Bogus fact-checking site amplified by dozens of Indian embassies on social media

Site published spurious fact-checks & other content that were amplified by over 50 Indian diplomatic accounts on Twitter & Facebook

@DFRLab
@DFRLab
May 27 · 14 min read
(Source: @oddbench)

By Ayushman Kaul

A Canada-based communications firm created a website presenting itself as an Indian media outlet and fact-checking site, then used it to promote narratives supporting the Indian government. Articles from the website, written to influence public perception in favor of the Modi government and against its opponents, were amplified by verified social media accounts of dozens of Indian embassies and consulates on Twitter and Facebook.

The Toronto-based company Press Monitor created and managed the website, India Vs. Disinformation, and the site’s social media accounts. It also registered and published a parallel pro-government site, India News Network, which served as the primary content provider for India vs. Disinformation.

The firm used India Vs. Disinformation to amplify and aggregate pro-government content while simultaneously publishing “fact checks” targeting the government’s political opponents, as well as local and international media outlets for their critical coverage of the current administration. While the communications firm never disguised the fact that it ran the website, its use of fact-checking and disinformation-monitoring rhetorical tropes gives casual readers the impression that it is an independent news source.

This instance is the latest in a series of cases in which PR companies and digital communications firms operate online publishing networks claiming to fight disinformation while simultaneously aligning with individual politicians or governments. The DFRLab has reported on prior examples of so-called “disinformation-as-as-service” providers, including our coverage of Operation Carthage and Archimedes Group.

In a written response to questions posed by the DFRLab, the company confirmed that it had contracts with the Indian government and some of the country’s foreign embassies to conduct media monitoring services but claimed that India Vs. Disinformation was a separate independent initiative not related to these contracts. Press Monitor also told the DFRLab that it created the websites as a means of gaining the favor of and receiving further commercial contracts from the Indian government.

India Vs. Disinformation

Press Monitor created India Vs. Disinformation (IVD), a spurious news and fact-checking outlet populated by content generated by its companion site, India News Network (INN). While projecting themselves as independent media outlets, they were both managed by the PR firm. Under the tagline “Truth Matters,” IVD presents itself as “an online news portal which brings to you authentic information about the world’s largest democracy.” Its About page, though, gives the strong impression that the site exists to counter foreign propaganda and negative coverage of India from western news outlets:

The About page also acknowledges that the site is run by Press Monitor Inc, based in Toronto.

India Vs. Disinformation’s homepage, which was populated with pro-government content and questionable fact-checks. (Source: India Vs. Disinformation/archive)

Among the more notable parts of the homepage is a section dedicated to combatting disinformation, though focused on rejecting claims that might paint the Indian government in a poor light.

The “Disinformation” section of the homepage focuses on debunking claims that might hurt the Indian government’s image. (Source: India vs. Disinformation/archive)

The firm also managed social media handles for India Vs. Disinformation on Facebook, Twitter, Instagram, and YouTube.

India vs. Disinformation maintained a presence on social media, using these accounts as vehicles to disseminate junk news links. (Source: Instagram/archive, top left; YouTube/archive, top right; Facebook/archive, bottom left; @IndiavsDisinfo/archive, bottom right)

An analysis of IVD activity between April 2020 and April 2021 using the social media monitoring tool BuzzSumo highlighted how the website, which began to publish articles in April 2020, significantly increased its output by June 2020, jumping from eight articles in April to 67 articles in June. An examination of links redirecting to the outlet’s website revealed that IVD’s content received extremely limited social media engagement, averaging eight engagements per story on Twitter and one engagement per story on Facebook.

Graph plotting number of articles published by the outlet, as well the engagement with these articles on various social media platforms. (Source: @dfrkaul/DFRLab via BuzzSumo)

A junk news aggregator

Since April 2020, the network amplified links from its associated site, India News Network, which in turn published stories favorable to the Modi government.

