EDITOR’S INTRODUCTION

This is an inside, yet almost accidental, story about how an American fugitive who sought asylum in Moscow has become a key player in Russia’s global disinformation network. It starts with a NewsGuard analyst happening upon what appeared to be a fledgling Washington D.C.-based news site promoting Russian propaganda. Unbeknownst to her, this was six months after her boss and his family had been threatened in a YouTube video that included an aerial shot of his home and calls to his unlisted phone number by a Russian disinformation operative working from a studio in Moscow. It turns out that this D.C. website, those threats to NewsGuard’s co-CEO, and what NewsGuard discovered were dozens of similar hostile information operations — including a “documentary” that the Russians used as an excuse to invade Ukraine — were all orchestrated by the same man — John Mark Dougan, a former Florida deputy sheriff who fled to Moscow after being investigated for computer hacking and extortion.

As of this writing, NewsGuard has discovered 167 Russian disinformation websites that appear to be part of Dougan’s network of websites masquerading as independent local news publishers in the U.S. and 15 films on Dougan’s since-removed YouTube channel. Ranging from Ukrainian President Volodymyr Zelensky siphoning off money meant to aid the war against Russia so he could buy an estate in England owned by King Charles, to a non-existent U.S. bioweapons lab in Ukraine being the reason the Russians had to invade that country, these concocted stories have been amplified on social media accounts to reach a broad global audience of more than 37 million views—including 1,300,000 views of just the narrative about Zelensky buying the king’s estate.

What follows—including multiple conversations with the Russian operative and an excerpt from NewsGuard co-CEO Steven Brill’s upcoming book, “The Death of Truth,” recounting Brill’s harrowing experience with the same man—is the story of how NewsGuard connected the dots, shining light on a sophisticated multi-media global disinformation operation.

By McKenzie Sadeghi

With additional reporting by Eva Maitland

A RED FLAG PLANTED IN D.C.

During a routine scan of Russian disinformation in late November 2023, my NewsGuard colleagues and I stumbled upon a site called DC Weekly. It branded itself as “your definitive hub for the freshest updates and in-depth insights into Washington, D.C.’s political scene.”

As a journalist based in Washington who scrutinizes the credibility of news outlets as a profession, I was familiar with the landscape of trusted local publications in the area. DCWeekly did not appear to be one of them.

I first noticed the site when it published an article reporting that the Ukrainian Azov Battalion was recruiting in France. It carried the byline “Jessica Devlin,” who was described as a “distinguished and highly acclaimed journalist.” Another scoop: The U.S. had bought a mansion for Ukrainian President Volodymyr Zelensky in Vero Beach, Florida. 

Everything about the website and these articles was a red flag: The site presented itself as a credible new local news source yet was propagating fabricated narratives that smelled of Russian influence.

It turned out that “DCWeekly” is not actually based in the nation’s capital. Nor is “Jessica Delvin” a real person. As uncovered by researchers at Clemson University, the site operates from Moscow, hosted on an IP address belonging to John Mark Dougan. 

His is a name I would come to know well over the coming months. 

‘ASK YOUR QUESTIONS’

After tracking down a phone number listed on his Facebook account, I contacted Dougan via WhatsApp, determined to figure out his motive, although I didn’t expect him to answer truthfully, if at all. He responded by WhatsApp five days later, saying, “NewsGuard? The site owned by the guy Steven Brill? … Stop touting your website’s reputation. You guys are government shills and nothing more. Your service lies more than anyone. Anyways, ask your questions.”

And so, I did. He answered each of them, denying any affiliation with the DCWeekly website.

Dougan’s initial, dismissive response was unsurprising. However, his subsequent messages, beginning two days later, suggested that Dougan was central to a larger story. “…Mr. Brill received a call from the FBI at his home at 6:30 in the morning…Any comment on that?” Dougan wrote to me. Thus began a series of online conversations during which he seemed to be toying with me, both to elicit my responses and, it seemed, to show off his talent for global online mischief, without actually admitting anything.

Dougan’s casual reference to my co-CEO Steven Brill receiving a call from the FBI lingered but didn’t fully register — until I told Brill about Dougan’s comment, and he shared excerpts with me from the manuscript of a book he was working on for publication in June called “The Death of Truth.” The excerpt told a story that he had not yet shared with the NewsGuard staff, but it explained new security measures NewsGuard had taken in March 2023, eight months before my initial discovery of Dougan.

As I read the section of the manuscript Brill now shared, the dots started to connect. It became clear that Dougan was not some hobbyist setting up a phony website from his basement somewhere. This was the same person who in March had targeted my boss by calling him and impersonating an FBI official — a federal crime that can carry up to three years in prison — and who had become well known to the FBI as a Russian operative who has produced some of the Kremlin’s most significant disinformation campaigns. And it was all done from an elaborately equipped studio in Moscow. 

Here are excerpts from how Brill’s book, which is being published on June 4, described Dougan and his operation:

[A] fake Russian FSB bioweapons claim did not receive much attention initially when it was posted in December 2021 on the YouTube account of someone named John Dougan. However, the “report” about the supposed weapons lab, pre-positioned online three months before the Russian invasion, was then cited by Russian officials in explaining to their countrymen and the world the urgent need for the invasion of Ukraine in February 2022. When NewsGuard reported a year later that YouTube had never taken down videos pushing Russian propaganda, despite its promises when the war started to do so, YouTube finally removed those that NewsGuard had listed, including the bioweapons lab video. Dougan and the Russian FSB security service were apparently not pleased….

On Friday, March 10, 2023, a thirty-one-minute video was posted on YouTube with the headline “US Govt Using 3rd Parties to Censor Free Speech and Spread Disinformation!” Reading from a teleprompter and sitting in front of a backdrop showing photos of what appeared to be scenes of war-caused carnage, the narrator John Dougan began by accusing the U.S. government of spreading massive amounts of disinformation. Speaking calmly, with a plain American accent, and clearly at ease using the teleprompter, he then explained that a new enemy was assisting the American government in its disinformation campaigns.

