CNN:

By Donie O'Sullivan

American Herald Tribune bills itself as a "genuinely independent online media outlet." Set up in 2015, it publishes in English and pays Americans to write articles. But multiple investigations by American tech companies, details of which have not previously been reported, point to the site originating in Iran.

A Facebook spokesperson told CNN Business that company staff who looked into the website's Facebook page say it was linked to Iranian state media. Facebook removed the page in 2018. FireEye, a top cybersecurity company, says it assessed with "moderate confidence" that the website originates in Iran and is part of a much larger influence operation.

The new details about alleged Iranian ties to the American Herald Tribune shed light on how the country has attempted to run a years-long covert online influence campaign targeting the United States. As Russia did around the 2016 election, Iran appears to have co-opted and in this case paid a small number of unwitting Americans to lend legitimacy to its operations.

The sophistication described by these companies calls to mind recent US government warnings about Tehran's capabilities in cyberspace in light of the killing of top Iranian general Qasem Soleimani in a US drone strike. Some US officials have raised concerns about a conventional cyber attack that could impact US infrastructure, but this type of information and influence campaign could represent another aspect of Iran's cyber efforts, this one with the potential to impact US political discourse.

The articles posted to American Herald Tribune are largely in line with the views of Iran's ruling establishment. It publishes stories criticizing American foreign policy and attacking President Donald Trump and Israel. Often the criticism is not unlike viewpoints expressed on authentic US-based independent websites, especially ones with an anti-establishment perspective.

What appears to be one of the website's most viral stories was published during the 2016 US presidential election campaign and made unsubstantiated claims about then candidate Donald Trump's father being in the Ku Klux Klan. (Though the article appears to have been shared on Facebook in large numbers, it is impossible to determine the proportion of engaged accounts that were authentic.)

American Herald Tribune calls itself "genuinely independent" and says funding for the publication "comes from site advertising, individual donors, and private foundations." But evidence gathered by top cybersecurity company FireEye as well as by Facebook and Google paints a different picture.

In August 2018, Facebook shut down a network of 652 pages, groups, and accounts posing as independent organizations which were, it said, in fact linked to Iran state-backed media.

Facebook did not name American Herald Tribune in its public post about the takedown but a Facebook spokesperson confirmed to CNN Business earlier this month that the website's Facebook page was part of that takedown. The pages that were removed by Facebook were linked to Iranian state media, the company said.

Around the same time as the Facebook takedown, Google took action too. The company shut down Gmail and Google ad accounts linked to the same network of sites, which it also determined were linked to Iran. Google confirmed to CNN Business earlier this month that American Herald Tribune was part of that takedown. (Both Facebook and Google credited FireEye's research in helping their investigations.)

The people who run American Herald Tribune decried Facebook and Google's actions at the time, claiming "alternative media is under attack."

"It seems that the US government and its allies do not find it suffice to control mainstream media, and is, in fact, desperate to shut down any alternative media that speaks the truth," a post on the site read. Facebook, it claimed, "has become little more than a vehicle for US government censorship and Western propaganda."

Lee Foster, who leads the team at FireEye that first uncovered the network of sites, told CNN Business that "indicators, both technical and behavioral" point to American Herald Tribune being linked to an operation run from Iran.

Independent researcher and social media sleuth Josh Russell publicly posted on Twitter in 2018 further evidence supporting American Herald Tribune's alleged links to Iran.

Even after the takedowns on Facebook and Google, the website remained active and ran a Twitter account.

Twitter removed American Herald Tribune's account this month after the company was contacted by CNN Business. Twitter would not provide any information on where the account was run from, but said it was investigating.

Go to link