Indian Actors | Investigation
44:26 Share

Welcome to True Spies. Week by week, mission by mission, you'll hear the true stories behind the world's greatest espionage operations. You'll meet the people who navigate this secret world. What do they know? What are their skills? And what would you do in their position?

This is True Spies. And so this organization, which was supposed to be defunct, to have stopped its activities in 1973, started to be active again at the UN Human Rights Council. They have decided to use the name of one of the former presidents. The only problem with that...

is that they used the name of someone who died one year before they used this name. Episode 51: Indian Actors Don't believe everything you read. That's the moral of this week's story.

We were really curious why a website which seems to be connected to Russia according to the media report will focus that much and have so much connection with India and with geopolitical issues linked to South Asia. You're about to enter a hidden world of malign influence, operating at the heart of the world's most important international organizations.

A world in which bad actors operate behind layers of misdirection. Where fake news and phony lobbyists fuel deadly rivalries between nuclear powers. Because one of the main issues is that there are not rules, at least for now, to really sanction actors who are doing disinformation. Disinformation.

The propagation of half-truths, cooked numbers and outright lies, all in the service of a political agenda. And no, it's nothing new. From campaign season mudslinging to wartime propaganda efforts, political enemies have weaponized disinformation against one another since, well, since forever. But you'd like to imagine, savvy as you are, that you'd know disinformation when you saw it.

Microchips in vaccines. Peter Fowles under pizza parlors. Tut tut. Now who would fall for that? But not all this information is as easy to spot. Sometimes it's delivered so subtly that you'd never stop to question its provenance before liking, sharing, subscribing. More importantly, in the age of quick and easy information sharing online, it's increasingly widespread.

It doesn't have to be particularly clever, engaging or well-written. To make an impact, it just has to be constantly, ubiquitously there. And it is, in vast quantities, from a diverse array of sources. It seems all but impossible to stem the flow of disinformation. But that's where this week's True Spy comes in.

So my name is Roman Adamczyk. I'm the research coordinator for the EU DisinfoLab. I'm working mainly on research and investigation. Our main task is to try to expose disinformation operations all over Europe.

Roman Adamczyk and his colleagues at the EU Disinfo Lab in Brussels are not spies as we know them. So we have really two pillars in our activities. The first pillar is research, trying to identify disinformation trends, what are the main narratives, how disinformation ecosystem evolved. And our second very big activity is the work on OSINT investigation.

The world of espionage is full of handy initialisms. OSINT stands for Open Source Intelligence. Basically, it means that the EU disinfo team has no special access to government resources. It collects data that is accessible through public sources and then applies rigorous analysis to determine the origins of disinformation. If you are so inclined and willing to work weekends,

you could do the same. It's really a full-time job, especially when you are a small organization trying to investigate far bigger actors which have more resources, which are more powerful. You want to be sure that the work you are doing is really precise, that you are not going to make any mistake that can be exploited

by the people who are investigated. Between 2019 and 2020, Roman and his colleagues happened upon a campaign of disinformation stretching back 15 years. The longevity of this operation, not to mention its sheer audacity, shocked and fascinated the EU Disinfo Lab in equal measure.

It all started with an investigation from the task force of the European Commission which is fighting disinformation. And they discovered a website which was impersonating the European Parliament. And what was interesting is that this website was copy-pasting a lot of content from Russia today. Well, that's fairly cut and dry then, surely. You've got a fake website churning out content from the preeminent pro-Russian news outlet

It's got to be the Russians, right? When the European Commission released their report, that's the conclusion that most media outlets reached, wouldn't you? But we had a look, a more precise look on the report from the task force from the European Commission. And what we realized is that this report had much more nuances

And we were really interested by some specific details. For example, why this fake media outlet impersonating the European Union will have a Facebook page managed from India. Hmm. Now that is odd. What's the Indian connection? Let's keep digging.

