The Stanford Internet Observatory has been investigating new facets to the manipulation of the local media environment in Libya: Russian actors who are known to have previously created and sponsored online news media fronts and associated Facebook pages, now appear to be expanding into similar activities in broadcast media. By surreptitiously financing a well-established well-known media brand, these actors are taking a Cold War-era strategy of supporting local media outlets and updating it for the digital age.

Over the past year Russia has become increasingly involved in the conflict in Libya. Some of this involvement is kinetic: Russian mercenary soldiers employed by firms linked to Yevgeny Prigozhin, a Russian businessman with close ties to Vladimir Putin, are fighting alongside Khalifa Haftar’s self-styled Libyan National Army (LNA) forces. Modern Russian weapons have been found on battlefields. Alongside the kinetic, the relationship includes media and information operations support for political candidates, and social media influence operations: Stanford Internet Observatory research previously found that Prigozhin-linked firms had created Facebook Pages bolstering not only Haftar but Saif al-Islam Gaddafi, one of Muammar Gaddafi’s surviving sons. Prigozhin may be trying to bring Gaddafi supporters to Haftar’s camp, or simply playing multiple sides of the local power game by bolstering two likely presidential contenders. While the motivation remains a matter of state strategy, it is clear that Russian actors are exerting influence via traditional as well as social media channels.

This involvement takes the form of both direct involvement in content creation as well as financial support for local creators, which presents a challenge for evaluating authenticity in the Libyan media ecosystem: when does foreign support for local media cross the line into facilitating inauthentic behavior?

In November the Dossier Center, a London-based investigative organization, shared an appendix from an internal Prigozhin-linked group document with the Stanford Internet Observatory team. The leaked document, dated March 20, 2019, describes three media interventions in Libya:

1. entering into a financial arrangement in which a Prigozhin-linked firm would own 50% of the former state-run TV station under Muammar Gaddafi (now supportive of Saif al-Islam Gaddafi); 
2. creating a physical pro-LNA newspaper, Voice of the People 
3. consulting on Alhadath, a Haftar-aligned TV station.

In this post, we discuss the social media and online presence of these television channels and the Voice of the People print newspaper. Key findings include:

• By secretly investing in a long-standing TV channel, Prigozhin is refining his ability to blur the lines of media authenticity. 
• The TV channel (and its related social media entities) have historically been pro-Gaddafi; in the months since investment, they additionally became supportive of Haftar. This backfired, with social media users mocking the obvious shift in tone and calling out what they perceived to be the channel’s foreign backers. 
• A real political party, the Civil Democratic Party, posts PDFs of the Prigozhin-funded newspaper on its Facebook Page, with the party’s logo on the paper’s header. The newspaper is vigorously anti-GNA and pro-Haftar.

Internal document from a Prigozhin-linked group. Source: The Dossier Center.

Aljamahiria TV station and Jana News Agency

The Aljamahiria TV channel was the former Libyan state-run broadcasting organization under Gaddafi. Anti-Gaddafi rebel forces removed it from the air in 2011. It appeared again in 2014, and is now on Nilesat, an Egyptian communications satellite.

The Dossier Center document describes “the company” (the name for the Prigozhin-linked group) providing technical, financial, and advisory support for a TV station, Aljamahiria TV since January 2019. The memo goes on to say that “the channel criticizes the activities of Khalifa Haftar [LNA], Khalid Al-Mishri [head of the Tripoli-based High Council of State] and Western countries” and supports Saif al-Islam Gaddafi, and notes that “50% of the channel (in a joint venture) belongs to the Russian side” (translated).

The memo highlights the transformative effects of the Prigozhin investment, saying that the TV channel used to be:

chaotic, regularly interrupted for 2-3 months. Currently, the channel broadcasts on a regular basis and is popular with supporters of Saif al-Islam Gaddafi. The channel’s monthly audience exceeds 6 million views in the Middle East and North Africa. Moreover, the company’s employees created a unified information service for the Jamahiria TV channel and the Jana news agency. In March 2019, the company’s specialists launched 6 new regular broadcasts and resumed work [...]

The memo then shows before and after images of the studio, illustrating that the Prigozhin investment helped modernize the studio.

Heading reads: "On-air studio: Before and after working with the company"

Aljamahiria and Jana News Agency have an extensive presence on social media platforms, sometimes with substantial followings and frequent posting schedules:

Aljamahiriya TV station and Jana News Agency social media presence.

