In May, the Committee to Protect Journalists listed the top 10 tools used by online oppressors. Iran was highlighted as a master of web blocking; Burma a dab hand at attacking exile-run sites; and the Egyptian authorities employed the use of the kill switch with devastating effect.
Another tool they might have added is cloning.
Another tool they might have added is cloning.
In December, in the middle of Belarus' postelection protests, a number of opposition websites were forced down by distributed denial of service (DDoS) attacks. But instead of just pulling them down, some independent media websites were also mirrored, including the website of RFE/RL's Belarus Service. (I’m carefully using a passive tense here as it’s difficult to prove that this was the work of the Belarusian state or state-connected actors.)
The mirrored sites seemed to have two primary purposes: 1) to present an exact mirror minus any overtly critical stories of the authorities. 2) disinformation, for example by presenting inaccurate information about the time/location of opposition rallies.
This fight has now been taken to the arena of social media. Shaun Walker, a correspondent for Britain's "Independent," noticed that his Twitter account had been cloned:
On Sunday I was at one of the regular "clapping" protests in Minsk, where people unhappy at dictator Alexander Lukashenko's regime mobilise online and arrange to meet in a particular location and simply clap their hands. The protest was crushed by plain-clothed thugs, who waded in and threw people at random into military trucks. Most of those arrested were given a fine, some were given 15 days in prison.
As the events unfolded on the square, the ruthlessness of the police shocked me, and as there were few international journalists present, I started tweeting what I was seeing. Clearly, this was noticed. On Wednesday evening, while the latest protests in Belarus ended up with another 400 people detained, a certain Shaun Walker was tweeting like crazy. Someone had stolen the photograph of me from my real Twitter account, @shaunwalker7, and set up a clone account, @shaunnwalker. The fake "me" spent the two-hour protest period on Wednesday evening spewing out nonsense tweets and false information in Russian, at a rate of about one per minute. "The police have been allowed to use rubber bullets," my clone account informed people at one point. "Everyone should go home, most of the coordinators have been arrested," the account said a little later.
He wasn’t the only one. Our Belarus Service received the usual treatment -- journalists arrested and website attacked -- but this time around their YouTube page was also cloned. The fake site had a very similar address: youtube.com/svabodavideos instead of youtube.com/svabodavideo and looked identical to ours, logo and all.
I didn’t see the site myself as it was relatively quickly taken down, but one of our broadcasters, Bohdan Andrusyshyn, said that “the fake site had a few videos, titled more or less accurately (i.e. "Clapping protests in Belarus" or "Brutal dispersal of protests").”
“But when you opened them, the video had nothing to do with the title, for example you would see the inside of what appeared to me to be a New York subway car, or some guy talking to a little boy,” he said.
A complaint was made and the site was taken down as it violated YouTube’s policy of content designed to impersonate another person or user.
I don’t know of many other examples of the cloning of opposition/dissident websites for the purposes of disinformation. Has anyone heard of any others?
In a BBC report from June 16 about how African governments are increasingly using more sophisticated tools to clamp down on the Web, there was mention that the Tanzanian government was cloning a Swahili-language version of WikiLeaks.
But apart from that, I haven’t turned up much else.
But apart from that, I haven’t turned up much else.