And we also had a look at the original content because behind all the articles copy-pasted from Russia today, there was some original content. And it was mostly op-eds written by members of the European Parliament and these op-eds were really focusing on India and Pakistan. Now we're getting to the good stuff. Why do these op-eds, the only original material on the website,

focus on South Asian politics. So we were like maybe there is a misattribution there and maybe the media reports focused way too much on the Russian connection and the copy-pasting of Russia to their content and maybe there is something more to investigate here. The EU Disinfo Lab felt as though they were onto something, maybe something big.

The original content on the fake European Parliament site was highly critical of Pakistan. These op-eds were then signal boosted by Asian News International, one of India's largest news networks. Disinformation was being beamed out to millions of Indians at home and abroad. Now, bearing that in mind, it doesn't take much imagination to figure out which major world power might have a vested interest in making Pakistan look bad.

Roman and his team launched their own investigation into the disinformation network, paying close attention to any evidence that might link it to India, rather than Russia. We wanted to know more about this network and to try to understand why there was this gap and who was really behind this network.

To be sure that the attribution is good, which means that everyone has connected this disinformation network to the right people and has not made any mistake. So that was really the first motive of our investigation. Proper attribution, pointing the finger at the right people, is a crucial part of Roman's work.

When you're trying to expose corruption, your own methods have to be totally transparent. Reputation is everything. And the EU DisinfoLab knew that the content copied from Russia Today didn't necessarily point to Russian involvement, not by a long shot. Producing content is expensive.

So when people copy paste content, it can be simply to give the impression that you have a website which is really active without any specific connection with the content. Some news organizations allow their content to be reproduced freely as long as the source is cited. Russia Today is one of them. The copy pasting was really more a question of having free content

to display on their website than really an ideological proximity. In fact, on the geopolitical stage, Russia would be more likely to be working with Pakistan than India. And we really realized quickly that the Russian connection as described by media in Brussels was definitely not a good one because the fake media was hosted

on the same server as a lot of websites connected to India, including the Srivastava group. After some digging, that Indian connection was looking even healthier. And now, Roman had a name: the Srivastava group, that seemed to offer that connection a public face. It was a name that would recur throughout Roman's investigation. Let's find out more about who they are.

The Srivastava Group is an Indian company, very obscure, which means that you are not really sure what is their main field. They claim to work on energy, on health care, on media. They have a lot of different activities. The website for the Srivastava Group claims that the company operates in the key industries that drive economic growth.

Click through and you'll see that the group operates several subsidiaries across a range of industries, including several non-government organizations, or NGOs for short. Could this jack-of-all-trades also be running a neat sideline as a peddler of disinformation? Roman and his team needed to confirm their hunch. But how? Of course, you want to dig deeper to understand and to confirm that this connection is right.

So we had a look at archives and we realized that in the previous version of the fake website, you had a phone number and the phone number was also similar to the Srivastava group. So here you have another connection. Again, Roman's techniques aren't classified. They're just smart.

Through accessing archived versions of the website, the EU DisinfoLab was able to draw a strong link between the Indian Srivastava group and the fake European Parliament news site. And it might have ended there. The fake website had been exposed for what it was: a Trojan horse through which Indian interests could lobby against Pakistan within the EU.

But when the EU Disinfo Lab's initial findings were released, they realized that they'd only really scratched the surface.

You see, the thing about open source intelligence is that a tip-off can come from anywhere. Because some people had seen our initial investigations and these people were telling us to have a look at what was happening at the time in India, which means a visit of MEPs organized by some people connected to the Srivastava group. So the shadowy Srivastava group had a few more tricks up their sleeves.

through one of their pet NGOs, the group had made arrangements for a delegation of MEPs, that's members of the European Parliament, to visit Kashmir, a contested border region between India and Pakistan. At the time, a new citizenship law passed by India in Kashmir had created fresh tensions with their neighbour to the north. During their visit, the MEPs would be apprised of the Indian point of view.

And they would be an illustrious company. Also, one important detail is that during this visit in Kashmir, MEPs met the Prime Minister of India, Narendra Modi. Narendra Modi, the most powerful man in India and a fervent nationalist. If you're trying to win over a delegation from Europe, people who can change the international policy of one of the world's wealthiest blocs, setting up a meeting with Modi shows that you're serious.

