Log into your member account to listen to this article. Not a member? Join the herd.

Around the world, the internet has become an important source of information, influencing decisions on everything from news and politics to shopping and recreation. Employers today will use internet search engines to check out prospective employees just as voters are likely to “google” politicians they are considering voting for. The search engines, of which Google is the most dominant, categorize the mass of available online information on any particular topic into consumable chunks and decide which ones are most relevant for any particular search.

With so much resting on search results, it is no surprise that a whole industry of reputation management has been spawned with companies dedicated, through means fair and foul, to gaming the system in favor of their clients. While some engage in enlightened best-practice, such as optimizing content and websites for the search engines, others are practitioners of the dark arts, utilizing intimidation and deception in campaigns to suppress unflattering information.

According to its website, the Spanish firm, Eliminalia “was born to ensure every individual and company maintains its privacy and network security, regardless of the uncensored information that has been posted on the Internet – whether malicious, incorrect, or embarrassing”. In short, its mission is to erase internet content its clients consider objectionable. Media reports in August last year – denied by both parties – claimed that Kenya’s Deputy President, William Ruto, had retained the company to spruce up his online image as he prepares for a run at the country’s presidency in 2022.

While some engage in enlightened best-practice, such as optimizing content and websites for the search engines, others are practitioners of the dark arts, utilizing intimidation and deception in campaigns to suppress unflattering information.

However, the techniques the company utilises are not always transparent and could even be illegal. A newly released investigation by Qurium has found that the company is involved in a campaign of intimidation and deceit using fake lawyers and impersonating regulators to threaten websites into taking down content, and creates fake websites to manipulate search results.

In an initial report summarising some of their findings, Qurium shows how the Digital Millennium Copyright Act (DMCA), a US law enacted in 1998 that requires hosting services and internet service providers to take down content when notified of copyright infringements, and data protection regulations as the EU’s General Data Protection Regulation (GDPR), are systematically abused to restrict the freedom of the press, particularly when investigating corruption or abuses of power.

Some of the techniques used by Eliminalia to eliminate, modify or de-index content from the Internet identified by Qurium include creating copies of original content in other websites, backdating it and then filing a DMCA complaint to Google for copyright infringement. Thanks to research access granted by the Lumen Database, Qurium found several identities used by Eliminalia to file such complaints. The company also sends fake GDPR abuse reports using fake legal e-mails and domain names.

De-indexing agreement
Part of a de-indexing agreement

De-indexing is a process that involves removing a website from the search engine’s index but not from the page where it originates which means that a website or a specific URL stops being seen in search results. The Google search engine will automatically de-index content that it determines is not original, that is, which has been previously published on another web page. Cloned websites abuse this by making it difficult for the search engine to determine which is the authoritative source.

One of the methods to push down results in search engines is to clone the full content of the websites in similar domains. During the cloning of the content, all articles that their clients do not want to be published are avoided. This strategy is consistent with their definition of de-indexing in their contracts.

The forensic analysis by Qurium determined that Eliminalia creates fake domain names and impersonates the EU Commission in order to send fake take down requests. The company also submits fake copyright complaints to Google and clones original articles from websites in an attempt to de-index content from search engines. It also uses hundreds of fake newspapers hosted in the Ukraine to support disinformation campaigns on Social Media.

The Google search engine will automatically de-index content that it determines is not original, that is, which has been previously published on another web page. Cloned websites abuse this by making it difficult for the search engine to determine which is the authoritative source.

The Elephant has been among those targeted by such content take-down campaigns. They involve notices from fake legal firms claiming copyright infringement or invoking data protection legislation and demanding removal of the content without revealing the identity of who is paying for their legal services.

After exchanging dozens of e-mails with different “lawyers” in the course of several months, Qurium, which provides secure hosting services for human rights organisations and independent media – including The Elephant – from more than twenty countries, managed to identify those behind such campaigns and the infrastructure that has been put in place to support such businesses.

Emails from IP addresses associated with Eliminalia, which has registered offices in Spain, the US and the Ukraine, were sent to Qurium, purporting to be from lawyers and from the Legal Department of the European Commission in Brussels demanding removal of articles related to corruption in Angola involving Isabel dos Santos or Vincent Miclet.

The Elephant has been among those targeted by such content take-down campaigns. They involve notices from fake legal firms claiming copyright infringement or invoking data protection legislation and demanding removal of the content without revealing the identity of who is paying for their legal services.

One of the emails concerned a story published in The Elephant two years ago regarding French businessman Vincent Miclet’s corruption-tinged exploits in Angola. It was sent February this year to one of Qurium’s internet service providers in the Netherlands by one “Raul Soto” claiming to be from the Legal Department of European Commission.

Fake take down requests
Fake take down requests

The physical address provided was actually that of Regus, an office space rental agency in Brussels, Belgium, which happens to be situated in front of one of the buildings of the European Commission. However, the information on the header shows that the email was actually sent from a Ukrainian IP address using a server in France.

The domain it was sent from, abuse-report.eu, appears to have been registered in September last year for the sole purpose of sending fake data protection complaints as it lacks a website or other contact details. Queries on both Censys and Shodan, which are internet search engines that enable researchers to probe hosts, networks and devices, quickly revealed that Eliminalia was behind the fake setup.

Who.is data on the abuse-report.eu domain name
Who.is data on the abuse-report.eu domain name

A further examination of the internet infrastructure of Eliminalia in the Ukraine found that several of their servers are within an IP address range (62.244.51.50 – 62.244.51.58) which includes the servers of World Intelligence Ltd, a company registered to Diego Sanchez. Diego (Didac) Sanchez Jimenez/Gimenez is also the founder and CEO of Eliminalia. World Intelligence Ltd. hosts almost 300 fake newspapers which are used to run all sorts of “information campaigns” and to clone existing websites in order to “de-index” content out of search engines.

To understand how the 300 fake newspaper websites were used and whether they were used in a coordinated manner, Qurium analysed 3,000 articles published by them during one calendar month. They found that many of the newspapers shared common articles and groups of them posted the same content simultaneously.

The domain it was sent from, abuse-report.eu, appears to have been registered in September last year for the sole purpose of sending fake data protection complaints as it lacks a website or other contact details.

Apart from trying to de-index content from Google Search, they also found that clusters of websites are used to promote fake content. For example, a campaign targeting the Tanzanian whistle-blower website Fichua Tanzania used social media and a cluster of websites to distribute the fake news.

Campaign bots use dozens of registered domains to run disinformation campaigns against a target.
Campaign bots use dozens of registered domains to run disinformation campaigns against a target.

The dangers posed by such tactics to democracy are obvious. Information is the oxygen of democracy, allowing citizens to hold governments to account and to accurately assess their options when making selections in voting booths. Much of this information is today to be found online where it is curated by search engines. However, when companies use laws meant to protect online privacy and guard against copyright theft are abused to silence the press, and when they use fraudulent means to manipulate search results, then the public is deprived of the tools it needs to meaningfully participate in democracy.

This is a problem for the search engines as well. Trust is the currency of the internet. Left unchecked, companies like Eliminalia will inevitably damage public confidence in the results delivered by the engines and thus the public’s propensity to use them.