Content on social media accounts associated with this TV station indicate that it shares Muammar Gaddafi nostalgia content (ie, “Muammar Gaddafi, I wish that you would come back.”) and content supportive of Saif al-Islam Gaddafi. For several months the additional posts on Aljamahiria’s Facebook Page were typically neutral news statements -- noting that there were clashes south of Tripoli, or posts about the weather.

In December 2019, however, the tone changed. Posts began to appear  that were critical of Turkish military support to the UN-recognized Tripoli-based Government of National Accord, and more supportive of the LNA. For example, a post on January 6, 2020 said قوات الشعب المسلح تحرر مدينة سرت (The forces of the armed population free the city of Sirte). The phrase “forces of the armed population” is a phrase originating from the Gaddafi regime to describe the official Libyan armed forces. Here the channel is using the term interchangeably to describe the LNA advancement on Sirte.

Posts on al-Jamahiriya became more anti-GNA over time. The anti-GNA slant measure comes from a dictionary of 37 words and phrases like “liberation” (as in “Haftar will liberate Tripoli”) and “Turkey” (as in “report reveals the number of Syrian mercenaries arriving from Turkey to Libya”) and “Qatar”/”terrorism”/”Muslim Brotherhood” (as in “Doha, funded by `Hamas and the Muslim Brotherhood’ to spread terrorism in Libya”).

Beginning in December 2019, social media users noticed this trend; they called it “حفترة قناة الخضراء” (Hafterization of the Green Channel). On December 19 one Facebook user commented in a group that Aljamahiria had shifted from referring to “Haftar’s militias” to “the Armed Forces,” language that aligns Gaddafi-era terms with Haftar’s LNA. One Page mocked Aljamahiria’s dramatic shift in tone, suggesting satirically that even the word “prayers” needs to be renamed “Haftar’s prayers.” In one comment thread a user said “the channel is now with Haftar,” and another responded saying “no, Haftar is now with the channel.”

Authentic Gadaffi supporters took to Facebook to express their displeasure at how now Hafterized Aljamahiria was misrepresenting them. One commenter even wrote a few poetic verses to describe his anger:

Yes, he really hafterised it
from Ghat to Sebha ..
and He ruined it ..
The green channel, he hafterized it.

Yes, rats hafterize yourselves.
The zero hour always equals zero if it's according to the local time of the Karama leader's watch.

A user posted Aljamahiria content using laughing emojis after noting that Aljamahiria encouraged people to fight with Haftar.

A Facebook user commenting on Aljamahiria’s shift from referencing “Haftar’s militias” to “the Armed Forces.”

Aljamahiria then backed off the pro-LNA language; in one post they called Haftar a war criminal. But social media users noticed this shift in tone as well. In February 2020 a pro-GNA Page posted an Aljamahiria video, saying that the channel was suddenly criticizing Haftar after having encouraging the youth to fight with him. In response to an Aljamahiria video that was critical of Haftar and posted in February 2020, one user wrote: “why did u turn on the army?” (translated). Two users posted 1,500 word tomes theorizing about the shifts in Aljamahiria’s tone, with one directing remarks toward what he perceived to be Aljamahiria’s foreign backers: he accused Jamahiriya of accepting money from foreign countries and said that Jamahiriya had become a channel of “propaganda and distorted ideas.” A Twitter user commented on the new tone shift as well. 

Libya Facts, a pro-Gaddafi Page, defended the Aljamahiria Page, showing screenshots of anti-Haftar posts on Aljamahiria to allay suspicions. Libya Facts also noted that the channel is based out of Egypt and the Egyptian government carefully monitors who receives foreign funding, implying that Aljamahiria could not possibly be tied to any foreign entity. 

Aljamahiria has a professional, polished Instagram account, created in October 2019, which shares original Muammar Gaddafi nostalgia memes and pro-Saif al Islam Gaddafi memes. 

Upper left: A post from facebook.com/libyanfacts.ly attempting to prove the neutrality of Aljamahiria TV. The image caption says “Jamahiriya attacked Haftar.” Upper right: A post on the Aljamahiria Facebook Page. The text says, in part, Muammar Gaddafi, I wish that you would come back. Lower left: An ad run by the Aljamahiria Facebook Page. It reads, “The official account of the Jamahiriya (green) channel.” The channel was called The Green Channel under Muammar Gaddafi. Lower right: A meme bolstering Saif al-Islam Gaddafi on the Aljamahiria Instagram account.