So, just how much power did the Srivastava group have? What kind of connections? Whoever they were, it seemed as though they had some serious pull. We were like, yeah, there is much more to find here. So we decided to continue the investigation and to have a specific look on servers linked to the initial website and to the Srivastava group.

What the EU DisinfoLab found on those servers was interesting, to say the least. So first, a lot of organizations, a lot of NGOs, NGOs and FinTank, that were working on area and topics of interest for the Indian states, like issues linked to the minorities in Pakistan. And there was more, much more.

Roman's team found evidence of more than 250 other websites, all reposting the same content. A mix of copyright-free filler from legitimate news websites and targeted anti-Pakistan invective. Most of it, the think tanks, the NGOs and the fake media, could be traced back to the Srivastava group. But how? It's not that complicated. In fact, there are services

which allows you to have a look at a lot of data linked to websites like IP address, domain names, registries,

and servers. So you can use this tool to have a look at all the data linked to a website. So when we see all this fake, all this media outlet on the servers, we were really like, there is a network to try to amplify some messages. But before you shed a tear for the poor soul who had to think up names for more than 200 news websites, listen to this.

We found out that a big share of these media outlets were reusing names of defunct media outlets to try to pretend they have some legitimacy because they have the name of a media which already exists. So that's what we call zombies. Yep, you heard that right. Whoever was behind the fake news websites had been hijacking the identities of defunct legitimate media outlets.

Raising zombies. They used names of very, very old media. Some of these media were active like in the 20s or 30s. So really most of these media haven't had any domain names or any website. That's the thing. Yes, it's unlikely that a newspaper that went out of business in the 1930s would have a website.

But these dead names gave the disinformation network a pedigree, a veneer of respectability. Sure, it wouldn't stand up to a few minutes of semi-dedicated Googling, but how many of us really think to check where our news is coming from when we're scrolling through our media feeds? Slick copy and some half-decent web design really does count for a lot. In 2019, Roman and the EU Disinfolab released a report detailing their findings.

After our first investigation, what we have seen is that most of the assets were shot down. So we had the impression that

that our investigation really impacted their activities and that they wanted to keep a low profile. But what we are going to see and what we have discovered very quickly is that our first investigation didn't prevent them to come back. The 2019 investigation had concluded that the Srivastava group, either working alone or on behalf of more powerful actors,

had been behind a network of pro-Indian disinformation that spread out across Europe. This network had two main focal points. We've mentioned the first one in Brussels, the capital of Belgium and the home of the European Parliament. But Roman's team also noticed that the Srivastava network had a strong presence in Geneva, the Swiss city where several agencies of the United Nations are headquartered. And when new disinformation activity started to flare up in January 2020,

The EU DisinfoLab was watching.

and a larger-than-life character or two. You can find all of those things in abundance in June's Journey. In the game, you'll play as June Parker, a plucky amateur detective trying to get to the bottom of her sister's murder. It's all set during the roaring 1920s,

And I absolutely love all the little period details packed into this world. I don't want to give too much away because the real fun of June's journey is seeing where this adventure will take you. But I've just reached a part of the story that's set in Paris.

And I'm so excited to get back to it. Like I said, if you love a salacious little mystery, then give it a go. Discover your inner detective when you download June's Journey for free today on iOS and Android. Hello, listeners. This is Anne Bogle, author, blogger, and creator of the podcast, What Should I Read Next? Since 2016, I've been helping readers bring more joy and delight into their reading lives. Every week, I take all things books and reading with a guest and guide them in discovering their next read.

They share three books they love, one book they don't, and what they've been reading lately. And I recommend three titles they may enjoy reading next. Guests have said our conversations are like therapy, troubleshooting issues that have plagued their reading lives for years, and possibly the rest of their lives as well. And of course, recommending books that meet the moment, whether they are looking for deep introspection to spur or encourage a life change, or a frothy page-turner to help them escape the stresses of work, socializing,

school, everything. You'll learn something about yourself as a reader, and you'll definitely walk away confident to choose your next read with a whole list of new books and authors to try. So join us each Tuesday for What Should I Read Next? Subscribe now wherever you're listening to this podcast and visit our website, whatshouldireadnextpodcast.com to find out more.