“With the advent of social media,” Dougan said, “it’s becoming harder for the US government to pull the wool over the eyes of the American people, and so they need a mechanism to quash dissenting opinions and the presentation of facts. . . . They are pressuring social media companies to engage in egregious acts of censorship.”

One of the government’s weapons for applying that pressure, Dougan declared, was NewsGuard—“a company that is . . . engaged in a smear campaign against me and fellow YouTuber Mike Jones, pressuring YouTube to have our content removed.”

That content, he explained, included “revelations” in a recent video report that he and Jones had done featuring what he said was an undercover “walk-through” of a bioweapons lab in Ukraine financed by American pharmaceutical companies. “Yes, we were there,” he said. He also….reminded viewers of a… report he had done in December 2021 purporting to document the U.S.-run bioweapons labs in Ukraine. That video, he said, showed his journalism skills because he was “ahead of the curve” in reporting what the Russians only revealed four months later when, citing Dougan’s earlier YouTube documentary, the Kremlin used the weapons lab as a key rationale for invading Ukraine. In other words, Dougan’s trailblazing, independent journalism—achieved, he said, because “we are in a position to travel to places where other Western journalists refused to go and where they refuse to report on”—had informed Russia and the world about the bioweapons threat in Ukraine.

Contrary to Dougan’s claim, NewsGuard was not acting on behalf of the U.S. government, nor had it pressured YouTube to do anything. But NewsGuard had issued a public report nineteen days before Dougan taped this YouTube video declaring, “Full-length Russian propaganda films justifying the war proliferate on YouTube, despite the platform’s ban on Russian state-funded media.” The report revealed that since the Russian invasion of Ukraine had begun a year earlier, the Russian propaganda outlet RT had produced fifty films spreading disinformation on “more than 100” YouTube channels about Ukraine and the war. The films included false reports that Ukraine committed genocide against Russian speakers in Ukraine’s Donbas region, that Western sanctions against Russia following the invasion have had little effect on Russia’s economy while devastating the economies of Western countries, and that “Nazism” is rampant in Ukraine. These were elaborately produced videos, billed as documentaries.

More important, the NewsGuard report explained how these pseudo documentaries had managed to evade YouTube’s ostensible ban on RT propaganda: RT had paid for them to be produced but was allowing them to be rebranded and posted on YouTube channels—including many whose accounts were listed as belonging to the Briton Mike Jones and the American John Dougan. NewsGuard proved that by finding that the Jones and Dougan videos were identical to videos that had first been posted on RT before YouTube banned the RT versions.

Within days of NewsGuard issuing its report, most of Jones’s and Dougan’s RT-financed videos were taken down, including the December 2021 “documentary” about bioweapons labs in Ukraine. It was about two weeks after that that Dougan posted his video about NewsGuard.

“NewsGuard is owned by a man by the name of Steven Shill, excuse me, Steven Brill,” Dougan’s YouTube video continued. “Brill is a far left-leaning Democrat that owns a sprawling . . . estate right down the road from the Clinton crime family in Westchester County, New York.” At that moment a camera shot showing an aerial view of my home appeared. 

Dougan then produced what he said was proof that I was working for the government. He played portions of a tape-recorded phone call in which someone had called me, identified himself as an FBI agent, and asked for my cooperation in an investigation the bureau was conducting into Russian disinformation on YouTube. In the recording, I responded, “We’d be delighted to help.”

As I watched Dougan that Friday morning on YouTube play the recording, I now realized what a strange, unsettling phone call that I had received two weeks earlier had really been about. On Friday, February 24, someone had called my unlisted home phone just before 7:00 a.m. and identified himself, with a name that was garbled, as being “with the bureau.” When I asked, “What bureau?” he had hesitated, then answered, “The Washington bureau of the FBI. . . . We’re investigating reports of Russian videos on YouTube, and we would like to come see you.”

I was immediately suspicious, both because of his hesitation initially to say he was with the FBI (impersonating an FBI agent is a crime) and because it seemed that agents wouldn’t call someone at home so early to make an appointment; if the matter was that urgent, they would just show up. So I told him to put the request in writing and email it to me at my office and, “if appropriate,” we would be delighted to help, whereupon I gave him my office email address. In his telling on YouTube, Dougan made much of the fact that I gave the supposed agent my “personal company email address.” He said it was evidence of my eagerness to cooperate. In fact, my email is listed prominently on NewsGuard’s website. In much of the rest of the video he talked about my wife and one of my daughters.

THE FBI’S ASSESSMENT

I had occasionally received death threats via the NewsGuard website contact email or on the office telephones, as had many of my colleagues, which had required us to add some extra security protocols at our office. This call—a man with a muffled voice calling on my unlisted home number saying he wanted to come see me—seemed much more serious.

Within hours I was in contact with agents from an FBI counterterrorism unit, and they immediately opened a case. That the caller had identified himself as an FBI agent especially interested them. At their request, we culled through emails and voicemail messages to me . . . the rest of the staff separating out the threats (“We know where your office is and you will all die soon”) from simple name-calling and sent the whole batch to the bureau. They began tracking down the senders of the death threats. At the same time, they put in motion a process to get my home phone records from the phone company so they could track down that call impersonating an agent.

Four days later, on February 28, my wife was shaken when she played back a voicemail recording of a message left for me on our home phone by what seemed to be the same person. This time, after again mentioning my daughter, he dropped the FBI pose and said he knew “everything about you guys,” accused me of “selling out your country,” and said that “when you die, and it won’t be long, you’re getting close to that age, people will realize exactly what you were.” We sent the FBI an audio file of the recording.

Ten days later, on the morning I saw the Dougan YouTube video with the aerial shot of my home, I sent it to the lead FBI agent on our case. She called immediately to say that she had been about to call that morning to tell me that they had traced back the two phone calls. They had been from the same person. The man at the other end of the phone both times had been John Dougan, who was in Moscow.