Screenshot of India News Network, created and managed by Press Monitor, which presents itself as an independent Indian media outlet. (Source: IndiaNewsNetwork)
Screenshot of IVD “News & Opinion” section consisting of an aggregation of news articles from India News Network. (Source: India Vs. Disinformation/archive)

Many of these articles amplified pro-government narratives around controversial policy decisions enacted by the Indian central government, including the abrogation of Article 370 of the Indian Constitution, which defines Kashmir’s relationship with India, the enactment of the controversial Citizenship Amendment Act, which includes a loophole that allows for religious persecution, and the targeting of Muslims amid sectarian violence in Delhi.

An internal website search on IVD using the keywords “Article 370” and “Delhi riots” reveal how the website aggregates multiple junk news links from its associated websites furthering pro-government narratives on these topics. (Source: India Vs. Disinformation/archive)

The network also sought to manipulate domestic public perception of foreign policy issues, such as the COVID-19 outbreak and the government’s response to it, ongoing border tensions between India and China, and attitudes toward Pakistan on a range of political and humanitarian issues. On YouTube, for example, it used another disinformation-monitoring trope, a video playlist called “Mythbusters,” to criticize Pakistan and its government.

“Mythbusters” Youtube playlist created by IVD with a majority of the videos targeting politicians in Pakistan. (Source: YouTube/archive)

Other pro-government content published by India News Network and aggregated on the India Vs. Disinformation website sought to discredit reporting on India by international media outlets, accusing them of exhibiting Western bias in their coverage of various political developments in the country. This content was categorized under the header “Disinformation.”

Various headlines of India News Network “fact-checks” hosted on IVD website that accuse international outlets of biased reporting. (Source, top to bottom: IndiaNewsNetwork/archive; IndiaNewsNetwork/archive; IndiaNewsNetwork/archive; IndiaNewsNetwork/archive)

Eroding distinctions between real news and junk news

One the most significant characteristics of the Press Monitor operation was the manner in which it sought to utilize its associated pages to aggregate both traditional and junk news sources.

In some cases, junk news stories published by India News Network would source their information from the IVD website, which would then post the India News Network story, creating a self-sustaining information loop.

Example of India News Network offering a point-by-point rebuttal of an article by BBC News on the community transmission of COVID-19 in India. The story sources IVD at the bottom, redirecting users to the outlet’s homepage. (Source: India News Network/archive)

In other cases, individual articles would blend in-house opinion pieces published under the moniker “IVD Bureau,” with sections of text taken from Press Monitor’s associated websites. Other articles published by IVD combined provocative headlines with sections of plagiarized text originally published by traditional Indian news sites, partisan outlets, and state-owned publications, including Kremlin-owned RT and Sputnik. Together, these tactics effectively worked to erode the distinction between sources of high quality and low quality information.

An example of an article published by IVD that combined a provocative headline with references to an op-ed published by Russian state-owned media outlet Sputnik News. (Source: IndiaVsDisinformation/archive)

Connecting the dots

Open-source evidence uncovered by the DFRLab was corroborated by an examination of the network’s publicly facing website content, the source code for the individual websites as well as the network infrastructure underpinning India Vs. Disinformation operation. This examination revealed a wealth of links between Press Monitor and India News Network, as well as commercial services, propaganda pages, and political pages hosted by the organization.

On the web pages themselves, the DFRLab identified multiple indicators that they were operated jointly. The About page of India News Network, for example, features a summary of its business services that is verbatim to the business services listed on the IndiaVsDisinformation About page.

The About pages of India News Network and IVD presented identical lists of “media-related services.” (Source: India News Network/archive, left; IndiaVsDisinformation/archive, right)

The source code of the various websites revealed that images published by them were hosted centrally on the same Amazon Web Services (AWS) account. The AWS bucket (https://ankpublic.s3.amazonaws.com, though access is now denied) was linked to an earlier website connected to Press Monitor owner Abhay Aggarwal and provided a strong indicator that the pages belonged to the same network. Since being contacted by the DFRLab with questions regarding their involvement in the operation, the firm has since taken the link down.

