Fact-checker’s identity stolen to spread disinfo about NATO and COVID-19

Forged letter and a persona based on a real journalist used to spread disinfo about NATO withdrawing troops from Lithuania

(Source: @nikaaleksejeva via Lietuva Mano Tevyne/archive)

Authors of a disinformation campaign about NATO troops leaving Lithuania due to the spread of COVID-19 impersonated Vilius Petkauskas, a well-known journalist and fact-checker from the Lithuanian media outlet 15min.lt. This case is yet another example of COVID-19 being used to create anti-NATO sentiment in the Baltic states.

The outlets that were involved in the campaign had previously used anonymous online personas, as the DFRLab reported in 2019. This case demonstrates greater dedication to achieving authenticity, as a real person’s identity and credibility was used to spread falsified information. The case also demonstrates a new approach by disinformation actors to psychologically influence the fact-checker. Fact-checkers in Latvia have also received blowback due to the authors of disinformation that created personally offensive videos and unflattering content.

In early 2017, NATO enhanced its presence in the Baltic states and Poland amid Russian aggression in Eastern Ukraine. Narratives such as NATO being aggressive and unwelcome in the region routinely target Russian-speaking population in the Baltic states.

The forged letter

A forged letter from NATO Secretary General Jens Stoltenberg was sent to Lithuanian media, NATO headquarters in Brussels, and other governmental institutions from a spoofed email of the Lithuanian Ministry of Defense (MoD). The letter alleged that NATO is going to withdraw its troops from Lithuania due to the COVID-19 pandemic

The letter was written in poor English, and a version of Stoltenberg’s signature that is openly available online matched perfectly with the one used in the letter.

Matching Jens Stoltenberg’s signatures. Note the perfect match which would not be possible if the signature in the letter was authentic. (Source: Lietuva Mano Tevyne/archive, left; Wikimedia Commons/archive, top right)

The Lithuanian MoD quickly refuted the forgery, which had spread on some fringe English-language media outlets and YouTube channels. Overall, it did not garner significant engagement on social media, according to BuzzSumo, a social media listening tool.

English-language outlets that shared false news about NATO withdrawing troops from Lithuania. (Source: DFRLab via BuzzSumo)

Impersonating a real journalist

The authors of articles that spread the forged letter impersonated a well-known Lithuanian journalist, Vilius Petkauskas, who writes and fact-checks for Lithuanian mainstream news outlet 15min.lt. The sites that published the articles, OpEd News and The Duran, have previously spread anti-NATO narratives by using anonymous online personas with Latvian and Lithuanian-sounding names. Most recently, both were used to spread a story that the U.S.-led NATO military exercise Defender Europe 20 would lead to the spread COVID-19 in the Baltic states.

Fringe media outlets use Petkauskas’s name to spread disinformation about NATO withdrawing troops from Lithuania. (Source: The Duran/archive, top left; OpEd News/archive, top right; OpEd News/archive, bottom)

Petkauskas’s identity was also used to create a Blogspot blog with the domain viliuspetkauskas.blogspot.com, as well as a YouTube channel that has since been deleted. Both were named “Lietuva Mano Tevyne,” or “Lithuania My Fatherland” as translated from Lithuanian, and shared the story titled “NATO withdraws troops from Lithuania.” The description of the blog and the logo used for the YouTube account were extracted from Petkauskas’s profile on 15min.lt.

Google blog and YouTube account “Lietuva Mano Tevyne” used Petkauskas’ identity to spread false news and the letter. (Source: Lietuva Mano Tevyne/archive, top; 15min.lt/archive, bottom left; 15min.lt/archive, bottom right)

Besides the false story about NATO, the blog contained eight other posts, all of which were originally published on 15min.lt by Petkauskas.

Comparison of some of the earlier stories that appeared on viliuspetkauskas.blogspot.com with stories that Petkauskas has published on 15min.lt. The titles, images and dates of the publications match. Title of the top article translated from Lithuanian: “False statements about Ingrida Šimonytė are distributed on a social network”; title of the bottom article translated from Lithuanian: “Distorted examples on the Internet create a negative image of NATO soldiers.” (Source: Lietuva Mano Tevyne/archive, top left; 15min.lt/archive, top right; Lietuva Mano Tevyne/archive, bottom left; 15min.lt/archive, bottom right)

Though the dates of the articles matched and went back as early as May 14, 2019, the source code indicates that all articles were most likely backdated. The structure of the blog’s source code suggests that the older articles appeared in a folder dated April 2020, the month when disinformation about NATO troops leaving Lithuania first surfaced.

