<https://www.theguardian.com/world/2023/feb/15/aims-software-avatars-team-jorge-disinformation-fake-profiles>
At first glance, the Twitter user “Canaelan” looks ordinary enough. He has
tweeted on everything from basketball to Taylor Swift, Tottenham Hotspur
football club to the price of a KitKat. The profile shows a friendly-looking
blond man with a stubbly beard and glasses who, it indicates, lives in
Sheffield. The background: a winking owl.
Canaelan is, in fact, a non-human bot linked to a vast army of fake social
media profiles controlled by a software designed to spread “propaganda”.
Advanced Impact Media Solutions, or Aims, which controls more than 30,000 fake
social media profiles, can be used to spread disinformation at scale and at
speed. It is sold by “Team Jorge”, a unit of disinformation operatives based in
Israel.
Tal Hanan, who runs the covert group using the pseudonym “Jorge”, told
undercover reporters that they sold access to their software to unnamed
intelligence agencies, political parties and corporate clients. One appears to
have been sold to a client who wanted to discredit the UK’s Information
Commissioner’s Office (ICO), a statutory watchdog.
On 18 October 2020, the ICO ruled that the government should reveal which
companies were awarded multimillion-pound contracts to supply PPE after being
entered into a “VIP” lane for politically connected companies. “This is
politically motivated, it’s clear!” Canaelan lamented on Twitter two days later.
'Team Jorge' unmasked: the secret disinformation team who distort reality –
video
That comment was part of a chorus of disapproval generated by the bots, who
seemed aghast. “Information Commissioner tries everything to destroy the
government,” one said, while another described the ruling as a “desperate act”.
All of the “replies” under that and other tweets were united in their outrage
at the ICO, which they described as “a waste of time” and “lame”. As the
replies continued, they became more trenchant, making wild and false
accusations against the ICO about bribes, corruption and links to the far right.
Others just seemed nonplussed by the ICO’s insistence on transparency over the
government’s pandemic procurement. “This is so typical from the UK …” one bot
opined, “focusing on the wrong things.”
It is not known who commissioned Team Jorge to unleash the bots on the ICO, or
why. Hanan did not respond to detailed requests for comment but said: “To be
clear, I deny any wrongdoing.”
The ICO campaign appears to have been relatively short-lived compared with
others around the world that reporters have been able to link to Team Jorge’s
Aims software, which is much more than a bot-controlling programme.
Each avatar, according to a demonstration Hanan gave the undercover reporters,
is given a multifaceted digital backstory.
Aims enables the creation of accounts on Twitter, LinkedIn, Facebook, Telegram,
Gmail, Instagram and YouTube. Some even have Amazon accounts with credit cards,
bitcoin wallets and Airbnb accounts.
Hanan told the undercover reporters his avatars mimicked human behaviour and
their posts were powered by artificial intelligence.
Using the Aims-linked avatars revealed by Team Jorge in presentations and
videos, reporters at the Guardian, Le Monde and Der Spiegel were able to
identify a much wider network of 2,000 Aims-linked bots on Facebook and Twitter.
Quick Guide
About this investigative series
Show
We then traced their activity across the internet, identifying their
involvement in what appeared to be mostly commercial disputes in about 20
countries including the UK, US, Canada, Germany, Switzerland, Greece, Panama,
Senegal, Mexico, Morocco, India, the United Arab Emirates, Zimbabwe, Belarus
and Ecuador.
The analysis revealed a vast array of bot activity, with Aims’ fake social
media profiles getting involved in a dispute in California over nuclear power;
a #MeToo controversy in Canada; a campaign in France involving a Qatari UN
official; and an election in Senegal.
Tal Hanan.
Tal Hanan. Photograph: .Source: Haaretz/The Marker/Radio France
Do you have information about Tal Hanan or ‘Team Jorge’? For the most secure
communications, use SecureDrop or see our guide.
One of the Aims-backed campaigns targeted a Monaco-based superyacht company,
accusing it of having direct links to several Russian oligarchs who were
subject to sanctions.
We also identified real-world events that appeared to have been staged to
provide ammunition that could be leveraged in social media campaigns. One case
involved a fake protest staged outside a company headquarters on Regent Street,
central London.
Three masked activists in baseball caps, sunglasses and masks filmed themselves
waving placards. A similar leafletting campaign was staged near the Eiffel
Tower in Paris, before being circulated on social media by Aims bots. It is not
possible to know who the clients were in any of the campaigns, or even what
their objective was.
However, what seems clear is that the avatars peddling propaganda are doing so
with the help of stolen photographs of real people.
The photo of a beaming man on Canaelan’s Twitter bio, the Guardian has
established, was taken from the real Twitter page of Tom Van Rooijen, 25, a
freelance Dutch journalist living in the Netherlands.
Canaelan’s Twitter bio (left) was taken from the real Twitter page of Tom Van
Rooijen, a journalist in the Netherlands.
Canaelan’s Twitter bio (left) was taken from the real Twitter page of Tom Van
Rooijen, a journalist in the Netherlands. Photograph: Twitter
Informed about the identity theft by the Guardian, Van Rooijen said he felt
“quite uncomfortable” seeing his face beside a tweet expressing views he
disagreed with. “I give a lot of workshops to school classes about news, media,
journalism and fake news. I teach children weekly that their identity can be
stolen by a Twitter bot,” he said. “I never thought my own identity would be
stolen by a bot.”
Van Rooijen is likely to be among tens of thousands of unsuspecting victims
whose images have been harvested by Team Jorge.
Other techniques are also used to lend the avatars credibility and avoid the
bot-detection systems created by tech platforms. Hanan said his bots were
linked to SMS-verified phone numbers, and some even had credit cards. Aims also
has different groups of avatars with various nationalities and languages, with
evidence they have been pushing narratives in Russian, Spanish, French and
Japanese.
Those involved in the ICO campaign had been made to seem British, retweeting
news articles from the Guardian, BBC, the Daily Mail and the Telegraph. They
showed an interest in the royal family, Glastonbury and Liz Truss’s performance
as foreign minister, and posted lighthearted jokes about British weather and
food, as well as scenic photos from Wiltshire and Yorkshire.
Those backgrounds provided some credibility when, later, they suddenly began
expressing views about the UK’s data watchdog.
Twitter declined to comment. Meta, the owner of Facebook, this week took down
Aims-linked bots on its platform after reporters shared a sample of the fake
accounts with the company. On Tuesday, a Meta spokesperson connected the Aims
bots to others that were linked in 2019 to another, now-defunct Israeli firm
which it banned from the platform.
“This latest activity is an attempt by some of the same individuals to come
back and we removed them for violating our policies,” the spokesperson said.
“The group’s latest activity appears to have centred around running fake
petitions on the internet or seeding fabricated stories in mainstream media
outlets.”
For all of their apparent sophistication, some Aims avatars betrayed giveaways.
One of the Twitter bots involved in UK campaigns alongside Canaelan was
“Alexander”, whose profile picture showed a young man with a sculpted beard in
a white beanie hat. The background: orange tulips beside a chirpy slogan “Be
happy”.
And his profile bio consisted of two short sentences that hinted at an interest
in falsehoods – and how to make them convincing: “The difference between
fiction and reality?’ Fiction has to make sense.”
_______________________________________________
nexa mailing list
[email protected]
https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa
