The protocol is supposed to prove that an email really came from where it says it did, and in this case, that’s Meta’s fb.com domain. The Wire posted a video showing the authentication process — that the outlet says was signed off on by two independent security experts — and came to the conclusion that the email is real.
In response, Meta said that the email is “fake” and that there’s no such thing as a “watchlist.” Stone also denies the existence of the email in a statement on Twitter. “This is completely false,” Stone writes. “I never sent, wrote, or even thought what’s expressed in that supposed email, as it’s been clear from the outset that @thewire_in‘s stories are based on fabrications.”
Users on the web have poked holes in The Wire’s allegations as well. In a thread on Twitter, cybersecurity expert and author Arnab Ray found that the DKIM analysis video posted by The Wire doesn’t actually prove Stone himself sent the email.
As explained by Ray, “DKIM is based on a domain public key,” which means it can’t prove that it came from a specific person; it only shows that it came from the domain attached to a specific organization, like fb.com. This leaves room for someone with access to the organization’s email to spoof their address, making it seem like the email came from Stone but really didn’t.
Prakash also shows how easy it is to create a video that makes it looks as if he’s using a DKIM tool with a two-line shell script named “dkimverify.” Prakash made it so the “tool” outputs a “signature ok” result regardless of what’s entered, which indicates the DKIM is verified. The Wire has since revealed that, during the review of its reporting, its investigators haven’t been able to verify the validity of Stone’s alleged email.
The emails between The Wire and supposed security experts who verified the outlet’s DKIM authentication process are also questionable. Prakash points out that the dates on the emails don’t match up on the current and archived versions of the article, with the former listing the email’s year as 2022 and the latter saying 2021.
There’s also evidence that the emails may have been fabricated altogether. Kanishk Karan, a policy manager for online platforms, found that The Wire referred to him as an “independent security expert” at the bottom of one of the unredacted emails, along with a fake email address made to look as if it belongs to him. Karan says that while The Wire reporter Devesh Kumar did contact him for DKIM verification, he never did it and referred him to other experts instead. In its most recent update, The Wire admitted the other security expert featured in the story, Ujjwal Kumar, also “denied sending such an email” to sign off on the DKIM process.
Whatever happened, it doesn’t look good for The Wire. One way or another, there’s mounting evidence that their initial reports weren’t quite telling the whole story. Some skeptics believe The Wire fabricated the evidence entirely and created a phony story in an attempt to smear Meta. There are even some who think someone aligned with the BJP leaked the story in a deliberate effort to discredit the publication.
Meanwhile, others think The Wire might’ve been the subject of an elaborate ruse, with someone close to Meta creating the fake evidence and tricking the journalists into believing it’s real. The Wire is considering this as well, noting “We are still reviewing the entire matter, including the possibility that it was deliberately sought to misinform or deceive The Wire.”
As more information comes out, things are starting to get clearer, though. A recent report from Platformer revealed Kumar is the only one who had contact with The Wire’s so-called “source,” and just last week, Kumar claimed his accounts were hacked. In addition to retracting Kumar’s reporting on Meta, The Wire has also suspended access to his story on Tek Fog, an app supposedly used by the BJP to infiltrate, control, and spread misinformation on various social media platforms. The Wire states the report has “been removed from public view pending the outcome of an internal review by The Wire, as one of its authors was part of the technical team involved in our now retracted Meta coverage.”
“In the light of doubts and concerns from experts about some of this material, and about the verification processes we used — including messages to us by two experts denying making assessments of that process directly and indirectly attributed to them in our third story — we are undertaking an internal review of the materials at our disposal,” The Wire explains. “This will include a review of all documents, source material and sources used for our stories on Meta. Based on our sources’ consent, we are also exploring the option of sharing original files with trusted and reputed domain experts as part of this process.”
But wherever this confusion and doubt came from in the first place, the point of reporting is to suss this stuff out — and that clearly didn’t happen here.
Meta’s leadership has had a turbulent relationship with the Indian government, and this bizarre back-and-forth is only going to make things worse. When Facebook whistleblower Frances Haugen came forward last year, internal documents showed that Meta (then-Facebook) largely ignored issues happening in India. According to The New York Times, Meta allocated 87 percent of its budget for classifying misinformation on the platform to the US in 2019, while the remaining 13 percent was spread across the rest of the world. This lack of moderation left a rash of hate speech and misinformation on Facebook in the country.