Iranian social media users have denounced a domestic messaging app, Rubika, for serial identity theft. The row broke out at the weekend after Twitter user and social media marketing specialist Houman Ghorbanian searched for his name on Rubika. He discovered the app had registered a fake account using his name and photo, crawling and uploading all his real Instagram posts onto the fake page on a daily basis. Within a few hours, hundreds of Twitter users were posting identical allegations. The furious victims included ordinary citizens, footballers and artists.
The Rubika scandal comes just after the hugely controversial “Bill for the Protection of Cyberspace Users”, which proposes to drastically limit Iranians’ access to the world wide web and put the military in control of internet traffic, was approved by parliament. Foreign social media platforms such as WhatsApp are set to be blocked in Iran if they don’t adhere to internal rules, leaving many Iranians with no option but to use domestic copycat versions. The Rubika debacle has led many to suspect that either the app’s developers or the Iranian authorities are trying to lend these new platforms greater credibility, making bogus accounts to give a false impression of the user base.
Rubika’s parent company, Tosca Business Development Company, was officially registered on October 8, 2017. At that time, the sole shareholder was Hamrah-e Aval: Iran’s biggest telecommunications network, which is owned by the Islamic Revolutionary Guard Corps.
In essence, Rubika was created by the IRGC as a domestic replacement for Instagram. But its low quality and, more importantly, Iranians’ reluctance to hand over their personal data to the Islamic Republic’s security agencies, made it struggle to take off in the same manner as other Iranian-made copycat apps Soroush, Gap and Yes.
Rubika has tried without much success to deny the allegations, blaming bad actors and third parties using the platform. In the aftermath of this weekend’s revelations, more than 100 attempts were made to hack Houman Ghorbanian’s Twitter account. The social media expert said he believes the Rubika identity theft is “definitely” related to the disputed internet filtering bill. “They want these fake accounts to say that people trust them, to prove their success,” he said. “Their intelligence is low; they don’t realize they’ll be disgraced every time.
“The fake accounts for celebrities and football players were also given a blue check. For someone’s identity to be officially confirmed, a video or image of the user's identification documents must be sent to the administrators. So clearly, Rubika’s claim that they didn’t create these accounts themselves – and that it’s the work of other users – is a complete lie."
Ghorbanian is also resigned to the idea that after the internet shutdown in November 2019 and during recent protests in Khuzestan, the authorities will eventually finish building the long-anticipated "National Information Network" and completely disconnect Iran from the world wide web. "After November 2019, and the 13-day global internet shutdown in Iran,” he said, “it became clear they have the ability to manage the internal internet to launch websites within the country.
“Also, most online businesses in Iran were forced to transfer their servers into Iran after November 2019 in order to operate. So, this coercion has often worked. During the 13-day shutdown, I had no other way to pass the time than by looking at Iranian search engines. Imagine, if one day Instagram and WhatsApp are filtered and there’s no way to connect to the global internet using anti-filtering software, what can Iranian users do other than use Iranian messengers?"
He stressed that he would have no issue with the launch of Iranian social media apps “if it takes place in a free and competitive environment. It should not be the result of blocking foreign competitors and forcing Iranian citizens to use domestic products."
IranWire contacted Nemat Ahmadi, a lawyer in Tehran, asking him for his view on the bizarre actions of Rubika’s management. He replied: “If this happened without users’ permission, it’s a case of forged documentation and the operators of these apps can be prosecuted. They have stolen information, photos and names of various users, and plaintiffs could sue Rubika in the Culture and Media Court.
“Strange that the managers of a messaging app would permit themselves to invade the privacy of thousands of users like this. With regard to the Bill for the Protection of Cyberspace Users and forcing citizens to use Iranian apps, I also believe this will be in vain. With the increasing advancement of satellite internet technology into the market, this government project will fail, just like the previous project to ban satellite dishes.”
In a tweet about the fake accounts on Rubika, Amir Rashidi, a cybersecurity expert, said he didn’t expect the operators to face criminal or civil reprisal. “What did they do when [communications minister Mohammad-Javad Azari] Jahromi and [deputy minister Amir] Nazemi were criticized because of the creation of accounts on Soroush without informing the owners? Nothing! Now this practice has become a normal phenomenon. They build accounts in the names of the people in order to deceive the rest of the nation. Security and privacy are nothing more than a joke.”
“They present content to get people using the messenger," said programmer Ashkan Norouz-Zadeh. "Then they restrict Instagram on the pretext of the same users and content creators."