The Jana News Agency, which is explicitly part of the Aljamahiria network (its logo says Aljamahiria News Agency) and is mentioned in the leaked document, has a website, jana-ly.co, that was created in January 2017. Its original Facebook Page had 5 admins in Egypt, 1 admin in the UK, and 3 admins whose location are hidden. This pattern is similar to the administrator ownership pattern of Facebook Pages involved in Libyan influence operations that we identified in previous research, where Pages typically had 5 Egyptian Page admins and 1 other admin in a European country. Interestingly, jana-ly.co has an article from November 2, 2019, reposted from Russian state media outlet Sputnik, about the Prigozhin-linked Facebook takedown of influence operations targeting Libya. It claims that Facebook removed those Pages in anger over the success of the Russia-Africa Sochi summit. In February 2020 its Page came down, and days later it respawned as facebook.com/jana2.ly with 3 admins in Egypt. 

We also found a Facebook Page called الجبهة الشعبية لتحرير ليبيا (Popular Front for the Liberation of Libya) that lists as its “media platforms” facebook.com/aljamahiriytv and facebook.com/janaly.co Like the TV channel and Jana News, the Popular Front for the Liberation of Libya Page has pro-Gaddafi content. It has also run anti-Sarraj and anti-Turkish ads. The Popular Front Page also lists facebook.com/safalbonyan, facebook.com/libya24tv, and facebook.com/libyamandela as additional “media platforms”, which similarly have pro-Gaddafi posts. All of these Pages have a majority of administrators in Egypt.  

Consistent with the trends we observe on these social platforms, New York Time reporting suggests that Haftar is welcoming support from former Gaddafi supporters.

Voice of the People Newspaper

Another entity mentioned in the Dossier Center memo is the Voice of the People newspaper. The memo notes that “since January 2019, the Company’s specialists began publishing the Voice of the People newspaper. The newspaper is distributed in the territory controlled by the LNA. The general content of the newspaper is criticism of the new draft Constitution, the policies of Al-Misri and Sarraj, support for the activities of the LNA and the image of Khalifa Haftar. The circulation of the newspaper is 300,000 copies. At the moment, 2 circulations of the newspaper have been prepared and distributed.”

The creation of a print newspaper is noteworthy. New York Times reporting suggests Russian entities created a newspaper in Madagascar in 2018 as well, saying: “Russians published their own newspaper in the local language and hired students to write fawning articles about the president to help him win another term.”

We found the two issues of the newspaper here and here -- as of February 2020, there don’t appear to be more. The newspaper is vehemently against the new draft constitution, encouraging citizens to vote “no” on it. The Constitutional Drafting Assembly voted to allow military personnel to be eligible for president only if they renounce their military positions two years before elections, a policy that pro-Haftar groups were against given that he would likely run for the position in the future. The latest (fourth) draft of the constitution also says that presidential candidates must relinquish any foreign nationalities at least one year before elections; Haftar has American citizenship. The Civil Democratic Party appears to be close to Haftar, and supports his offensive on Tripoli.  Accounts on Twitter have said that the newspaper is being distributed for free; one posted a photo of it.

Photo of the newspaper, Voice of the People. The Tweet says “Read the Voice of the People newspaper.”

The paper is branded with the logo of the Civil Democratic Party, and issues have been posted as PDFs on the Civil Democratic Party Facebook Page. The Party is made up of former members of Libya’s Transitional Council and former ambassadors. Its Facebook Page was created in September 2017, and has 3 admins in Libya. The CDP appears to have their own video recording capability, occasionally posting videos reminiscent of news broadcasts.

Cover page of the March 2019 issue of the Voice of the People newspaper.

The first issue of the newspaper, published in January 2019, included an article introducing the paper, written by the president of the party. The party leader expressed allegiances toward the LNA. The issue focused on criticizing the constitutional drafting project. Articles implied the new draft constitution was undemocratic and “succumbed to political Islam.” An opinion piece urged citizens to vote against the constitution.

A cartoon in the 2019 issue saying that the constitution project does not meet the demands of the people. The other cartoon criticized the constitution for preventing Haftar from competing in elections.

The first issue of the newspaper told Libyans not to be fooled, and to vote “no” on the draft constitution.

The second issue of the newspaper, published in March 2019, led with an article called “The Hidden Lebanese Government” (translated). The article alleged that the Government of National Accord -- the internationally-recognized Tripoli-based government -- is letting international actors like the UN and Lebanon take over the government. Another article on the cover page noted that the average Libyan is suffering, with queues at banks and corruption. The GNA should be replaced, it claimed, and the state should regain its monopoly on force and bring back the rule of law. A cartoon on the cover page shows the GNA Prime Minister bringing foreign allies a pie of Libya. Each foreign actor vies for a piece of Libya, and the Special Representative for the UN in Libya says there will be enough for everyone.