In further briefings, I learned that Dougan, a former marine, had been an officer in the Sheriff’s Department in Palm Beach County, Florida, until 2016, when he fled to Russia and was granted asylum after being targeted in a computer hacking scheme. Since then, I was told, he had become well known to the FBI and, as they put it, “our sister security agencies” as a Russian operative who specialized in producing some of the Russians’ most elaborate disinformation campaigns and narrating them as if he were an independent American journalist. 

Relatedly, it appeared that the aerial video of my home in Dougan’s video was not a simple Google satellite shot. Instead, it had probably been taken by a drone that someone had hired. [Dougan denies this; see below.] I was also told that those same sister agencies reported that Dougan was still in Russia. “So he poses no imminent threat to you,” the lead agent on the case said.

But he knows where I live and the Russians must have people all over the United States, I said. And he must have followers here on his YouTube channel that could act on their own. The FBI agents agreed. This was more serious than a few random crank emails. In a meeting a few days later with three agents and my wife sitting at our dining room table, we agreed on a multifaceted security plan to be implemented by a private security company.

I now live in a home surrounded by twelve motion-detecting security cameras, monitored remotely by the security service, and filled with dead-bolt window and door locks and other reminders of Dougan’s video—which produced multiple new death threats.

Brill’s account, completed as of January 2024, does not tell the full story of Dougan’s journey from former deputy sheriff in Palm Beach, Florida, to a major Russian state media operative. What remained unclear to me was how and why Moscow would so eagerly accept a fugitive small-town deputy sheriff with open arms, extend him permanent political asylum, and apparently put him to work producing phony documentaries and websites.

‘AWESOME’ NIGHTLIFE, ‘DELICIOUS’ FOOD

Dougan’s connection to Russia began to form long before he fled the U.S. in 2016. He says he first visited Russia in 2013, prompted by a Facebook message from a Russian woman who expressed an interest in his work developing PBX systems (private telephone networks used within a company.) “She was the manager of a company that sold telephone equipment and they didn’t have anything like what I was producing,” he said.

Business brochures, provided by Dougan, advertising his PBX phone system venture in English (left) while he was living in Florida, and in Russian (right) after he branched out to Moscow.

In our conversations, Dougan would regularly paint a rosy picture of his new life in Moscow, attempting to get me to reconsider a country that I primarily associated with its notorious disinformation operations.

“You read too much western media. Russia is NOT the place it was 30, 20, or even 10 years ago :))),” he said to me. One late night he described nightlife in Moscow as “F****** AWESOME.” He’d send me photos of Russian bars, fast food chains, and shopping malls. When I asked about Russia’s voting system, he said with no other prompting, “To answer that question you already think you know, absolutely I voted for Putin.” His tales were rich with detail about the quality of life in Russia, which seemed to be topics lifted straight from typical Kremlin talking points.

“I eat at restaurants nearly every day because the food is delicious and cheap. There are no GMOs [Genetically modified organisms] or fillers in the food here, it’s illegal,” he said. (Indeed, Russia signed a law in 2016 prohibiting GMOs, which state media leveraged to spread propaganda about the dangers of GMOs — declared safe for consumption by U.S. health officials — to foster distrust in Western agricultural practices.)

Dougan touted Russia’s free healthcare system: “A few days ago I was sick and a doctor came into my home, gave me an injection and it cost me nothing,” he said. Yet, studies and reports from the U.S. Embassy in Russia, suggest that while healthcare is free in Russia, the reality is that medical services are low-quality and nearly impossible to access without hidden charges.

I asked him about his views on law enforcement in Russia. “Nice guys, they don’t like f****** with people,” he said, adding, “When you hear about Americans getting arrested here, you have to f*** up really bad to get arrested.” I countered this statement by referencing Russia’s arrest of Wall Street Journal reporter Evan Gershkovich. 

“[Gershkovich] was on the outskirts of Yekaterinburg, meeting a source that was supposed to be bringing him documents and samples of a special radar absorbing paint that the Russians were developing.” Dougan responded. “Sorry, but that’s f***** spying. You can’t do that s***… You think if a Russian journalist was caught near the Skunk Works factory trying to get classified info, the U.S. government would just turn a blind eye?” 

(Executive director of the National Press Club Bill McCarren told Time magazine that it is difficult to know exactly why Russia detained Gershkovich, but that it may have been largely in part due to his reporting. Latvia-based news site Meduza reported that prior to his detention, Gershkovich traveled to Nizhny Tagil, home to the Russian defense manufacturing plant Uralvagonzavod. An in-depth search of local Russian language and international media reports yielded no information about “special radar absorbing paint,” suggesting that this specific claim from Dougan was either entirely fictional, or information he only had knowledge of only through close government sourcing.)

As reported by Kevin Poulsen for the Daily Beast, Dougan’s first visit to Russia in February 2013 was marked with a photo Dougan uploaded to Facebook of a meeting he had with Pavel Borodin, a Kremlin official who has long been referred to as Vladimir Putin’s “mentor.” The details about their meeting are murky, but Dougan told Gossip Extra that Borodin asked him to set up “a massive community charity fundraising website for all of the various charities in Russia.”

Asked about his meeting with Borodin, Dougan said, “Borodin is a guy involved with lots of different businesses in Russia. He’s a good guy to meet if you are looking to do business here…We didn’t really talk politics, just talked about bringing my PBX systems to Russia.”

SCRUTINY BACK HOME

At the time of his meeting with Borodin, Dougan was already under scrutiny by local officials in Florida for a website he created called PBSOTalks, an open forum where Dougan and anyone else could anonymously publish grievances and sensitive information about local officials in Florida.

Dougan was accused by local officials of posting the home addresses of 14,000 law enforcement personnel, judges, and other officials on PBSOTalks — data exempt from public disclosure due to its sensitivity. (Dougan denies any allegations of hacking, and says he discovered a flaw in the county’s database and used data analytics to bypass Florida’s confidentiality safeguards without engaging in any actual hacking.)