Page source code of the IVD website highlighting how the website shares a common Amazon Web bucket with INN. (Source: India vs. Disinformation/archive)

In addition to a shared AWS, the websites also shared a Google Analytics code and a dedicated web server hosting the sites. A search using DomainTools’ IRIS tool revealed that a relatively small number of websites, including Press Monitor, and India Vs. Disinformation, were hosted at the same IP address. These, in turn, had traceable links to Aggarwal. Such a small number of websites on a single IP address is indicative of a dedicated or local hosting solution, both of which would indicate a link between the websites hosted on the same IP. In addition, these websites also used the same Google Analytics ID (UA-155248165) to track traffic and engagement on their webpages.

Hive network graph plotting the links between the various websites (blue), IP address (orange), Google Analytics ID (silver), and WHOIS registration information (brown) for the IVD operation. (Source: @dfrkaul/DFRLab via DomainTools)

Amplification by Indian embassies and consulates

Despite the fact that IndiaVsDisinformation is a relatively new site with limited social media engagement, it is particularly notable that among its biggest boosters online are verified social media accounts of Indian embassies and consulates around the world. For example, India’s embassies in Sweden, Syria, and Mongolia amplified IVD articles on their verified Facebook pages.

Examples of verified Facebook pages belonging to Indian diplomatic consulates across the world amplifying links to IVD on the platform. (Source: India in Sweden/archive, left; India in Syria/archive, center; India in Mongolia/archive, right)

Most notable, though, is the amplification IVD received from Indian diplomatic Twitter accounts. A query using the open-source Twitter tool TweetBeaver analyzing the 10,000 most-recent followers of the @IndiaVsDisinfo account found that ir was followed by more than 40 verified handles belonging to different Indian diplomatic embassies and consulates, including the Indian diplomatic missions in Geneva, Iran, Qatar, New Zealand, and Canada.

Results of a TweetBeaver query showing @IndiaVsDisinfo Twitter account is followed by a number of verified accounts belonging to Indian diplomatic missions abroad. (Source: @dfrkaul/DFRLab via TweetBeaver)

The DFRLab conducted a deeper review of these diplomatic accounts to determine whether they amplified IVD tweets or stories. Of the 192 verified Twitter accounts aggregated by the public diplomacy office of India’s Ministry of External Affairs, at least 52 of these verified accounts (27 percent of total) had retweeted @IndiaVsDisinfo. Among the most prolific were India’s diplomatic missions in Sweden (88 retweets), Mexico (29), Jamaica (14), Fiji (12), Panama (11), and Botswana (9). In total, the 52 accounts amplified India Vs. Disinformation on at least 430 different occasions.

Bar graph showing the accounts operated by Indian government entities that were most prolific in retweeting the @IndiavsDisinfo Twitter account. (Source: DFRLab via TweetBeaver)

In terms of specific @IndiavsDisinfo tweets amplified by Indian diplomatic accounts, the most widely retweeted posts were highly critical of Pakistan. The most amplified tweet, retweeted by 33 of the accounts, posted graphic images of a boy with his dead grandfather. “These pictures speak more than a thousand words,” the IVD tweet stated. “Demonic Pakistan sponsored terrorists gruesomely kill an elderly gentleman even as his grandchild helplessly looks on. Our brave Indian security forces saved the child.”

@IndiavsDisinfo tweet retweeted by 33 Indian diplomatic accounts. One image has been blurred due to its graphic nature. (Source:@IndiavsDisinfo/archive)

A less graphic IVD tweet appearing to be from the same incident was retweeted by at least 17 of the diplomatic accounts.

Not all IVD content retweeted by diplomatic accounts was political in nature, though. Two tweets about Google investments in India were retweeted by at least six diplomatic accounts each.

