A Facebook spokesperson told CNN Business that company staff who looked into the website's Facebook page say it was linked to Iranian state media. Facebook removed the page in 2018. FireEye, a top cybersecurity company, says it assessed with "moderate confidence" that the website originates in Iran and is part of a much larger influence operation.

The new details about alleged Iranian ties to the American Herald Tribune shed light on how the country has attempted to run a years-long covert online influence campaign targeting the United States. As Russia did around the 2016 election, Iran appears to have co-opted and in this case paid a small number of unwitting Americans to lend legitimacy to its operations.

The sophistication described by these companies calls to mind recent US government warnings about Tehran's capabilities in cyberspace in light of the killing of top Iranian general Qasem Soleimani in a US drone strike. Some US officials have raised concerns about a conventional cyber attack that could impact US infrastructure, but this type of information and influence campaign could represent another aspect of Iran's cyber efforts, this one with the potential to impact US political discourse.

The articles posted to American Herald Tribune are largely in line with the views of Iran's ruling establishment. It publishes stories criticizing American foreign policy and attacking President Donald Trump and Israel. Often the criticism is not unlike viewpoints expressed on authentic US-based independent websites, especially ones with an anti-establishment perspective.

What appears to be one of the website's most viral stories was published during the 2016 US presidential election campaign and made unsubstantiated claims about then candidate Donald Trump's father being in the Ku Klux Klan. (Though the article appears to have been shared on Facebook in large numbers, it is impossible to determine the proportion of engaged accounts that were authentic.)

American Herald Tribune calls itself "genuinely independent" and says funding for the publication "comes from site advertising, individual donors, and private foundations." But evidence gathered by top cybersecurity company FireEye as well as by Facebook and Google paints a different picture.
In August 2018, Facebook shut down a network of 652 pages, groups, and accounts posing as independent organizations which were, it said, in fact linked to Iran state-backed media.

Facebook did not name American Herald Tribune in its public post about the takedown but a Facebook spokesperson confirmed to CNN Business earlier this month that the website's Facebook page was part of that takedown. The pages that were removed by Facebook were linked to Iranian state media, the company said.

Around the same time as the Facebook takedown, Google took action too. The company shut down Gmail and Google ad accounts linked to the same network of sites, which it also determined were linked to Iran. Google confirmed to CNN Business earlier this month that American Herald Tribune was part of that takedown. (Both Facebook and Google credited FireEye's research in helping their investigations.)

The people who run American Herald Tribune decried Facebook and Google's actions at the time, claiming "alternative media is under attack."

"It seems that the US government and its allies do not find it suffice to control mainstream media, and is, in fact, desperate to shut down any alternative media that speaks the truth," a post on the site read. Facebook, it claimed, "has become little more than a vehicle for US government censorship and Western propaganda."

Lee Foster, who leads the team at FireEye that first uncovered the network of sites, told CNN Business that "indicators, both technical and behavioral" point to American Herald Tribune being linked to an operation run from Iran.

Independent researcher and social media sleuth Josh Russell publicly posted on Twitter in 2018 further evidence supporting American Herald Tribune's alleged links to Iran.

Even after the takedowns on Facebook and Google, the website remained active and ran a Twitter account.

Twitter removed American Herald Tribune's account this month after the company was contacted by CNN Business. Twitter would not provide any information on where the account was run from, but said it was investigating.

Recruiting Americans
An unsubstantiated story by the American Herald Tribune in 2015 was published under the headline, "Trump's grandfather was a pimp and tax evader; his father a member of the KKK."

The story continues to circulate online.
The story's byline belongs not to an Iranian, but to an American man who lives in Salem, Oregon.

That man, Tim King, a writer who has had, according to his social media profiles, a long career in media, told CNN Business he couldn't recall how he first began working with American Herald Tribune. The people who run the website paid him a couple of hundred dollars for the article, he said.

King's KKK story has, since it was first published, been fact-checked by Facebook's fact-checking partners and people sharing it on Facebook are warned that the story is false.

King is a critic of American foreign policy and US ally Saudi Arabia. He says that Iran is "misunderstood" in the US.

"I'm always glad to find a website that's willing to, you know, publish stories about Palestine and Israel and different subjects like that, that are so fully taboo here in the United States," King said of his involvement with American Herald Tribune.

Although King said he has knowingly worked with Iranian media in the past, he said he doesn't think American Herald Tribune is run by Iran. Instead he believes it is run by a man named "Sam" who lives in Brazil.

When American Herald Tribune came online in 2015, website records show that it was registered under King's name. But false names and identities can easily be used to register websites and King denied setting up or registering the website.

His story, based on details provided to CNN by his ex-wife, checks out. In late 2016, King's ex-wife Bonnie King was surprised when she was contacted by a writer complaining that American Herald Tribune had been plagiarizing his work. The writer told Bonnie he had found her contact details through the site's registration data.

Bonnie emailed King: "Those folks at AHT [American Herald Tribune] are LIARS." In the email, which she provided to CNN Business, she attached a screenshot of the website records the writer had sent to her showing that Tim's name had been used and her phone number used to register the site.

When King contacted "Sam Brown" from American Herald Tribune to ask why his name was being used in the site's registration, "Brown" responded with a nonsensical excuse in broken English: "The name of the guys registering the name was a variant of your name. I asked the guy to write full name instead of its short form which sounds your name. The name has been changed to avoid the misunderstanding." The individual added: "Sorry if we have made troubles for you unintentionally."

King said he passed on contact information for CNN Business to "Sam." The administrators of American Herald Tribune did not respond to multiple requests for comment from CNN Business. King declined an on-camera interview with CNN after talking with "Sam."

To complicate matters further, the website was registered using an email address with the name Paul Craig Roberts. Roberts worked in the Reagan administration and is now a critic of US foreign policy. Some of his articles have appeared on American Herald Tribune.

He denied ever using or knowing about that email address.

An air of legitimacy
While American Herald Tribune pays some contributors like King for original content, it also republishes articles from elsewhere and then lists the people who wrote those articles as contributors to its site.

The practice gives the false impression that a long list of Americans, including some prominent public figures, write directly for the website.

Among those public figures whose work is published by the site is Roberts. Roberts allows anyone to republish his work: a disclaimer on his site reads "Permission to reprint Dr. Roberts' columns does not imply that Dr. Roberts endorses the websites or media organizations that republish his columns or that he approves of the content of the websites, media outlets or books that republish his columns."

After CNN Business contacted Roberts, he posted on his blog, "I find it necessary to remind the public of the terms on which my words are republished as the presstitute scum at CNN have in mind associating me with the aims and purposes, real or alleged, of some who reproduce the columns. "

He also stated, "my columns are reprinted on a large number of websites and individual blogs in the US and abroad and in Russian newspapers in the Russian language, and in foreign languages that I do not know and have no idea what is being done with my words."

American Herald Tribune's complicated origin story, and people involved with the project not knowing for sure who is behind it, fits into a broader trend of online foreign interference seen in the US in recent years. It will be familiar to those who followed Russian interference in the 2016 US presidential election.

Using fake websites and fake activist groups, Russian operatives targeted and co-opted often unwitting Americans to contribute to their disinformation campaigns online and offline. Those real Americans were used to shield the origins of the campaigns and lend them legitimacy.

Through social media, Russians successfully organized real events in the United States, including in at least one instance coordinating two opposing rallies to take place at the same time in Houston, Texas. It also successfully co-opted small groups of unwitting Trump supporters and African Americans.
Whoever set up American Herald Tribune, it seems, may have also used King's and Roberts' identity in an attempt to cover their tracks.