What happened after our first report which highlighted really all the infrastructure of the fake media outlets is that we realized that there was more to investigate, especially at the UN. Because at the UN, so the fake media were amplifying demonstration in front of the UN about topics of interest for the Indian state.

Demonstrations are held frequently outside the UN in support of a wide range of causes. But these particular demonstrations, which focused on the treatment of minorities in Pakistan, were unusual. Unusual enough for Roman in the EU Disinfo Lab to reopen their investigation.

What happened is that some of these NGOs which organized demonstrations in front of the UN about India or Pakistanis minority didn't have clear link to India or to South Asia.

which means that you had NGOs which were supposed to focus on Africa, for example, on education in Cameroon. And these NGOs were organizing demonstrations about India, about topics linked to India, so it caught our attention. NGOs with no connection to India, demonstrating for Indian interests outside the United Nations,

Something's wrong with that picture. Let's take a closer look at the people involved. These NGOs were also often represented by activists linked to Pakistani minorities or people like that. So why are these activists speaking on behalf of NGOs with no connection to their cause? So we wanted to investigate more.

Soon enough, the team had a lead. When we dig on all this organization, we realized that one of the organization was called the CISOP. And this organization was supposed to have stopped its activities in the 70s. The CISOP, or the Commission to Study the Organization of Peace, is an NGO based in the USA. Yes, CISOP was, for all intents and purposes, long dead.

But some 30 years later, in 2005, it had been revived. And so this organization, which was supposed to be defunct and to have stopped its activities in 1973, started to be active again at the UN. The rejuvenated CISOP had begun speaking at the UN Human Rights Council. And strangely enough, it had a bone to pick with Pakistan. The strangeness didn't end there.

Roman's team began looking into the attendance records of the Human Rights Council's meetings. In 2007, the CISOP had sent a representative called Louis Sean. For the EU Disinfo Lab, that name rang a bell. Roman and his team thought back to their research into the original CISOP, the group that had ceased operations in 1973. And this organization's last president was Louis Sean. Put yourself in Roman's position.

Your research has thrown up two names: Luis Son and Luis Shon. Both are affiliated with the CSOP. There are two possibilities here: either this is two different people with very similar names, or it's a typo, and the same Luis Son/Shon has decided to revive the CSOP three decades later. That's pretty unlikely too.

If you Google Louis Son, you'll find reams of articles about one of the most respected legal minds of his generation, the so-called "grandfather of international law" in the US. Is this Louis Son really going to devote his golden years to criticizing Pakistan? But somebody, and by now you should have an idea of who, is using his name to do just that.

because we suppose that they wanted to have some credibility when this NGO started to speak again at the UN Human Rights Council. They have decided to use the name of one of the former presidents, but changing only one letter of his name to give the impression that this organization, which is back and active again, is connected to the former organization. The only problem with that

is that they used the name of someone who died one year before they used this name. Ah, maybe that wasn't such a smart move. Or maybe the people behind the revival of C-SOP just didn't care if they were caught. It seems to be a small detail, but it really shows that these Indian actors were not really careful and were not really scared of the consequences.

So far, we've heard a lot about how Roman and the EU Disinfo Lab utilize open source intelligence. But what might surprise you is that the people they try to expose also use unclassified techniques to achieve their aims. What the Indian NATO did, they hijacked the identity of former NGOs which stopped to exist. And what they did was really simple. Most of the time, they just register a domain name

As easy as that, eh? But surely an NGO needs a physical presence in the world if it's going to engage with a power as scrupulously official as the UN.

To register to the UN, you need to have a specific address. So what they did, they created virtual offices. There are companies that allow you to use their office as the main address of your own organization. Virtual offices and mailing addresses are easy to come by. They offer an important service for small businesses, but they're unlikely to vet their clients too closely.