Anatomy of a PR firm

According to IVD’s About page, Press Monitor Inc is based in Toronto. The company maintains two nearly identical websites, www.pressmonitor.com and www.pressmonitor.ca; the former features a contact phone number with an Indian country code (+91) while the latter website features contact information with a Canadian mailing address and phone number. On the .com website, the firm advertises itself as “Media Intelligence for Public Relations.”

Press Monitor home page. (Source: Press Monitor.com/archive)

Also, on the .com website, the firm offers news monitoring and social media marketing as part of a range of “content creation” and “content dissemination” services to its clients.

The website advertises the “content creation” and “content distribution” services offered by the firm. (Source: Press Monitor.com/archive)

Additionally, Press Monitor’s “Our Clients” page lists multiple Indian government entities among its clients, including the office of the president and the prime minister, as well as “all Indian embassies, high commissions and consulates worldwide.” In a statement to the DFRLab, Abhay Aggarwal, the owner of Press Monitor, said that this is in reference to their media monitoring services and not connected to IndiaVsDisinformation, which he stated he ran independently.

Screenshot from Press Monitor’s Our Clients page. (Source: Press Monitor/archive)

Further examination of the firm’s website indicated that it is a subsidiary of Business News and Informational Services Private Limited (BNI), a New Delhi-based news monitoring and media relations firm.

“About Us” section of Press Monitor Website listing that the firm is part of BNI, a larger New Delhi based firm. (Source: Press Monitor/archive)

Company filings for BNI located on open-source Indian companies directory Zaubacorp reveal that BNI was incorporated in 1994, with Aggarwal listed as the original director of the firm.

Company brief and director details for Business News and Informational Services on Zaubacorp, an open-source company directory website. (Source: Zaubacorp/archive)

Aggarwal’s LinkedIn profile corroborated that he was the director of both BNI and Press Monitor. On his profile, the businessman used language similar to what appears on the Press Monitor clients page, claiming that his firm’s services “are used by President of India, Prime Minister of India, all the ministries of the Indian government, all Indian embassies worldwide,” and other clients.

LinkedIn profile of Abhay Agarwal, the director of both BNI and its subsidiary Press Monitor. (Source: LinkedIn/archive)

Following the DFRLab’s outreach, Aggarwal removed the mention of BNI on his LinkedIn page, along with Ankiti Technologies and Bushchat Inc., which appear to be subsidiaries of Press Monitor in the UAE and United States respectively.

Aggarwal’s LinkedIn profile, before and after DFRLab reached out for comment. (Source: LinkedIn/archive, LinkedIn/archive)

Other business interests

While researching IndiaVsDisinfo and its related websites, the DFRLab discovered other business activities by Press Monitoring, including the “cyber-squatting” of domains named after key BJP-government initiatives, including Pradhan Mantri Jan Dhan Yojana (PMJDY), Pradhan Mantri Adarsh Gram Yojana (PMAGY), and Digital India.

Examples of the “cyber-squatting” websites created by the firm named after key government initiatives. (Source: pmjandhanyojana.org/archive, top; http://adarshgramyojana.org/archive, middle; digital-india.org/archive, bottom)

Another website uncovered during the DFRLab investigation, Jigyasa Online, publishes inflammatory content targeting both China and Indian Muslims. The website appears to be a work-in-progress — its About page, privacy notice and terms of service are all missing — and multiple backlink searches revealed almost no other websites linking to it. Curiously, the Facebook and Twitter buttons on its homepage both point to social media accounts run by India Vs. Disinformation. In his statement to the DFRLab, Abhay Aggarwal said that Jigyasa Online “has nothing to do with us,” though he acknowledged it was hosted on his server.

