Analyzing a Twitter Takedown Originating in Saudi Arabia
On December 20, 2019 Twitter announced the removal of 88,000 accounts managed by Smaat, a digital marketing company based in Saudi Arabia, and attributed thousands of these accounts to involvement in “a significant state-backed information operation”. On December 17 Twitter shared with the Stanford Internet Observatory 32,054,257 tweets from 5,929 randomly sampled accounts. In this report we provide a first analysis of the data.
Smaat is notable in part because it was co-founded by Ahmed Almutairi (also known as Ahmed Aljbreen), a Saudi agent of the royal family who recruited two Twitter employees to spy on the accounts of critics of the Saudi government. Almutairi is now wanted by the FBI.
Behavioral observations:
The accounts were high-volume; the average account had 5,406 tweets and was created in 2016, and several accounts tweeted tens of thousands of times. Many bordered on spam.
These accounts appeared to attempt to obscure their commercial and political activity by tweeting an abundance of largely-automated religious, sports, and poetry content. Approximately 7% of tweets came from client apps that appeared designed to automatically tweet religious messages.
One amplification strategy we observed in our dataset was the use of, “قروبات دعم”, which translates to Support Groups, for boosting visibility for brands and gaining followers. Other terms for this activity - which involves everyone in the group using the same hashtag, following members in the hashtag, or retweeting the hashtag - are a “retweet ring”, follow-back ring, or follow train. Smaat’s participation in these support groups appeared to have the goal of expanding the visibility of their accounts.
The user accounts listed additional social profiles on SnapChat, WhatsApp, and some regionally-popular social sites such as Telegraph, Sarahah, and CuriousCat.
From du3a.org. Translation: "Doaa application is an application that specializes in spreading supplications to your Twitter account and provides a service for all subscribers who have Twitter accounts where you can subscribe through your Twitter account. This application provides everyone who subscribes to the automatic Twitter service in his account, as Twitter is done automatically every hour."
Content observations:
Much of the content was commercial in nature; this is expected given Smaat’s business objectives. According to their website, their clients included Dunkin Donuts, Coca Cola, LG, Bentley, Toyota, The Ritz Carlton, and Fanta. Tweets about Dunkin Donuts, for example, defended the brand against a scandal where they had used a four-finger hand gesture to communicate how cheap their coffee was - a hand gesture which has been used by the Muslim Brotherhood. The tweets were designed to look like the expressions of real people, as opposed to ads. Social media marketing tactics are frequently misused for influence operations and this behavior looks like it was trying to mimic grassroots enthusiasm (sometimes called “astroturfing”).
A large quantity of the content was political. The political narratives the accounts pushed were consistent with the objectives of the Kingdom of Saudi Arabia, such as tweets critical of the governments of Qatar, Iran, and Turkey.
Another set of of political tweets of note, also aligned with KSA goals, attacked Jamal Khashoggi, the acclaimed Saudi journalist who was killed in the Saudi Consulate in Istanbul in 2018. After his death there were thousands of tweets denying any involvement by the Crown Prince Mohammad bin Salman.
We observed many tweets critical of Qatar, including tweets from accounts claiming to be Qatari citizens speaking out about abuses against them by the Qatari government. There were 78 hashtags about Qatar, including #cutting_relations_with_Qatar and #Qatar_hosts_homosexuality.
Top hashtags used in the takedown about Jamal Khashoggi.
We note that there are likely other political narratives in the 32 million tweets that merit additional study.