I asked a spokesperson for the Palm Beach County Department whether Dougan breached any networks and what their investigations into Dougan’s activities concluded. “I have been advised that Mr. Dougan is a wanted felon for cyber stalking using unsubstantiated and fabricated claims that have NO factual basis,” the spokesperson responded.

Dougan’s meeting with Borodin, coupled with his activities on his PBSOTalks website, sparked suspicions among local officials, according to The Daily Beast, that Dougan was partnering with the Russians. Dougan’s explanation is that he decided that if officials were so keen to brand him a Russian hacker, he may as well embrace the role. So Dougan created “BadVolf” — a professional Russian hacker persona that he could use to release illegally recorded phone conversations and other sensitive information, without any trace to him. He was still in Florida at the time.

“Just sit back and watch psychological mindf*** unfold when you mess with БадВолф [BadVolf]!” he wrote in a post announcing the persona. In the interim, his strategy was successful. Dougan had local news stations, Florida residents, and to some degree, even government officials convinced that BadVolf was a legitimate Moscow-based IT worker making noise in Palm Beach. 

“I needed to blame a fictional person, so the feds didn’t come after me for releasing the recordings,” Dougan told me. But by March 2016, FBI agents linked BadVolf to Dougan, leading to a raid on his home. In 2018, Palm Beach County prosecutors charged Dougan with wiretapping and extortion, officially making him a fugitive on the run, according to the Daily Beast, which reported that the details are under seal.  

‘THINGS ARE JUST SO MUCH BETTER HERE’

Dougan claims a better life, denying any nostalgic feelings about his time in the U.S., aside from seeing his loved ones. “I mean, I miss my family, sure,” he said. “But generally speaking, things are just so much better here.”

Now living in the heart of Russia, fueled by a vendetta against the U.S. government he felt wronged him, the “BadVolf” professional Russian hacker persona Dougan concocted years ago turned from a fictional guise to his true identity. Put simply, Dougan seems to have become his own alter ego — a professional operative residing in Moscow, intricately involved in information warfare against the West. 

His past endeavors of creating fake news narratives about local officials in Florida can be viewed as a practice run for what would later become a larger role in the international information war. Apparently operating sites with names like the “Miami Chronicle” thousands of miles away from Moscow, Dougan applied his knowledge of U.S. politics and his understanding of the trust that small communities place in local news outlets. 

THE SHORT LIFE OF THE CHICAGO CHRONICLE

A few weeks after our exchange about DCWeekly in January, a newly registered website called “ChicagoChron” caught my eye. The website published an article titled, “Controversial Pfizer Vaccine Trials on Children Raise Concerns In Ukraine.”

ChicagoChron bore unmistakable signs of Dougan’s tactics: a newly registered domain posing as a local news publication, AI-generated error messages buried at the end of articles, and a website style and format similar to DC Weekly. 

ChicagoChron.com’s baseless narrative about Pfizer was not just confined to this single website. Instead, after appearing on this supposedly Chicago-based website, the false claim quickly gained traction across Russian state TV and various Russian and international social media platforms. On X, the narrative was amplified by more than 50 pro-Kremlin accounts in what showed signs of a coordinated campaign, suggesting an orchestrated attempt to spread the claim widely.

ChicagoChron then disappeared from the internet as suddenly as it had appeared. Despite its two-week life span, the impact of ChicagoChron appeared to be far-reaching, much like its predecessor DCWeekly. As the BBC reported in December 2023, those behind DCWeekly “appear to have achieved a level of success that had previously eluded them — their allegations being repeated by some of the most powerful people in the US Congress.” 

Indeed, in a Nov. 27, 2023, X post, Republican Rep. Marjorie Taylor Greene shared the false claim that Zelensky purchased two seven-figure luxury yachts, a narrative that originated with DC Weekly. “Anyone who votes to fund Ukraine is funding the most corrupt money scheme of any foreign war in our country’s history,” Greene wrote. Appearing as a guest on a Dec. 11, 2023, episode of former Trump White House chief strategist Steve Bannon’s podcast, Republican Sen. J.D. Vance said, “There are people who would cut Social Security, throw our grandparents into poverty, why? So that one of Zelensky’s ministers can buy a bigger yacht?” 

The ChicagoChron article about Pfizer cited as supposed evidence a Feb. 3 YouTube video in which a supposed Pfizer whistleblower named “Anna Sakhno” revealed the details of the purported clinical trials and said that the tests were authorized by the Ukrainian Health Ministry and Zelensky. The inclusion of supposed testimony from a Pfizer employee appeared to be a calculated move: As a former Florida whistleblower himself, Dougan well understood the credibility often given to actual whistleblowers, lending the baseless narrative a veneer of legitimacy.

This narrative laundering scheme followed a Russian disinformation modus operandi outlined by Clemson University’s Darren Linvill and Patrick Warren in a December 2023 study. According to the Clemson researchers, a self-described “journalist” or “whistleblower” claims to have proof of some outrageous act of corruption and cites fabricated documents. The account that is the provenance of the false claim has few followers, but then the video claim is picked up by dozens of obscure pro-Kremlin sites, eventually reaching mainstream sources.

A report from Microsoft’s Threat Analysis Center linked this narrative laundering tactic to a Russian-affiliated influence actor it identified as Storm-1516. “Storm-1516’s method typically begins with a purported whistleblower or citizen journalist seeding the actor’s disinformation on a purpose-built video channel, which is then covered by a seemingly unaffiliated network of managed or affiliated websites…Ultimately, after the narrative has circulated online for a series of days or weeks, US audiences repeat and repost this disinformation, likely unaware of its original source,” Microsoft wrote on April 17.

I asked Dougan about the ChicagoChron Pfizer story: “We reached out to Pfizer. They have no former employee by the name Anna Sakhno. So, what do you know about the site Chicago Chron?”

His tone shifted from his earlier outright denials to cryptic acknowledgments. “You guys are actually on top of things, damn. I’m actually impressed,” he responded. “Never heard of them. But I suspect the site will be nuked tomorrow, so I heard.” True to his word, the site went offline the next morning. NewsGuard got in touch with an agent for domain registrar Liquidnet seeking information on why ChicagoChron.com was suspended. She said she couldn’t provide any details about why the site was taken down, but that “he has many hosted domains…At the moment the registered domains are around 10…I am afraid I can’t disclose anything further.”

