Pro-Russia disinfo behind claim ‘Ukraine killed Egyptian journalist’

On 26 December 2023, news of the assassination of Mohammad al-Alawi, an Egyptian investigative journalist, at the hands of Ukrainian intelligence services started circulating on social media and multiple media outlets.

According to reports, al-Alawi was potentially targeted after he revealed in late August 2023 that Olga Kiyashko, the mother-in-law of Ukrainian President Volodymyr Zelensky's, had purchased a US$4.85 million villa in the Egyptian Red Sea resort town of El Gouna.

The New Arab (TNA) Investigative Unit conducted a review of the videos testifying to the assassination of al-Alawi, and found them to be fabricated. It was also able to identify the pro-Russia disinformation network behind the operation.

Our investigation shows how pro-Russia disinformation networks have become more sophisticated, and now use AI-generated content to create fake news, before inserting them in popular news sources as sponsored content.

Involvement of Ukrainian intelligence

Most reports relayed information from an article in the English edition of online pro-Kremlin Russian online outlet Pravda.ru, which stated that “Egyptian police believe that Ukrainian intelligence services were involved in the murder of the journalist”, adding that “supposedly [the intelligence services] received orders from Volodymyr Zelensky or a senior Ukrainian official.”

Multiple online news outlets repeated the claim, including London-based Pan Arab news website Arabi 21, and our Arabic-language sister publication al-Araby al-Jadeed.

No purchase and no journalist

Already on 31 August 2023, Orascom Development Holding, the company that owns El Gouna resort town, had denied allegations that Zelensky’s mother-in-law had purchased a villa in El Gouna, saying it belonged to an Egyptian family.

After the assassination claim went viral, on 30 December 2023, the Egyptian ministry of interior issued a denial of the allegations on its official X account.

On 2 January 2024, Cairo-based online news site Egypt Telegraph questioned whether an Egyptian journalist named Mohammad al-Alawi ever existed. 

According to them, the Egyptian Journalists Syndicate “spent three days” looking for the journalist and his past work, to no avail. The head of the organisation therefore concluded that there was no journalist with the given name among syndicate members.

"The New Arab contacted Clemson University Professor Patrick Warren over email to ask whether Clear Story News could be part of the same disinformation network identified in his report, given the evidence. 'I strongly believe they are linked, for all the reasons you mentioned,' he said."

Egypt Telegraph also challenged the veracity of the claims made on the journalist’s Youtube channel. 

Indeed, Mohammad al-Alawi uploaded two videos on his account to attest to his claims on 20 August 2023. In one of these videos, al-Alawi is seen speaking to a camera, while allegedly holding a copy of the contract of the sale of the villa. It is not possible to see the contract in the clip, but a purported incomplete copy was published on Nigerian online daily The Punch on August 22. 

Both the YouTube account and the videos were created on the same day, suggesting that the identity of the journalist was fictitious. No follow up video or announcement was made on the account afterwards.

"The video of the interview is just as cryptic. The face of the interviewee is not shown. The interviewer ‘Mohamad Fathi’ is not seen in the video, replaced instead by what looks like an AI-generated avatar."

TNA looked for any evidence that an Egyptian journalist with the name or pseudonym Mohammad al-Alawi had ever existed before the day the videos were uploaded. We did not find any.

According to a Hurghada-based journalist, who spoke to TNA on condition of anonymity, there has been no journalist by the given name known to the local community in recent years.

Egypt Telegraph analysed the copy of the contract that al-Alawi reportedly obtained, and concluded that the document was forged. An Egyptian business lawyer told TNA that the contract lacked sufficient unredacted details to determine its authenticity. 

Fabricated videos

The Pravda.ru article, which alleged the involvement of Ukrainian authorities in the “assassination”, sourced its claim from a piece that has since been deleted, and which originally appeared on the online Egyptian news outlet El-Mostaqbal.

An archived copy of the article included footage that allegedly showed the crime scene, as well as a video interview with Ahmad, who is introduced as the brother of the victim.

In the 76 second long interview, Ahmad explains how the Egyptian police believes “the Ukrainian special forces” committed the assassination, on the orders of Ukrainian President Zelensky.

However, many details from these videos cast doubt on their veracity.

The two videos were uploaded, on the same day on 21 December 2023, to a Youtube account called ‘Akhbar Masr’ (meaning ‘News of Egypt’ in Arabic). The account was created a day earlier, on 20 December 2023.

Both videos carry the same description, which reads “the materials for the article [sic] journalist”.

The footage showing the scene of the assassination is very short and light on details. It shows a corner of a dimly lit street, without providing any information about its location, or the identity of the person who produced the footage.

The video of the interview is just as cryptic. The face of the interviewee is not shown. The interviewer ‘Mohamad Fathi’ is not seen in the video, replaced instead by what looks like an AI-generated avatar. The intonation and tone of the interviewer’s voice, as well as his pronunciation, is very similar to those heard in the original Mohammad al-Alawi video.

