August 09, 2019
The Islamic Republic is suspected of being behind a fake news report that Canadian police have implicated US National Security Adviser John Bolton in drug trafficking.
On August 6, a Twitter user claiming to be a high-ranking Canadian law enforcement official posted records supposedly showing a $350,000 wire transfer from a Canadian children’s apparel company to a Swiss bank account belonging to Bolton’s daughter. The tweet linked the payment to drugs.
Lee Foster, an information operations intelligence analyst at the cybersecurity firm FireEye, told The Daily Beast the hoax’s techniques are “consistent with what we’ve seen with previous pro-Iranian influence operations.”
Foster emphasized that there wasn’t enough information to attribute the Bolton hoax to Iran or any other specific party yet. But the lone country where the fake report has gotten attention in the news media is Iran.
The Twitter account at issue impersonated a high-ranking Toronto police officer named Donald Belanger. Twitter suspended the fake Belanger account and Toronto Police Service spokesman Alex Li confirmed to The Daily Beast that it was “a fraudulent” persona. The real police official the account had impersonated has never had a Twitter account and Toronto’s Police Service does not tweet out information naming witnesses, victims, and other sensitive information in the course of criminal investigations, Li said.
The operator of the account first registered it in 2013 and appears to have originally tweeted in Arabic before repurposing the account into a fake Toronto police official. The account retweeted a stream of content from Canadian police accounts and mentioned nothing about Iran or Bolton until August 6.
Though Twitter quickly removed the tweet and suspended the account, it had already been picked up by a handful of websites, including Iran Front Page, which caught the attention of the Iran Times.
Iran Front Page attributed its story to a tweet from a “senior Canadian law enforcement agent from the Toronto Police Drug Squad”—the fake police account—but has not updated or corrected its story to reflect the account’s suspension or the Toronto Police Service’s confirmation that the account was fake.
In May, FireEye assessed with “low confidence” that a series of fake Twitter accounts impersonating US and Israeli political candidates and reporters “was organized in support of Iranian political interests.” The fake accounts published content in line with Iranian foreign policy, but FireEye was unable to pinpoint the identity or location of those behind it.
In other cases, FireEye has found more direct ties between social media influence campaigns and Iran. An August 2018 report from the company cited a network of interconnected fake news websites and Facebook pages echoing “anti-Saudi, anti-Israeli, and pro-Palestinian themes” tied to Iranian state-run media outlets.