THE DANCE BETWEEN US

Pressed about the obvious similarities between ChicagoChron and DCWeekly, Dougan said, “Coincidence I’m sure…Keep up the good work. If you find something, let me know. And if you don’t, well then, maybe I’ll give you a hint.” 

This pattern of engagement — subtle semi-acknowledgement followed by a denial — would become a familiar dance between us. The discovery of ChicagoChron made it clear that DCWeekly was not just some isolated disinformation website. I soon found what appeared to be a network that already spanned multiple states, and seemed poised for significant expansion as election season neared.

As new seemingly innocuous national and local news continued to crop up around the U.S., I found myself at the center of a cat-and-mouse game. Each conversation, and every cryptic message Dougan sent uncovered layers of an individual who I was starting to perceive as a master manipulator.

With new sites and narratives I found, I would message Dougan about it, and he’d regularly deny involvement, occasionally slipping hints. One evening, when I opened up several of the websites, I discovered my own name. “Founded by the visionary U.R. McKenzie, our publication has been a beacon of journalistic excellence,” the sites said. My name was scrubbed from the sites 10 minutes later.

UNRAVELING THE GROWING NETWORK

This pattern continued: Every few weeks or so, a new site would pop up spinning a new elaborate disinformation narrative that would reach millions and spread in multiple languages. So far, I have found 167 websites in the Dougan network.

After DCWeekly and before ChicagoChron came ClearStory.news, which on Feb. 3 — approximately two weeks before the death of Russian opposition leader Alexei Navalny — published an article baselessly claiming that Navalny’s wife had multiple affairs. The article cited a video of a woman identifying herself as Yulia Navalnaya’s former personal assistant Anna Gonchar, claiming to have proof of the affairs. 

Then came a narrative from a website called NYNewsDaily.org alleging that U.S. film company Paramount Pictures teamed up with a Ukrainian studio to produce a $115 million budget film about Zelensky. This was followed by a website called the Miami Chronicle that published AI-generated audio purporting to show former U.S. officials Victoria Nuland and James O’Brien discussing Navalny’s replacement. 

It appeared that Dougan was getting better at hiding his tracks. I plugged the AI-generated audio purporting to show Nuland and O’Brien into several AI detection tools that I considered reliable, only to be surprised to see that the detectors rated the clip as “Unlikely AI-generated.” 

So, I asked Hafiz Malik, a professor of electrical and computer engineering at the University of Michigan-Dearborn and digital forensics expert, to analyze the audio, which he concluded was fabricated. In fact, the audio likely underwent anti-forensic processing, in which certain effects are applied to deepfakes to evade AI detection tools, he said. Dougan and his team were clearly better at this than the average deep faker.  

“Deepfake detection tools, if you have AI-generated content, typically are pretty successful in detecting it,” Malik told me. “However, if you apply anti-forensic processing, or post processing, that post processing actually makes these detectors fail.”     

STRONG EVIDENCE, CONTINUED DENIALS

To be clear, Dougan denies being behind any of these websites, despite all evidence pointing to him. NewsGuard, The New York Times, cybersecurity company Recorded Future, the European Union, Clemson University, Logically, AntiBot4Navalny, and the BBC, have all reported that websites within the network are hosted from Moscow. Domain records show that nearly all of the websites use the same identification tracker as Falconeye.tech, which is in turn linked to Dougan through his personal website BadVolf.com. 

The sites in the network are also interconnected by the same Cloudflare nameservers, a system that directs internet traffic to various domains. As noted by AntiBot4Navalny,  an anonymous group of volunteers that tracks Russian influence operations, an overlap in Cloudflare nameservers does not conclusively prove a connection between the sites, but it “most likely” indicates that the domains were registered under the same account. As found by the European Commission, a batch of sites within the network (BostonTimes.org, SanFranChron.com, ChicagoCrier.com, LondonCrier.com) are hosted under Russian IP addresses overseen by an agency identified as “A MGTS-USPS” that operates within the Russian Federation. 

When I asked him about allegations from U.S. officials that he has been involved in elaborate disinformation operations, as detailed in Brill’s book, Dougan said, “It’s the first time I’m hearing it. It’s a laugh, honestly. Of course, US federal officials accuse everyone of working with Russia if s*** isn’t going the way they want…This is their default position and it’s laughable. Tell these people to have the Russians contact me and give me my paycheck that apparently I must be owed for such services. Because they must have forgotten. In all seriousness, I haven’t heard jack s*** from the Russians except a bunch of bureaucratic bull**** when it comes to immigration.”   

Nonetheless, however difficult it may be to pin down where and how Dougan gets a paycheck, it defies logic that he could receive asylum in Russia, operate as a “journalist” in Russia, and finance his global videos (where he has received access to Russian officials and troops) and his internet activities without the support of the authoritarian state. Indeed, while Dougan claims that the Kremlin is no fan, officials there clearly have taken a liking to his content. I watched in real time how what are apparently his websites were regularly cited by Russian state media websites and TV channels, Russian embassies, and members of the late Wagner Group leader Yevgeny Prighozin’s Foundation for Battling Injustice.

ZELENSKY ‘BUYS’ THE KING’S ENGLISH CASTLE

A prominent example of the mutually reinforcing relationship between the Dougan network and official media operated by the government of Vladimir Putin was an article from a website within the network called the London Crier. This site — operated from Moscow, not London — ran a story that falsely claimed Zelensky had purchased King Charles’ Highgrove estate in the English countryside. Days before the article ran, Dougan hinted to me on March 31, “Just wait until you hear that High Grove house was sold to Zelensky.” I then monitored the apparent Dougan-affiliated websites I knew about daily. Three days elapsed until the London Crier article went live, claiming that the property sale was supposedly confirmed by Grant Harrold, a former butler to King Charles.

