to school classes about news, media, journalism and fake news. I teach children weekly that their identity can be stolen by a Twitter bot,” he said. “I never thought my own identity would be stolen by a bot.”
Van Rooijen is likely to be among tens of thousands of unsuspecting victims whose images have been harvested by Team Jorge.
Other techniques are also used to lend the avatars credibility and avoid the bot-detection systems created by tech platforms. Hanan said his bots were linked to SMS-verified phone numbers, and some even had credit cards. Aims also has different groups of avatars with various nationalities and languages, with evidence they have been pushing narratives in Russian, Spanish, French and Japanese.
Those involved in the ICO campaign had been made to seem British, retweeting news articles from the Guardian, BBC, the Daily Mail and the Telegraph. They showed an interest in the royal family, Glastonbury and Liz Truss’s performance as foreign minister, and posted lighthearted jokes about British weather and food, as well as scenic photos from Wiltshire and Yorkshire.
Those backgrounds provided some credibility when, later, they suddenly began expressing views about the UK’s data watchdog.
Twitter declined to comment. Meta, the owner of Facebook, this week took down Aims-linked bots on its platform after reporters shared a sample of the fake accounts with the company. On Tuesday, a Meta spokesperson connected the Aims bots to others that were linked in 2019 to another, now-defunct Israeli firm which it banned from the platform.
“This latest activity is an attempt by some of the same individuals to come back and we removed them for violating our policies,” the spokesperson said. “The group’s latest activity appears to have centred around running fake petitions on the internet or seeding fabricated stories in mainstream media outlets.”
For all of their apparent sophistication, some Aims avatars betrayed giveaways. One of the Twitter bots involved in UK campaigns alongside Canaelan was “Alexander”, whose profile picture showed a young man with a sculpted beard in a white beanie hat. The background: orange tulips beside a chirpy slogan “Be happy”.
And his profile bio consisted of two short sentences that hinted at an interest in falsehoods – and how to make them convincing: “The difference between fiction and reality?’ Fiction has to make sense.”