Now, hijacking long-dead NGOs is one thing. But as Roman looked deeper into other groups connected to the Indian disinformation campaign, he found that some of them hadn't been quite dead enough before they'd been repurposed. So here you have a big question. It's why Indian interests were using the name of NGOs which are still active or still active like two or three years ago. What's your hypothesis?

Here's Romans: And one of our hypotheses is that there might be some kind of black market of people offering the possibility to use the name of their NGO at the Human Rights Council, to speak at the Human Rights Council and to use the name of the NGOs to have a speaking slot. Well, think about it. An invitation to speak to the Human Rights Council isn't that easy to secure.

Why bother hijacking a defunct NGO, creating a website, inventing an address, reviving a dead president, when you could just pay a real NGO for the same package of perks? We don't know much about the Srivastava group, but one thing is clear: they have access to funds, enough to buy influence at the UN. Who knows?

The EU Disinfo team continued their research, uncovering more evidence of widespread disinformation emanating from within several NGOs. And whoever was infiltrating these groups, they were doing a fairly subtle job of it. Where possible, they would stay in a similar vein to the NGOs' original area of interest and put an anti-Pakistan slant on it.

One interesting example is how they use an organization called the World Environment and Resources Council, which was active in Belgium in the 70s. And what they did when they registered this organization at the UN Human Rights Council, it's that they use this organization to speak

specifically on issues related to environment and minorities in Pakistan. Which means that, for example, the speaking slot of this organization were used to talk about the construction of a dam in Pakistan, which is quite controversial because to construct this dam, the Pakistani authorities

will have to displace some population in areas where there are a lot of minorities. By staying somewhat within the remit of the original NGO, the hijacked NGO could avoid suspicion for longer. The EU Disinfolab had uncovered yet another attempt by Indian actors to disseminate anti-Pakistan propaganda in one of the world's most venerable institutions. But there's another mystery we haven't touched on yet.

Who were the activists and demonstrators doing the work on the ground? We discovered really quickly that at the beginning of the activities in the UN Human Rights Council, sometimes the same speaker was speaking for multiple NGOs with always the same messages. So you have a small group of speakers being shuffled around various NGOs with access to the Human Rights Council.

They're all delivering speeches that promote Indian interests and criticize Pakistan. But what's their profile? Who are you picturing? Whoever's taking the podium in your mind's eye, there's a good chance that they're, well, Indian, right? Wrong, actually. Most of the time it was very young adults speaking for these NGOs, often from Russian or Eastern Europe origins.

And we were really curious to see why NGOs speaking so much about Pakistan and India were represented by people who seemed to have no relation at all to this NGO or to issues linked to South Asia. Young people, students from Russia and other Eastern European countries have been selected to be the public faces of the disinformation campaign.

It's also a way to hide a bit your traces because if you have students from multiple origins speaking for your NGO, it's difficult to understand that first sight that there is a connection to India because you have people from all over the world talking and representing your NGO.

In the same way that the fake news websites hid their true purpose behind copyright-free filler and long-dead titles, these decidedly non-Indian speakers were a smokescreen for their masters in New Delhi. But were they in on the scam? Roman had to find out. Unfortunately, there's only so much you can achieve with the information you'll find online, even if you're an experienced OSINT investigator.

Sometimes you need boots on the ground to get the job done. And so that's why we're working with journalists to try to confirm our intuitions. And what happened is that some of the journalists with whom we worked contacted some of these people who spoke for NGOs at the Human Rights Council. EU DisinfoLab extended its tendrils out into the real world

Friendly journalists tracked down the young speakers. And when they talked to them, some of these people explained how it works, why they talked for this NGO. And we quickly understood that they were all recruited from the same universities and schools in Geneva.

and that there was someone in this school recruiting these people to speak at the Human Rights Council. The students, as it turned out, weren't die-hard Indian nationalists. In fact, as far as the EU DisinfoLab could tell, they were largely unaware of the operation that they were a part of. In many cases, they'd answered an ad on Facebook. When they were asked to speak on an environmental issue that affected Pakistani minorities,

