Analyses of a Muslim Brotherhood-Linked Information Operation and a Facebook Network that Originated in Iran and Afghanistan

Download Muslim-brotherhood report DOWNLOAD IRAN / AFGHANISTAN REPORT

On November 5, 2020 Facebook announced the takedown of two networks: 

• 25 Pages, 31 profiles, and 2 Instagram accounts affiliated with the Muslim Brotherhood. According to Facebook, the operation originated in Egypt, Turkey, and Morocco. The network targeted audiences both in Egypt directly and across the Middle East and North Africa.

• 11 Pages, 6 Groups, 33 profiles, and 47 Instagram accounts that originated in Afghanistan and Iran and targeted Farsi/Dari speakers in Afghanistan.

Facebook suspended these networks not due to the content of their posts, but for coordinated inauthentic behavior: the Facebook Pages and Groups were managed by fake accounts. A summary of the two networks is below, and full reports are linked at the top of this post. Facebook's announcement is here.

Muslim Brotherhood-Linked Takedown

Many social media disinformation campaigns—and associated takedowns—have been linked to Saudi Arabia, the UAE, and Egypt. But we believe this is the first takedown linked to opposing pro-Muslim Brotherhood actors. Interestingly, this network appears markedly similar to networks from anti-Muslim Brotherhood disinformation campaigns on Facebook. Both sides create professional branding for Pages and share polished, original videos. We conjecture that like anti-Muslim Brotherhood operations, this network may be linked to a digital marketing firm in Egypt. These firms have a particular signature.   

Key takeaways:

• This was a complex cross-platform operation with a substantial audience. The Facebook Pages the Stanford Internet Observatory analyzed had nearly 1.5 million followers. The operation was also linked to many Twitter accounts, YouTube channels, and Telegram channels, many of which had large followings. 
• The network created and shared hundreds of original videos and dozens of original songs. 
• While most of the profiles linked to this operation were stub accounts, one of the profiles ran a social media advertising agency in Egypt.
• Central messages included:
  • Praise for the Muslim Brotherhood-supporting governments of Turkey and Qatar.
  • Criticism of Saudia Arabian, Egyptian, and UAE governments. 
  • Accusations that the Egyptian government had imprisoned and killed Muslim Brotherhood supporters, and that Muslim Brotherhood supporters were being detained across countries
  • The Facebook Page names were direct and unsubtle. Examples include Tunisia Against the UAE, Hearts with Qatar, and YemenAgainstKSAUEA [sic].

Takedown of Accounts Originating in Afghanistan and Iran

This operation produced content oriented towards women, including promoting women's rights. It also promoted the narrative that Iran is a good ally for Afghanistan, highlighted the brutality of the Taliban, and criticized Pakistani and American intervention in Afghanistan. 

Key takeaways:

• The network aimed to appeal to women. Fifty-three percent of the Instagram accounts had profile photos of women (compared to 11% with photos of men), and the network shared stories about the educational success of women. It is possible the intent was to undermine the peace negotiations between the Afghan government and the Taliban; the Taliban is known for restricting women’s rights.  

• The network shared messaging that criticized Pakistan, the Taliban, and the U.S. Content about the U.S. criticized U.S. President Donald Trump in general, and specifically claimed that Trump was colluding with the Taliban. The network praised the role Iran could play in Afghan peace negotiations.

• Posts from accounts purporting to be in Afghanistan used the term Farsi to describe its language, instead of Dari, often explicitly saying they were proud to use the term Farsi. The two languages are very similar; Iran uses the term Farsi and Afghanistan uses the term Dari. 

• The Facebook profiles and Instagram accounts were as actively involved in pushing particular narratives as the Pages and Groups, and in many cases had larger followers. 

• We identified five Telegram channels linked to this Facebook/Instagram operation.