Jigyasa Online’s homepage. The Twitter and Facebook buttons at the top of the page point to the respective Twitter and Facebook accounts for India Vs. Disinformation. (Source: Jigyasa Online/archive)

Meanwhile, an examination of the hosting histories of various websites hosted on the Press Monitor IP address revealed a diverse range of domains, including websites offering bulk SMS capabilities, commercial websites for businesses in India and the Middle East, as well as two websites affiliated with RSS, an extremist right-wing organization in India. Aggarwal registered one of the RSS sites, Swayamsevak, in 2016, according to a historical WHOIS search on Domain Big Data.

Historical WHOIS data revealed Abhay Aggarwal registered Swayamsevak in 2016. (Source: Domain Big Data/archive)

A second RSS-affiliated domain, PracharVibhag.org, is more mysterious. Over a period of several years, its homepage included the RSS logo and the text “Prachar Vibhag User panel.” It then contained a nondescript user and password form. At the bottom of the page, the header text stated, “For any problems and suggestions on this new Prachar Vibhag website, please contact Abhay Aggarwal,” followed by his phone number and Press Monitor email address. According to Aggarwal, he is squatting on the domain in search of a buyer. The homepage disappeared not long after the DFRLab reached out to him for comment.

Archival version of Prachar Vibhag homepage, including footer text referencing Abhay Aggarwal and Press Monitor. (Source: Internet Archive)
Prachar Vibhag homepage at the time of publishing in May 2021. (Source: Prachar Vibhag/archive)

In a series of emails to the DFRLab, Aggarwal denied that India Vs. Disinformation was linked to any of his clients. According to him, the website was developed to showcase the firm’s ability to produce videos, graphics, and other types of content. The DFRLab asked why he decided to use an alleged fact-checking website to showcase these products, rather than a portfolio, but did not receive an answer to that particular question. Asked about Indian diplomatic missions amplifying India Vs. Disinformation content, Aggarwal said the site has “many stories hoping missions will promote these” but was unaware how many diplomatic social media accounts had posted India Vs Disinformation’s content.

Aggarwal also reaffirmed that he had previous contracts with the Indian government and claimed that they were for media monitoring, not for public relations or political communications. “They have nothing to do with this project [IVD],” he said. “In fact, I don’t have social media or promotion work business with any government of India ministry or any Indian embassy. We have bid but have not been successful. We give them media monitoring services just as we do to anybody who is willing to pay.”

These contracts outlining the contours of his work agreements with the government are not publicly available, so the DFRLab was unable to verify his claim. He also denied that Press Monitor was responsible for Jigyasa Online, saying the website was simply registered on the company’s servers. Finally, he stated that he had registered the RSS-affiliated domain Prachar Vibhag and others to re-sell them in the future, confirming that he intentionally cyber-squats certain domains.

Conclusion

Among the most important trends observed by the DFRLab in recent years is the troubling increase of documented cases in which PR companies offer disinformation production and distribution as a service to their clients. In years past, the most egregious examples were often of shady enterprises offering their unethical services to non-democratic governments, but recent investigations by the DFRLab and others working in this field have led to a growing number of case studies regarding legitimate PR firms offering disinformation services to clients in democracies.

In this particular case, there is no open source evidence suggesting the Indian government or anyone affiliated with it paid Press Monitor to run this operation; in fact, the owner claims he created the network to drum up business with the government, which in itself is a noteworthy development. That, combined with the fact that over 50 verified Indian diplomatic Twitter accounts have amplified their tweets more than 400 times makes this an important case study for those who research the increasingly visible trend of disinformation-as-a-service, the blurring of overt political communications and official government accounts, and disinformation campaigns in democracies more broadly.

Ayushman Kaul is a Research Assistant, South Asia, with the Digital Forensic Research Lab.

Cite this case study:

Ayushman Kaul, “Bogus fact-checking site amplified by dozens of Indian embassies on social media,” Digital Forensic Research Lab (DFRLab), May 27, 2021, https://medium.com/dfrlab/bogus-fact-checking-site-amplified-by-dozens-of-indian-embassies-on-social-media-7b4b31004699.

Follow along for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.