Cyber Jihadists Target Journalist

Top of the news agenda in Iran last week was a leaked video raising fresh doubts about the qualifications of Ayatollah Khamenei as Supreme Leader.

The 19-minute video was recorded on June 4, 1989 during a crucial meeting of the Assembly of Experts that chose Ayatollah Ali Khamenei as the new Supreme Leader of the Islamic Republic of Iran following the death of its founder, Ayatollah Khomeini.

The footage was leaked to Washington DC-based Iranian journalist Shahed Alavi. Alavi first published a short version of the film on Facebook and Twitter, and then gave the full version to BBC Persian. (The full version, with original Persian audio, is available on YouTube.)

The tape casts doubt on the competence of Khamenei and has provoked interest both inside Iran and abroad. Alavi wrote on his Facebook page that an Iranian Cyber Army agent had contacted him for an interview, posing as a producer of the Persian-language television network Manoto (“You and Me”), based in London.

“After I published this video about the meeting of the Assembly of Experts, many of my colleagues working for various media outlets asked for a copy, and naturally I complied,” Alavi tells IranWire. “Among them was a lady who presented herself as Marjan Ashtari, a former producer for Manoto TV, who asked for an interview about the video. She has a social networking account [most likely Facebook or Twitter] with 3,000 active followers and I only later found out that it’s fake.”

Alavi had no reason to doubt the veracity of the claim. He did not ask for verification from his colleagues at Manoto TV, and agreed to a Skype video interview.

“The first questions were about how I got the video and how I published it,” he says. “I answered as though it were a professional interview. Then, as the interview went on, I noticed that the questions were getting stranger and deviating from the subject. I remembered that the Cyber Army had used the same technique to obtain interviews with other journalists, with the intention of ruining their reputations.”

He adds: “As soon as I had these doubts, I cut off the connection. Eventually I found out that nobody from Manoto had contacted me and it is likely I was talking to an operative from the Cyber Army.”

Discredit Him, Discredit the Video

Alavi believes that the agents wanted to find something during the interview to discredit both him and the video. Earlier he had been targeted by hackers and phishing attacks on the web. 

“I have received many phony messages such as, ‘You must change your Facebook password. Your account is in danger!’ Authentic messages would have come from the official Facebook page, but that was not the case with these. I have also received messages asking me to click on a link that contains important information. But the sender was unknown to me, and my knowledgeable friends insisted that the attached files were unclean.”

Some media outlets have also tried to manipulate public opinion about the video, Alavi says. “Those outlets are so faithful to the ideology of the Islamic Republic that they will go to great lengths to justify certain shocking parts of its content. For this group, apparently, interviews and material provided by the Cyber Army are sufficient evidence to prove the legitimacy of what they want to believe.”

But people independent from the regime and its propaganda machine are not fooled, he believes. “Ordinary people who are aware of what is going on are not misled. Technology helps us to find out whether a video has been edited or manipulated, or whether it is credible or not.”

He adds: “If we believe that the ‘public’ means the majority of Iranians — who do not necessarily look at the world through the eyes of the official media — then such efforts to influence public opinion are bound to fail. These efforts would only convince a small minority who are ideologically aligned with the regime or whose interests are served by it.”

The New Norm of Hacking

In recent years, cyberattacks to stifle political criticism have become the norm across the world. In December 2017, Associated Press reported that Russian hackers targeted more than 200 journalists, publishers and bloggers globally, using similar techniques to those allegedly used to discredit US politicians and intelligence figures. 

Iran is following suit, and whenever there is a political crisis the accounts of journalists or activists come under cyberattack. The usual tactic is “phishing”, when a hacker pretends to be somebody else, perhaps a colleague or friend, and sends malware via a fake link or file. When opened, these allow the hacker to hijack the computer and gain access to personal information.  

The stratagem used against Alavi has also become increasingly common in recent years. Cyber Army agents will pose as journalists from credible media organizations, give the names of trusted references and ask for interviews in an attempt to dig up dirt. The material will later be published by a pro-regime news agency, often after being edited to distort the content. To date, dozens of Iranian journalists have fallen victim to this subterfuge.