Ukraine’s response and the ‘black hole’ campaign

On 1 September 2023, Ukraine's Center for Countering Disinformation (CCD) denied the allegation regarding the villa purchase. It stated that "the Zelensky family and the parents of the family do not have any real estate in Egypt. The Center was informed about this in [sic] the Office of the President of Ukraine."

The CCD, part of the National Security and Defense Council of Ukraine, was established in March 2021 to counter propaganda and influence campaigns detrimental to Ukraine’s national interests.

The CCD attributed the source of the claim to a "russian [sic] propaganda with the aim of discrediting the reputation of Volodymyr Zelensky on the world stage", as part of a campaign it dubbed "black hole".

"The New Arab (TNA) Investigative Unit conducted a review of the videos testifying to the assassination of al-Alawi, and found them to be fabricated. It was also able to identify the pro-Russia disinformation network behind the operation."

According to a July 2023 report by the CCD, the ‘black hole’ campaign first started on Russian social media a year earlier, and was amplified through the accounts of known Russian propagandists and pro-Kremlin media.

In November 2022, official Russian government accounts embraced the campaign. A fabricated video, depicting Zelensky as a black hole on a Times Square ad, was shared by the X account of the Russian Embassy in London.

A few days later, the same video was shared by the Facebook account of the Embassy of Russia in Bangladesh.

Links with pro-Russia disinformation network

The first mention of the fabricated assassination claims outside Egyptian media appeared on 23 December 2023, on an online news site called ‘Clear Story News’.

According to a post on X by cyber intelligence researcher Kyle Ehmke, Clear Story News is associated with John Mark Dougan, a former US marine and Florida police officer who has been living in Russia since 2016.

Dougan has been in the news recently, after two disinformation researchers at Clemson University in the US showed that he was the founder of ‘DC Weekly’, a pro-Russia propaganda website.

TNA contacted Dougan about his alleged involvement with Clear Story News. “I think it’s one of my US based customers that had my company set up the server and domain,” he wrote over WhatsApp. “I just seem to remember seeing the domain in passing on a list of domains that we either host or set up. But I might even be wrong about that,” he added.

According to the BBC, Dougan denied being involved with DC Weekly’s current operations.

"Our investigation shows how pro-Russia disinformation networks have become more sophisticated, and now use AI-generated content to create fake news, before inserting them in popular news sources as sponsored content."

DC Weekly has been fuelling rumours about the purchase by President Zelensky of two luxury yachts using American aid money. The rumours have been successful in influencing US lawmakers’ debate over funding for Ukraine.

In May 2023, US Representative Marjorie Taylor Greene stated at a town hall in her congressional district that Zelensky and his government were corrupt.

She repeated the claim in November 2023, this time linking to a website covering the yacht rumour.

While the yacht purchase claim was debunked, corruption has been a running theme of conversations over support to Ukraine.

78% of Ukrainians hold the Ukrainian president directly responsible for government corruption, according to two nationwide surveys published on 11 September 2023 by the Ukrainian think tank Ilko Kucheriv Democratic Initiatives Foundation.

According to a 2021 Pandora Papers investigation, Zelensky and “his close circle were the beneficiaries of a network of offshore companies, including some that owned expensive London property”.

Same modus operandi, different result?

The two Clemson University researchers, Darren Linvill and Patrick Warren, described in detail how DC Weekly fabricated the narratives within its “disinformation production and distribution network”:

“Each [story] was first placed as a video appearing on a newly active social media account. These videos each give a first-person account from a supposed witness who serves as living evidence for the narrative claims. Each video then appears as the source of a story in one or more of a group of African and Arabic news sites. The narrative then surfaces as a story on DC Weekly and is circulated around social media.”

This seems to be the exact process Clear Story News used in its fabrication of the assassination of al-Alawi. But the similarities don’t end here.

In the case of the yacht story, the accounts of a fictitious journalist and Middle East expert named ‘Shahzad Nasir’ were created on X and Youtube to attest to the discovery of the purchased yachts, similar to how the persona of Mohammed al-Alawi was created.

To legitimise their fabricated stories, DC Weekly would sometimes place them as sponsored content in more established African news sources.

Sponsored content is a type of promotional media that is usually paid for by the entity promoting it.

This mirrors the process used in the case of al-Alawi’s killing claim, in which an early version of the story was published under ‘Branded Content’ on the website of Nigerian daily The Punch on 22 December 2023. The story has since been deleted.

TNA contacted Clemson University Professor Patrick Warren over email to ask whether Clear Story News could be part of the same disinformation network identified in his report, given the evidence. “I strongly believe they are linked, for all the reasons you mentioned,” he said. “The technical links are also fairly strong.”

The Clemson University report noted that “each of these narratives [...] work in various ways to undermine ties between the West and Ukraine.”

It remains to be seen if the work of revealing these disinformation networks and their level of sophistication will make a dent in their impact.

Cairo-based Thaer Mansour contributed to this article.