Blame it on Iran, Qatar, and Turkey: An analysis of a Twitter and Facebook operation linked to Egypt, the UAE, and Saudi Arabia
In December 2019, the Stanford Internet Observatory alerted Twitter to anoma- lous behavior in the hashtag السراج خائن ليبيا (“Sarraj the traitor of Libya”); Fayez al-Sarraj is Libya’s Prime Minister. The distribution pattern of the hashtag looked suspicious, and the images that appeared with the hashtag looked similar to those that Twitter removed in September 2019 as part of a takedown of a prior state-backed influence operation originating in the UAE and Egypt. Twitter confirmed that many accounts creating content with the “Sarraj the traitor of Libya” hashtag were related to that prior network, and took them down. Following extensive additional investigation based on the tip, Twitter shared with us a network of 36,523,977 tweets from 5,350 accounts that have been taken down. Facebook then shared with us 55 Pages linked to this Twitter network; we analyzed these Pages before Facebook removed them. We title this report “Blame it on Iran, Qatar, and Turkey”, given the prominent theme of lumping blame on these three countries for everything from terrorism throughout the Arab world to the disappearance of Malaysia Air Flight 370 to the spread of COVID-19.
Twitter reports that the network has links both to the digital marketing firm that was previously known as DotDev, which operated (or continues to, in other incarnations) out of Egypt and the UAE, and Smaat, a Saudi Arabian digital marketing firm. In December 2019 Twitter announced its largest ever state- tied takedown of a Saudi operation tied to Smaat. This new network revealed a link between the September 2019 DotDev takedown and the December 2019 Smaat takedown.