A cartoon of the UN serving a pie of Libya in the second issue of the Voice of the People newspaper.

Alhadath TV Station

The third aspect of this memo references the LNA-aligned TV channel: “In February 2019, the company’s specialists conducted an external audit of the activities of Alhadath TV channel (LNA channel), on the basis of which they prepared and presented their recommendations for the optimization of broadcasting to the [Haftar] team.” 

The Facebook Page associated with this TV channel has about 875,000 followers. It was created in 2016, and has seven Page administrators in Libya. The Page is generally pro-Haftar and often reposts statements from Haftar’s spokesman, Ahmed al Mismari. There is a Twitter account, @libyaalhadathtv, created in 2015, which has 89,100 followers. The only account that the Twitter account follows is @news9ly, which was created in July 2019 and shared LibyaAlhadathTV content. There is also a YouTube channel, created in 2016, which notes that the station (like Aljamahiria) is on Nilesat. Its associated website is libyaalhadath.net. The current nature of Prigozhin’s involvement in this TV channel is unclear, though we note that Facebook lists the Alhadath Page as a “Related Page” to the new Jana News Agency Page.

Pages discussed in this post, with a vertical line noting the start of January 2019. The internal document suggests some Prigozhin activities in Libya began in January.

Our prior research showed that Russian actors created Facebook Pages supportive of Saif Gaddafi and Haftar. This leaked document suggests that Russian actors are supporting these two figures in Libya’s traditional print and television media space as well. In our earlier research, we found that Russian actors had franchised out management of their Facebook Pages to content creators in Egypt. This made it harder for Libyans to detect the involvement of Russian actors. Similarly, here we see foreign actors inserting themselves into the legitimate Libyan media environment by way of financial support. While Libyans noticed the change in tone on the Pages, attributing that involvement to specific actors is a significant challenge. Going forward, the combination of franchising and virtually-undetectable financial support will make gauging the independence and authenticity of media outlets online and offline even more difficult for disinformation researchers. These tactics will also create difficult decisions for platforms about whether the behavior violates their terms of service. 

Russia’s global strategy for reasserting itself as a geopolitical superpower has led to an increased presence in Africa, where it has broadened efforts to shape the continent’s politics and pursue new economic opportunities to allay the effects of sanctions. While the presence of Russian military instructors and paramilitary groups in Libya and the Central African Republic is well documented, there is emerging evidence that Russian-linked companies are now active in the information space as well. Yevgeny Prigozhin, the oligarch perhaps best known for running the Internet Research Agency, is central to this expansion.

In this post we identify a Facebook operation attributed to entities tied to Prigozhin — including, it appears, the Wagner Group (Частная военная компания Вагнера), a Russian organization that has served as a private military contractor in several African countries. The first allusion to a social media influence operation tied to Prigozhin stemmed from Daily Beast reporting and a document shared with us by the Dossier Center that suggested the existence of a cluster of Facebook Pages tied to the Wagner Group. We identified an initial cluster of Pages which targeted Libya, and shared the find with the Facebook Threat Intel team. Facebook subsequently provided us with data on two related networks that they had been investigating previously. These networks have been targeting the Central African Republic, the Democratic Republic of the Congo, Madagascar, Mozambique, and Sudan, and included “news” Pages and websites, and Pages purporting to belong to political parties as well as individual politicians. The part of the operation we analyzed included seven Instagram accounts and 73 Facebook Pages. In total 1.72 million accounts liked the Facebook Pages, though we note that some of these likes are possibly from the same account across multiple Pages. The Page managers were quite active; in October 2019 alone there were 8,900 posts. 

 

Wagner Group document shared by the Dossier Center. The document included an example post from a Page called ليبيا القذافي (Libya Gaddafi). The post was a photo of former president Muammar Gaddafi, overlaid on an outline of Libya. The document described the post as a “Patriotic post about the best time for the Motherland.” (High Resolution)

From our analysis of the social media activity, there are several key takeaways:

• The operation, conducted by Russia-linked organizations likely operating at least in part at the behest of a state actor, appears to have further relied on subcontractors who are native speakers and/or local to the region. This variety of nested obfuscation increases hurdles to attribution of disinformation campaigns. 

• In addition to well-known social media platforms such as Twitter and Facebook, the actors leveraged public WhatsApp and Telegram groups. Whether more private chat channels were also used is an area for further research. 

• The operation used social media engagement tactics designed to develop a close relationship with the audience, including Facebook Live videos, Google Forms for feedback, and a contest.

