Forged letter and a persona based on a real journalist used to spread disinfo about NATO withdrawing troops from Lithuania

Authors of a disinformation campaign about NATO troops leaving Lithuania due to the spread of COVID-19 impersonated Vilius Petkauskas, a well-known journalist and fact-checker from the Lithuanian media outlet 15min.lt. This case is yet another example of COVID-19 being used to create anti-NATO sentiment in the Baltic states.

The outlets that were involved in the campaign had previously used anonymous online personas, as the DFRLab reported in 2019. This case demonstrates greater dedication to achieving authenticity, as a real person’s identity and credibility was used to spread falsified information. The case also demonstrates a new approach by disinformation actors to psychologically influence the fact-checker. Fact-checkers in Latvia have also received blowback due to the authors of disinformation that created personally offensive videos and unflattering content.

In early 2017, NATO enhanced its presence in the Baltic states and Poland amid Russian aggression in Eastern Ukraine. Narratives such as NATO being aggressive and unwelcome in the region routinely target Russian-speaking population in the Baltic states.

The forged letter

A forged letter from NATO Secretary General Jens Stoltenberg was sent to Lithuanian media, NATO headquarters in Brussels, and other governmental institutions from a spoofed email of the Lithuanian Ministry of Defense (MoD). The letter alleged that NATO is going to withdraw its troops from Lithuania due to the COVID-19 pandemic

The letter was written in poor English, and a version of Stoltenberg’s signature that is openly available online matched perfectly with the one used in the letter.

The Lithuanian MoD quickly refuted the forgery, which had spread on some fringe English-language media outlets and YouTube channels. Overall, it did not garner significant engagement on social media, according to BuzzSumo, a social media listening tool.

Impersonating a real journalist

The authors of articles that spread the forged letter impersonated a well-known Lithuanian journalist, Vilius Petkauskas, who writes and fact-checks for Lithuanian mainstream news outlet 15min.lt. The sites that published the articles, OpEd News and The Duran, have previously spread anti-NATO narratives by using anonymous online personas with Latvian and Lithuanian-sounding names. Most recently, both were used to spread a story that the U.S.-led NATO military exercise Defender Europe 20 would lead to the spread COVID-19 in the Baltic states.

Petkauskas’s identity was also used to create a Blogspot blog with the domain viliuspetkauskas.blogspot.com, as well as a YouTube channel that has since been deleted. Both were named “Lietuva Mano Tevyne,” or “Lithuania My Fatherland” as translated from Lithuanian, and shared the story titled “NATO withdraws troops from Lithuania.” The description of the blog and the logo used for the YouTube account were extracted from Petkauskas’s profile on 15min.lt.

Besides the false story about NATO, the blog contained eight other posts, all of which were originally published on 15min.lt by Petkauskas.

Though the dates of the articles matched and went back as early as May 14, 2019, the source code indicates that all articles were most likely backdated. The structure of the blog’s source code suggests that the older articles appeared in a folder dated April 2020, the month when disinformation about NATO troops leaving Lithuania first surfaced.

The fact that the creator of the blog most likely backdated articles that Petkauskas published earlier may suggest an attempt to make the impersonation more authentic.

Previous information attacks on the journalist

The authors of disinformation stories that Petkauskas had previously debunked published later accused him of lying. On August 3, 2019, the London-based fringe website Bukimevieningi.lt called Petkauskas a liar, accusing him of spreading fake news. On March 4, 2020, the website accused Petkauskas of spreading lies again. Meanwhile, an article on April 18 calling Petkauskas a “functional idiot” accused the journalist of protecting Bill Gates, who is now a popular target of COVID-19 anti-vaxxer conspiracy theories. 15min.lt is owned by Estonian media concern Postimees Group, which belongs to Margus Linnamäe, who also owns a pharmacy business. Meanwhile, an author of a story alleging Prince Charles was cured from COVID-19 with homeopathy targeted Petkauskas for accusating of him spreading “fake news.”

The DFRLab has previously documented personal attacks on fact-checkers in Latvia as well.

Disinformation continued to spread

Though the Lithuanian MoD refuted the fake letter on the same day it appeared and many media outlets reported on the forgery, the disinformation campaign continued to spread.

On April 22, a YouTube account named “Nikolas Ratas” that was created that same day published a video titled “Is this the collapse of NATO?” and used the forged letter as evidence.

On April 23, fringe outlet The Baltic Word published an opinion piece by Jonas Dringelis that cited the official position by Lithuanian MoD, but then speculated that the news about NATO withdrawing its troops could be true.

The DFRLab has previously examined The Baltic Word and Jonas Dringelis — one of several anonymous online personas that consistently share anti-NATO narratives in English.

On April 24, German media outlet Die Welt published an article titled “How Covid-19 destabilized NATO’s eastern flank.” The article was behind the outlet’s paywall, but RT, the Russian version of the Kremlin-owned outlet, translated it. The version adapted from Die Welt’s article did not characterize the forged letter as false.

The article garnered 271 engagements on social media, according to BuzzSumo.

While the falsified letter, along with the use of a real journalist’s identity to spread disinformation, had the potential of being a successful information influence campaign, overall engagement with the narrative on social media remained rather low. Its use of a real journalist’s identity to promote the claim, however, is a troubling sign of tactics that might be used in other disinformation narratives.

The Lithuanian Armed Forces Strategic Communications Department provided material and consultation for this article.

Nika Aleksejeva is a Research Associate, Baltics, with the Digital Forensic Research Lab.

Follow along for more in-depth analysis from our #DigitalSherlocks.