The reputational damage that might be inflicted on Pakistan was not at the forefront of their minds. And why would they question what they were doing? On the surface, it was for a good cause, and it wouldn't hurt their CVs either. A journalist for the Swiss publication Le Temps was able to reveal that these students were paid 200 Swiss francs to speak in front of the Human Rights Council. They were paid in cash, untraceable, and recruited by a fellow student

Again, with no provable links to India. But there's one question that's been hovering over the entire investigation so far: Who is really behind this network of propaganda and disinformation? The Srivastava group? Sure, okay, but who are they working for? You might think that the answer is obvious: Why are we skirting around it? But one of the downsides of open-source intelligence is that it's difficult to truly prove anything.

especially when world powers enter the mix. Then there are always some concerns because, like I said, we didn't connect directly this network to the Indian state. But you never know exactly who is behind everything and you always fear a bit what they are capable of to try to attack your findings and to try to dismiss them.

The more powerful your target is, the stronger the pushback.

and a nation state has the resources and expertise to make itself very difficult to trace definitively. That's why most of the time for our investigation we are working with journalists so the journalists will be able to investigate more, to go further that's only what you can find online and to be able to check if our findings are confirmed by our sources on the ground.

Using open source intelligence, Roman and the EU DisinfoLab could prove that a disinformation campaign was underway. They could link it to a company, the Srivastava Group, but that was as far as they could go. That's also why now most states are using proxies.

Because if you use proxies organizations like the Srivastava group, these organizations which are going to bear most of the reputation costs, and you can still say that you have no connection with these organizations. And this means that these disinformation networks are incredibly difficult to stamp out.

because one of the main issues is that there are no rules now, at least for now, to really sanction actors.

who are doing disinformation. They can be sometimes kicked out of platforms, of social media platforms. They can face this kind of consequences, but nothing prevents them to recreate a website, to create again a website, to create again social media accounts. So there is no real consequences, except in terms of reputations. But Roman and his colleagues are playing the long game.

What is important for us is to try to make the cost of such operations higher, higher, so the more costly it is for them in terms of manpower and in terms of financial resources, the less they will be able to have really extensive operation with a big impact. Think about it. What is the true impact of disinformation campaigns like this?

A speech here, a sous-son of clickbait there, what's the harm in letting it continue? After all, propaganda is nothing new. But the problem now that we are facing in our field is that a lot of actors now understand what they could gain

in investing times and resources in disinformation or information operations. And it's really complicated because in, at least in democratic states and democratic institutions like the UN, like the EU, you really want to have transparency and to have clear debates. And if you don't know who is who,

If you don't know if people are hiding their identity and are trying to manipulate political debates, institutional debates, it's difficult for democratic institutions to function on the long run. In essence, this is a war of attrition. It's not sexy. There's no gunplay, no car chases.

But defeating disinformation is key to preserving the institutions that maintain a modicum of peace and order in the world. And the actors that seek to undermine them are serious about their work. They won't hesitate to fight back when their operation comes under threat. The main consequences I think we always have when we publish this kind of investigation, it's online harassment.

And so this time, Indian actors put in place quite an extensive harassment campaign on Twitter, which means that we received more than 6,000 tweets from 600 accounts which were suspended by Twitter. States and other bad actors can use proxies to deflect any damage to their reputation.

People like Roman and the team at the EU DisinfoLab don't have the same luxury. And these accounts were really created to target specifically our organization, which means putting messages trying to denigrate some of our past activities. Also messages targeting some specific activities.

individuals in our organization. Targeting also sometimes their relatives or their colleagues, former colleagues, asking them if they know about our work and what we have done and all the lies we are spreading. They will invest financial resources to create this campaign specifically to target us. And when you are an organization with less than 15 people,

It can be really difficult to handle. I'm Vanessa Kirby. Join us next week for another glimpse into the shadows with true spies. You can read EU Disinfo Lab's full report, Indian Chronicles, at www.disinfo.eu. We all have valuable spy skills and our experts are here to help you discover yours. Get an authentic assessment of your spy skills, created by a former head of training at British Intelligence at spiescape.com.

Disclaimer. The views expressed in this podcast are those of the subject. These stories are told from their perspective and their authenticity should be assessed on a case-by-case basis.