But unlike the “London Crier,” one of my UK-based NewsGuard colleagues actually spoke with the supposed source to see if the story was true, providing the human reporting entirely missing from Dougan’s sites. Our interviews debunked the Highgrove narrative just hours after it surfaced. Harrold, the former butler, told NewsGuard in an email, “These claims are completely false, I have never put out a statement or spoken to anyone regarding this story.” A Buckingham Palace source said that the residence remains part of the Duchy of Cornwall estate, which belongs to the Royal Family.

Nevertheless, the narrative, which Dougan had presciently previewed for me, spread rapidly from the London Crier to X posts by Russian influencers, to numerous pro-Kremlin and state media outlets, and ultimately to the Russian Embassy in South Africa’s X account. In just six days, the claim was shared in 7,300 articles and social media posts, accumulating 1.3 million views. Ruslan Trad, a resident fellow at the Atlantic Council’s Digital Forensic Research Lab told NewsGuard that the claims are “very successful in regions close to Ukraine, which are still today deeply influenced and affected by the Russian propaganda.”

I asked Dougan why this particular claim spread so rapidly and wide. “It’s a very well-read publication that has been around for a very long time,” he said, sending me an AI-generated photo of a fictitious boy holding a hoax “London Crier” newspaper, clearly unable to hide his glee over his successful launch of the false claim targeting Zelensky.

‘A FAKE NEWS SITE IS NOTHING WITHOUT REAL NEWS’

At first glance, Dougan’s websites can easily pass for traditional local news sources. They feature a mix of everyday typical local news content, strategically placed alongside pro-Kremlin, Russian-language stories about the war in Ukraine. They seem like newspapers founded long ago. However, a closer examination reveals glaring discrepancies. Dougan is creative and energetic, even frenetic. But he is also careless and perhaps more eager to have added a personal, playful dimension to his work than his Kremlin colleagues might like.

The sites’ About and Contact pages contain Latin dummy text and provide no information about their ownership. Articles occasionally include an AI-generated message hidden at the bottom. One example, which reads like a prompt requesting an AI model to draft a news story written with a clear point of view, is “Please rewrite this article taking a conservative stance against the liberal policies of the Macron administration in favor of French working-class citizens.”

The websites’ content sections have included “Fox Politics Rewritten,” and “Russian Publications Rewritten,” indicating their large-scale practice of repurposing content from other media outlets using AI, presumably in an attempt to appear as legitimate news operations. As Dougan put it himself in a social media post in 2016, “A fake-news site is nothing without real news. There must be real news with real photos on the front of the site so the fake story blends in and becomes believable.”

The “journalists” listed on the sites are as fictitious as the stories under their names. For example, “Lucas Turner” of the DCWeekly website, is identified as “a passionate environmental journalist committed to raising awareness about the planet’s most pressing issues.” A reverse image search of the photo for “Lucas Turner” reveals that it is actually Michael Olivares, a Spain-based male model.

“It horrifies me to think that some stranger, I don’t know what intention, could use an image of mine without my consent, being able to impersonate me and thus deceiving many people,” Olivares told NewsGuard. 

‘THE TRAGIC MURDER OF OUR OWN JESSICA DEVLIN’

Perhaps Dougan’s most elaborate fake news persona was Jessica Devlin, described on the DCWeekly website as a “distinguished and highly acclaimed journalist whose career has taken her to some of the most critical and challenging regions of the world.” Clemson University researchers exposed “Jessica Devlin” as a fake identity that misappropriated a photo of Canadian writer Judy Batalion.

As news outlets such as FactCheck.org and the Agence France-Presse and reporters including Shayan Sardarizadeh with BBC would regularly call out the fictitious reporter, Dougan seemed to relish the spotlight on this fake persona. The DCWeekly website ran a fake obituary of its fictitious reporter, declaring the tragic demise of “Jessica Devlin,” showing his theatrical approach and use of trolling to bait his critics into further attention.

“Jessica Marie Devlin, a top investigative journalist for DC Weekly News, was brutally murdered in Costa Rica,” the story said, complete with a YouTube video of Delvin’s purported friend announcing her death, along with a supposed police report about the murder. 

“DCWeekly.org used my photo without my consent or prior knowledge,” Batalion told NewsGuard. “I had never heard of DCWeekly.org and I have never had any contact with them.”

The murder hoax was a departure from the network’s usual disinformation — the narrative appeared to be less about promoting Russia’s interests and more about taunting the community of journalists and researchers who had been tracking his movements.  “Jesus Christ. It’s a pity that journalist Jessica Devlin has died…Maybe she was murdered by the deep state,” he told me. “…Poor girl. I was starting to like her.” 

Dougan’s operations were my main focus day in and day out, so much so that I found myself inadvertently playing into his online trolling antics. “RIP Jessica,” I said to Dougan in our conversation about her death, asking if there would be a funeral for Devlin. “I bet you are funny as hell in a social setting,” he responded.

Roughly a month later, DCWeekly began running articles credited to Jessica Devlin, despite the fact that she had supposedly been murdered. “Was Jessica Devlin resurrected?” I asked, half-jokingly. “She’s like Jesus I suppose,” he responded.

FINDING THE RUSSIAN TIES

While attempting to spot the new websites and narratives as they appeared, I was searching for links between Dougan and Russian state actors. Others were, too. The New York Times reported that the network was linked to the remnants of the Internet Research Agency — a notorious Russian troll farm sanctioned for meddling in U.S. elections, founded by Prighozin, whose influence operations have persisted even after death. A report by cybersecurity company Recorded Future concluded “that there is a realistic possibility that the network receives strategy, support, or oversight from Russian government entities and the broader Russian influence apparatus.”

A French official source close to disinformation topics told NewsGuard in May 2024 that the Dougan network is integrated into Project Lakhta, a Russian interference operation previously funded and overseen by Prigozhin that targets U.S., European, and Ukrainian audiences. According to the U.S. Treasury Department, Project Lakhta has an operating budget of millions of dollars, and the operation relies on troll farms and fake personas posing as U.S. persons in an effort to interfere in U.S. elections. But my attempts to find more concrete evidence supporting Russian financial or ownership links fell short.

