October 23, 2024
SINGAPORE – The authorities on Oct 22 ordered the blocking of 10 fake websites linked to foreign actors that could potentially be used to carry out disinformation campaigns against Singapore.
The websites mimic typical news publications and are unlikely to raise suspicion to the untrained eye, but their tactics have been flagged by global cyber threat researchers as having the same playbook as state-run hostile information campaigns.
In a joint statement, the Ministry of Home Affairs (MHA) and Infocomm Media Development Authority (IMDA) said on Oct 22 that it is necessary to direct internet access service providers, including Singtel, M1 and StarHub, to block access to the 10 sites for users in Singapore under the Broadcasting Act.
MHA said that, based on investigations, there are no Singaporeans involved in operating any of the websites and the “level of exposure of Singaporeans to these 10 websites is assessed to be currently low”.
Although the websites have not mounted any hostile information campaign against Singapore, they could potentially be used to do so in future, said MHA in response to media queries. “It is therefore in the public interest to take pre-emptive action against them.”
MHA and IMDA said the websites masquerade as Singapore websites by spoofing or using terms associated with Singapore in their domain names and incorporating familiar local features and visuals.
“They also carried content on Singapore, some of which was generated by artificial intelligence,” the authorities added.
“These are common tactics used by malicious foreign actors: build websites which can attract a local following, that may subsequently be used as platforms to mount hostile information campaigns.”
MHA and IMDA noted that there are currently no provisions in Singapore’s foreign interference law – the Foreign Interference (Countermeasures) Act (Fica) – to pre-emptively act against websites.
“The Government is reviewing the Act to see how this can be addressed,” the authorities said, urging Singaporeans to remain vigilant when consuming online content, and alert to such inauthentic websites and the threat they pose.
The agencies did not disclose who is behind the websites.
However, cyber threat reports published by the likes of Meta and Google-owned cyber-security firm Mandiant frequently link Russia and China to hostile information campaigns that go by a similar mode of operations.
The websites are:
1. zaobaodaily.com
2. singaporeinfomap.com
3. Singaporeera.com
4. Singdaotimes.com
5. Todayinsg.com
6. Lioncitylife.com
7. Singapuranow.com
8. Voasg.com
9. Singdaopr.com
10. Alamak.io
Checks by The Straits Times show that they have been blocked as at 5.30pm on Oct 22. The sites, many of which have been publishing news in English and Chinese since as far back as 2020, contain articles on topics like daily news, economics, technology, culture and politics. But these sites are believed to be laying the groundwork for disinformation, based on threat research and cases overseas.
MHA and IMDA said zaobaodaily.com and singaporeinfomap.com use domain names that closely resemble legitimate Singapore-related websites, carrying content that could mislead audiences into thinking it reflects local opinions or official positions.
The name singaporeinfomap, for instance, is closely linked to a now-defunct online portal run by the former Ministry of Information, Communications and the Arts as a homepage for the Republic during the early days of the internet.
Investigations into Alamak.io – which uses the Singapore-associated colloquial expression of shock – found that many of the articles it carried were paraphrased versions of Singapore-related news articles published by local mainstream media, said MHA and IMDA.
The site also published commentaries on sociopolitical issues, including one that falsely alleged that Singapore had allowed other countries to conduct their biological warfare research activities here, the authorities added.
The remaining network of seven websites, including Singaporeera.com and Todayinsg.com, uses the country’s name or associated terms like “Lioncity” in the domain names and published Singapore-related content, said the authorities. Nearly none of the articles appears to have writers’ bylines, and most stories are credited to newswires like Times Newswire, which analysts at Mandiant found in 2023 to be at the centre of a separate Chinese influence operation that targeted US audiences.
The articles are often repeated across the sites and appear to be linked to global networks of inauthentic news websites that have been flagged by cyber-security researchers like Mandiant and The Citizen Lab to have led hostile information campaigns against other countries, said IMDA and MHA.
Overseas cases have shown how malicious foreign actors have maintained inauthentic news platforms to spread false narratives to sway the target population’s views and advance their own interests, said the agencies.
“They do so by inciting social tension, exploiting societal fault lines, manipulating elections, or undermining confidence and trust in public institutions,” they said.
Coordinated inauthentic behaviour
The latest directive against the 10 sites comes after the authorities in July blocked a network of 95 social media accounts used in a coordinated disinformation campaign that falsely claimed Singapore was under China’s control.
The accounts had published more than 120 posts containing videos on Singapore’s leadership transition and were linked to self-exiled Chinese businessman Guo Wengui – a vocal critic of the Communist Party of China and a convicted fraudster.
MHA directed Facebook, Instagram, YouTube, TikTok and X to block the accounts for Singapore users, in the first use of Fica.
In February, digital watchdog Citizen Lab flagged more than 100 websites disguised as local news outlets in Europe, Asia and Latin America, pushing pro-China content in a mass influence campaign linked to a Beijing public relations firm.
The sites’ content ranges from conspiracy theories, often about the US or its allies – such as a piece blaming American scientists for “leaking” the Covid-19 virus – to articles attacking Beijing’s critics.
Fake accounts, which are a key component of strategically manipulating public debate, have been under the scrutiny of many cyber-security analysts.
In the third quarter of 2023, Meta reported that it removed more than 4,700 Facebook accounts in China that targeted the US and posed as Americans to post about US politics and US-China relations.
It also removed 20 other pages and accounts linked to China and Russia that used fake personas of journalists, lawyers and activists and fictitious media brands to mislead audiences.
At the time, Meta flagged China as the third most common geographic source of inauthentic behaviour campaigns, after Russia and Iran.