November 2020
In July 2020, a clone of the Colombian investigative news site La Nueva Prensa (lanuevaprensa.com{.}co) appeared on the Internet. The clone was published under the domain lanuevaprensa{.}net, using the branding of La Nueva Prensa. The clone posted modified articles of the authentic newspaper with altered text and images. It is said that “a picture is worth a thousand word”, that also applies in digital forensics.
Dissemination channels
The imposter used two channels to spread the disinformation, the cloned website of La Nueva Prensa, and a fake Twitter account (@lanuevaprensa_ ) The Twitter account openly claims to be a “Fake” account of @lanuevaprensaco, most probably to avoid getting censored by Twitter. The account is used for disseminating the forged articles to social media users. The it is interesting to see that the Twitter account was created already in December 2016, and has no less than 886 followers.
On October 20, the clone website of La Nueva Prensa published the article “Las fotos del piloto del Cártel de Sinaloa con Gustavo Petro, Gustavo Bolívar y la plana mayor de la izquierda colombiana“. The article was quickly disseminated by the fake Twitter account.
Image 1: Clone website of La Nueva Prensa 
Image 2: Fake Twitter account of La Nueva Prensa
The missing pilot
The article contained a picture (Image 1) of Samuel David Niño Cataño (left) posting together with Petro Gustavo and Gustavo Bolivar, two left-wing political candidates. The cloned newspaper published the article in the name of Gonzalo Guillén and Julian F Martinez, two reporters of La Nueva Prensa.
Image 2: Fake image of Niño Cataño and left-wing politicians Petro and Bolívar. 
Image 3: Twitter account of Niño Cataño.
In August 2020, the legit La Nueva Prensa reported that an airplane that crashed in Guatemala in late November 2019 transporting cocaine from Sinaloa’s cartel was piloted by Samuel David Niño Cataño. Niño Cataño presumably died in the crash but his remains could never be identified. The pilot and his company Llanera de Aviación S.A.S were often used by the ex-president and senator Uribe Vélez and current president Iván Duque. Hence, the August report from La Nueva Prensa connects the presumed dead president-friendly pilot Samuel Niño Cataño with drug cartels.
Forged friendship – busted by ELA
The impostor’s aim with the article was to connect the president-friendly pilot with left-wing politicians, to discredit the findings of La Nueva Prensa – his links to drug cartels.
Qurium has analyzed the pictures published by the clone news site (lanuevaprensa{.}net) and processed them using Error Level Analysis (ELA), a technique used in digital forensics to identify image forgery. The ELA identifies parts of an image that has different compression levels. In other words, it detects how a fake images has been composed. The individual parts of the fake image is later used to do “Image Searches” to find the original pictures that have been modified.
Case 1: Adding a person
The picture below shows the pilot Niño Cataño (left) with Colombia Humana senator Gustavo Petro (middle) and senator Gustavo Bolívar, head of the coalition list “Los Decentes” (part of Colombia Humana during the presidential campaign).
The ELA processing shows a sharp edge in the right sleeve of Petro’s (middle) white shirt. We can also detect a bad “edge detection” of a photo editor.
The original picture (of Petro and Bolívar) that was modified had white background. The picture of the pilot was modified using “background eraser” and “hair cropped” before insertion. However, a part of the background remained around the pilot’s shoulder.
Image 5: Original image of Petro and Bolívar. 
Image 6: Sloppy work by “background eraser”.
Case 2: Replacing a person
Another picture (image 7: left) published by the clone website, shows Gustavo Petro with the pilot Niño Cataño. This image does not need technology to detect the forgery, as multiple mistakes are done. The position of the two persons is awkward, the size of their faces differs greatly, and the resolution of the two persons differs.
The forged picture is a composition of two pictures. A simple image search on each individual image finds the original images (Image 7 middle and right).
Image 7: Petro and Cataño (forged) 
Image 8: Petro and Bolívar (original) 
Image 8: President Duque and Cataño (original)
Case 3: Replacing a person and removing information
In the third fake picture, the pilot is now posing with Feliciano Valencia, senator for the indigenous party MAIS.
Image 10: Cataño and Valencia (forged) 
Image 11: Petro and Valencia (original) 
Image 12: Cataño and ex-president Uribe (original)
The original picture comes from a MAIS campaign, where of Feliciano Valencia is posing together with Gustavo Petro.
The pilot Niño Cataño’s picture was taken from picture with senator Uribe Vélez. Cataño is wearing a t-shirt with the logo DUQUE, supporting the presidential campaign of Iván Duque.
The ELA processing shows how the “DUQUE” branding in Niño Cataño t-shirt was blurred using photo editing software.