Asked about the network’s reported ties to Project Lakhta, Dougan said, “I absolutely deny that I’m part of any Kremlin plot. I have no contact with anyone in government here, aside from a few cops and FSB [Federal Security Service] friends that I have an occasional beer with. And we almost never talk politics. It’s very rich that the United States government is worried about election interference…they have caused more death and destabilization around the world than anything that Russia has ever done.”

TIMELINE OF WEBSITES

I initially found 15 websites within the network, all of which carried names mimicking trusted local news publications such as “The Flagstaff Post” and “The Boston Times.” I remained suspicious that the real tally was much higher than this group of sites and that it would grow as the election neared. 

Indeed, on May 7, during my regular daily scan of the network, I noticed that one of the sites, BostonTimes.org, was redirecting to a new news site called CentralRecord.org, which was registered just a week before on April 30. When I asked Dougan about CentralRecord.org, he denied any affiliation, and the site went inactive shortly after. 

A cybersecurity researcher who requested not to be further identified said that CentralRecord.org is connected to 22 additional domains, many of which bear benign names such as Georgia Gazette and Pennsylvania Messenger and are likely connected to Dougan. As of this writing, these additional 22 domains have no actual content, only displaying the message, “Apache2 Ubuntu Default Page: It works.” This default message signals that the domain and servers are operational, but have not yet been configured with any content, suggesting that these other sites could be activated at any given time.  Call them sleeper sites.

From May 6 to May 12, Dougan went off the grid. My attempts to reach him were met with silence or dismissive replies. “Seems to be lots of changes in the last couple of days…domains going up, domains going down,” I said, to which he replied, “No idea what you are talking about.” On May 11, I messaged him again, “You seem to be very busy these days.” He responded, “If you only knew.”

His activities became clear when I discovered that, during this time period, 132 new domains were registered that appear to be connected to Dougan. The domains carry names mimicking newspapers founded centuries ago such as “The Arizona Observer,” and the “Evening Star.”

In total, NewsGuard has discovered 167 Russian disinformation domains that appear to be part of Dougan’s local news network. Ranging from Zelensky siphoning off money meant to aid the war against Russia so he could buy that estate in England owned by King Charles, to Zelensky smuggling 300 kilograms of cocaine out of Argentina into Ukraine, these concocted stories have been amplified on social media accounts throughout the world to reach a broad global audience. The 19 significant false Russian disinformation narratives that NewsGuard has identified Dougan as promoting, often involving the “whistleblower” tactic, had received a total of 37.7 million views as of May 19, 2024.

BY THE NUMBERS

I dedicated hours to watching Dougan’s vlogs looking for any clues, zooming into his backgrounds, and reverse searching faces of those occasionally appearing with him in his studio. Yes, he had posted a video of himself and an acquaintance working in the studio — the same place where he filmed the YouTube video about Brill, sitting behind a backdrop of self-portraits depicting his “citizen journalism” efforts covering the war in Ukraine. However, my hunt didn’t yield concrete evidence of financing or control by the Russian government, although it increasingly painted a picture of someone clearly embedded in the state media apparatus.

Nonetheless, Dougan regularly denied any ties to state actors. “I don’t care if they want to tie me to Prigozhin, that’s street cred for me. Still, it’s a lie,” Dougan said, referencing news reports about links to the Internet Research Agency. At another point he said, “I’m actually not liked much by the government here…I once told Russian television to f*** off.”

Dougan would act entirely clueless whenever I brought up the “IRA.” He said, “IRA affiliated? Irish Republican Army?” After I clarified that I was referencing the Internet Research Agency, he said, “What is that?? Sorry, I actually don’t pay attention to the news…Ahhh the troll factory??? F*** if I know.”

A MOSCOW MEDIA STAR IS BORN

Yet in Moscow, Dougan is regularly in the news. He has appeared as a witness at Russian public hearings on the war against Ukraine, has gotten access to interview Ukrainian prisoners of war in Donbass, has filmed those lengthy disinformation documentaries, attends public speaking events, and appears on Russian state TV. These didn’t seem to be casual events. They all painted Dougan as a patriotic whistleblower committed to exposing Western corruption — a figure that Russian media is all too eager to promote.

Russia-operated RT praised Dougan’s arrival to Russia with articles including “From ex-cop to exile: Former police officer flees US after exposing crimes in his department,” “Why American cop and whistleblower Mark Dougan turned to Russia for sanctuary,” and “Facing the FBI & fleeing to Russia: US ex-cop reveals epic struggle to expose corruption.” Every year on International Day Against Police Brutality, RT says it shares its documentary about Dougan called “Breaking BadVolf.” And in 2017, state-run Sputnik News ran an exclusive titled “The Price of Truth…How one American ex-cop and whistleblower found refuge in Russia.”

Dougan welcomes the attention, insisting his supporters would be outraged if he were extradited. “Vladimir Putin has made it clear Russia doesn’t give up human rights fighters, and you can say a lot of things about president Putin, but he doesn’t flip flop,” he wrote in a 2020 Reddit post. “There would be outrage here if they gave me back. I’m actually quite famous here, Google Джон Марк Дуган , my name in Russian.”

Antibot4Navalny, the group of volunteers that tracks pro-Russian inauthentic operations, pointed to an interview Dougan conducted with the pro-Russia former mayor of Mariupol, Konstantin Ivashchenko. “A lengthy interview with Kremlin-appointed ‘mayor’ of Mariupol, in which Dougan poses as Western journalist, and [the] mayor treating him as such, are extremely unlikely for an individual’s independent initiative,” the group told NewsGuard. 

“Doing favors for the Kremlin on a regular basis in return for asylum [or] citizenship as a way to avoid persecution at home is a recurring pattern for multiple pro-Kremlin Russia-located voices having a Western origin,” Antibot4Navalny added.  