The source code of the viliuspetkauskas.blogspot.com article titled “Distorted examples on the Internet create a negative image of NATO soldiers.” Note the time — April 2020 — in the hyperlink that structurally involves the article that was supposedly posted in May 2019. (Source: Lietuva Mano Tevyne/archive)

The fact that the creator of the blog most likely backdated articles that Petkauskas published earlier may suggest an attempt to make the impersonation more authentic.

Previous information attacks on the journalist

The authors of disinformation stories that Petkauskas had previously debunked published later accused him of lying. On August 3, 2019, the London-based fringe website Bukimevieningi.lt called Petkauskas a liar, accusing him of spreading fake news. On March 4, 2020, the website accused Petkauskas of spreading lies again. Meanwhile, an article on April 18 calling Petkauskas a “functional idiot” accused the journalist of protecting Bill Gates, who is now a popular target of COVID-19 anti-vaxxer conspiracy theories. 15min.lt is owned by Estonian media concern Postimees Group, which belongs to Margus Linnamäe, who also owns a pharmacy business. Meanwhile, an author of a story alleging Prince Charles was cured from COVID-19 with homeopathy targeted Petkauskas for accusating of him spreading “fake news.”

Articles attempting to refute Petkauskas’s fact-checks and call him a liar. Translated from Lithuanian from left to right: “Be careful: lying “15min.lt” journalist Vilius Petkauskas !!!”; “Functional idiot Vilius Petkauskas and his embraced Estonian master decided: K. Juraitis announces a mix of Russian lies about the “conspiracy of the elites”; “Gabrielius Sevrukas: Writing feather virtuoso Vilius Petkauskas accuses me of fake news” (Source: bukimevieningi.lt/archive, left; LDiena.lt/archive, middle; Minfo.lt/archive, right)

The DFRLab has previously documented personal attacks on fact-checkers in Latvia as well.

Disinformation continued to spread

Though the Lithuanian MoD refuted the fake letter on the same day it appeared and many media outlets reported on the forgery, the disinformation campaign continued to spread.

On April 22, a YouTube account named “Nikolas Ratas” that was created that same day published a video titled “Is this the collapse of NATO?” and used the forged letter as evidence.

A one-off YouTube account named Nikolas Ratas kept sharing the forged letter. (Source: Nikolas Ratas/archive)

On April 23, fringe outlet The Baltic Word published an opinion piece by Jonas Dringelis that cited the official position by Lithuanian MoD, but then speculated that the news about NATO withdrawing its troops could be true.

Article questioning the debunk of the forged letter by the Lithuanian MoD (Source: The Baltic Word/archive)

The DFRLab has previously examined The Baltic Word and Jonas Dringelis — one of several anonymous online personas that consistently share anti-NATO narratives in English.

On April 24, German media outlet Die Welt published an article titled “How Covid-19 destabilized NATO’s eastern flank.” The article was behind the outlet’s paywall, but RT, the Russian version of the Kremlin-owned outlet, translated it. The version adapted from Die Welt’s article did not characterize the forged letter as false.

RT’s misleading translation of Die Welt’s article, presenting the Stoltenberg’s letter as true. (Source: RT/archive)

The article garnered 271 engagements on social media, according to BuzzSumo.

Engagement on social media for RT’s article. (Source: DFRLab via BuzzSumo)

While the falsified letter, along with the use of a real journalist’s identity to spread disinformation, had the potential of being a successful information influence campaign, overall engagement with the narrative on social media remained rather low. Its use of a real journalist’s identity to promote the claim, however, is a troubling sign of tactics that might be used in other disinformation narratives.

The Lithuanian Armed Forces Strategic Communications Department provided material and consultation for this article.


Nika Aleksejeva is a Research Associate, Baltics, with the Digital Forensic Research Lab.

Follow along for more in-depth analysis from our #DigitalSherlocks.