Indeed, Dougan’s journey from the U.S. to Moscow is not unique. He is part of a growing number of Western public figures who have relocated to Russia and pump out disinformation, including Tara Reade, who accused U.S. President Joe Biden of sexually assaulting her, former U.S. Army soldier John Mcintyre, and UK YouTuber Mike Jones.

Dougan’s involvement in Russian propaganda efforts is further evidenced by his previous role as part of a government-funded program called “Expat Russia,” which offers immigration and legal services “for those who consider moving to Russia from Western countries.” The program hosts blogger content competitions on “videos about the attractive sides of Russia.” At the bottom of Expat Russa’s about page, I saw Dougan’s name listed as one of the program’s bloggers and mentors.

“I don’t care about that kind of stuff, it was an easy 2k so I agreed,” Dougan said when I asked him about his involvement in the program. 

AntiBot4Navalny told NewsGuard that one “proven” connection between Dougan and Prighozin’s media empire is the network’s laundering of narratives originating from Prighozin’s nonprofit the Foundation to Battle Injustice, a link observed by multiple others including Eliot Higgins, founder and director of Bellingcat, and David Puente, a fact-checker for Italian news site Open.online. The group said another apparent link, which it described as a “pretty weak and indirect one” involves automated bots previously tied to the Internet Research Agency that regularly promote Dougan’s laundered narratives. 

“I doubt that Dougan is very much a self-driven leader that makes other parts move,” a spokesperson for AntiBot4Navalny said. “[He’s] more likely one of many cogs in the Kremlin’s machine, who is merely following assignments given by someone else. In a talented way in some aspects, but not much more than that. Having said that, I believe it would be fair to say that Dougan upgraded one of the aspects of Prigozhin’s work to a new level.” 

Antibot4Navalny pointed to Doppelgänger, a Russian disinformation operation named after its tactic of forging credible media outlets. The group said it observed the Doppelgänger campaign amplifying Dougan’s disinformation narratives using various tactics, including reposting the claims on X using automated bots, repeating the claims on Doppelgänger news sites, and repeating Dougan’s false claims in fabricated celebrity quotes. 

THE SHUTDOWN AND RESURRECTION OF BADVOLF

As of this writing, 116 of Dougan’s local news websites remain active and running, pushing out a steady stream of hyper partisan content as the elections near. An analysis conducted by AI detection company Pangram Labs on behalf of NewsGuard found that the network has published more than 50,000 articles in less than a year.

Dougan’s efforts have started to extend beyond news sites. On April 2, 2024, a domain linked to Dougan’s IP address was registered under the name “XposedEm.com.” The site describes itself as a public forum “exposing hypocrisy” in the U.S. government. “BadVolf” was back to his old ways.

“Calling all patriots and truth-seekers, Republican OR Democrat. The corruption in Washington has reached its boiling point,” a post from BadVolf said. “The swamp creatures enrich themselves while hard-working Americans suffer. Enough is enough.” 

BadVolf offered “MAJOR CRYPTOCURRENCY REWARDS” for information on New York Attorney General Letitia James, who ran on a platform of prosecuting Donald Trump, and Atlanta-based District Attorney Fani Willis, who is prosecuting Trump. “Leak their emails. Record their backroom deals. Photograph the bags of cash changing hands. The dirtier the details, the bigger the fish, the bigger your crypto payout. PROTECT your country and make some cash in the process.” As of writing, Xposedem.com is no longer active and now redirects to DCWeekly.org.

The FBI declined to comment when asked for additional information related to Dougan seeking incriminating information on New York Attorney General James and Fulton County District Attorney Willis through his Xposedem.com website or his activities in Florida before he fled to Moscow.

Throughout our conversations, a sense of paranoia lingered as to why Dougan, known for his hatred toward the media, would engage with someone from a company he had previously targeted. Anytime something out of the ordinary happened, my mind immediately went to Dougan.

My colleagues and I regularly speculated about his motives: Perhaps he was trying to use me as a way of targeting NewsGuard and my co-CEO again. Or maybe he was setting me up in a manner reminiscent of how an Internet Research Agency operative once played friendly with a New York Times reporter in 2015, only to later to target the journalist with a disinformation campaign. 

I eventually confronted him directly about his purpose in engaging with me. “I like your demeanor. Even though I don’t really trust you either,” Dougan said. Still skeptical, I asked him again weeks later if he was trolling, given my role in the media, which I thought he so deeply despised. “That’s true…But you have the vibes of an honorable person, even if you are working for the mainstream media. You’re young. I have high hopes for your future. I think it’s bright and you are inquisitive.” 

Finally, in our last conversation, I came back to his intimidating contact with my boss more than a year ago. This was the first time I would tell Dougan that Brill had been aware for more than a year that he was the one who had called his home impersonating an FBI agent and published an aerial shot of his home.

“Showing somebody’s house is now somehow against norms? It’s not like I published his address. I simply said he lived a stone’s throw away from the Clintons and wanted to show his sprawling pad…,” Dougan said when I asked if he had considered Brill or his family’s safety. “Perhaps if Brill had any integrity or honesty in what he was doing, he wouldn’t be afraid of people knowing where he lives. My address in Moscow is out in public and I invite people who don’t like my content to come and talk about it….”

Brill had been told by the FBI that the aerial shot of his home featured in Dougan’s YouTube video appeared to have been taken by a drone. Dougan flatly denied this, stating that the image of the home came from Google Maps. 

Despite denying the use of a drone, Dougan openly admitted to a crime – posing as an FBI agent in his first call to Brill. 

“NewsGuard touts its partnerships with federal agencies on the front of their websites,” he said. “I wanted to see his level of cooperation with federal agencies, and it was very clear that he was willing to do anything asked of him by a federal agency. Newsguard is one of the biggest propagators of disinformation on behalf of the US government….”

“So, the FBI’s claim that it was me is correct,” he added.

Asked if he knew that impersonating an agent is a crime and if he was concerned about that, he replied, “F*** the FBI. They are the biggest criminals in America.”

Dimitris Dimitriadis and Chine Labbe contributed this report.