• The operation shared tactical similarities to Internet Research Agency activities; the operatives created several associated news sites (in one case staffed by reporters who appear to have spent time in Russia) as well as Facebook Pages that produced social-first content (memes, live videos). The attribution of such activity to non-IRA entities that nonetheless share an affiliation with Prigozhin leads to a significant unresolved question of what relationship, if any, exists between the IRA, Wagner, and Prigozhin’s other companies, and to what extent Russia is distributing its active-measures capabilities across a myriad of organizations to hinder detection and attribution.

The activity and strategies varied by country:

• Libya: Russian actors are supporting two potential future presidential candidates: the rebel General Khalifa Haftar and Muammar Gaddafi’s son, Saif al-Islam Gaddafi. The Facebook operation began in December 2018, and the Pages were run by administrators in Egypt. Prior reporting has indicated that the Wagner Group has at least 100 mercenaries fighting with Haftar’s militias.

• Sudan: Facebook activity began in mid-2018, and has persisted since the April coup against Omar al-Bashir, transition to the Transitional Military Council, and transition to the Sovereign Council of Sudan. Content has been slightly supportive of whatever government is in power, and occasionally critical of protesters. Several of the Pages relate to two news websites, khartoumstar.com and sudandaily.org, the latter of which often re-posted Sputnik articles. There were additionally Facebook Pages purporting to be the official Pages of several political parties, along with “news” Pages for the Transitional Military Council and the Sovereign Council of Sudan. The former had the url facebook.com/transitionalmilitarycouncil, and at first glance appeared to be its official Page. Prigozhin-linked companies are known to have mining agreements in Sudan and have trained local military forces.

A Sudan Daily article, reposted from Sputnik, saying that Russian mercenaries in Sudan have no connection to the Russian government. (Link to full image) 

• Central African Republic: A network of Facebook Pages was created to publicize and praise the wide range of activities undertaken by the Russian government in the CAR, from military support to cultural events. These Pages, most of which had administrators in Madagascar, seem to have been intended to appear organic and give CAR audiences the impression of widespread domestic support for the administration of President Touadéra and its Russian partners.

• Madagascar: Russian actors created several Pages in 2018, but only began posting in February 2019, just after the new president was inaugurated. The Pages bolstered the government. One Page was created for a specific parliamentary candidate. 

• Mozambique: The Facebook operation began in September 2019, a few weeks before the country’s presidential and parliamentary elections. The Pages posted content to support the incumbent president, and damage the reputation of the opposition – in at least one instance, with a fake news story. 

A post from Onda da Frelimo (Wave of Frelimo) describing the results of a poll purportedly conducted by the International Anticrisis Center, a Russian organization. The publication of such polls is illegal in Mozambique. Frelimo is the ruling party in Mozambique. (High resolution)

• Democratic Republic of the Congo: Three Facebook Pages, created in 2019 after a contentious election, published content and memes mocking and criticizing key Congolese political figures, including the president. These Pages were not clearly aligned with the Russian government’s public strategy. 

The potential connection between the Libya operation and the Wagner Group is based on the leaked document obtained from the Dossier Center, which we cannot independently verify. We attribute these collective operations to actors tied to Yevgeny Prigozhin. Facebook’s attribution supports our conclusion. This investigation demonstrates a fundamental challenge of attributing information operations: disentangling activity by domestic interested parties, foreign actors working on behalf of domestic parties and foreign actors working in support of their own geopolitical or commercial interests. Our initial analysis of this content suggests a complex mix of motivations and our understanding of the African political disinformation ecosystem continues to evolve. Our full analysis of the materials, including images and figures, is in the linked whitepaper.

 

This is the second of a series of pieces we intend to publish on societies and elections at risk from online disinformation. This election monitoring project is somewhat unique: the elections in Libya may not actually happen. We choose to focus on Libya as regional actors are largely unconstrained in their ability to meddle in the country; it is an important test case to see how far malign influence operations can extend.

Libya’s UN-backed Government of National Accord (GNA) has proposed scheduling presidential elections for the end of 2019, though it is unlikely this will happen. Over the coming months the Stanford Internet Observatory will track disinformation in Libya, observing activities of myriad regional actors with both a stake in how Libyan politics unfold and a track record of running overseas social media influence operations.

Political context

Libya has seen continuing violence for several years, with rebel General Khalifa Haftar, head of the Libyan National Army (LNA) forces, controlling large swaths of the country and aiming to take control of Tripoli.

Libya became independent in 1952. Muammar Gaddafi took power in 1969 and ruled until 2011. His rule was characterized by oppression, patronage, and violence, and Gaddafi consolidated control with networks of informants and a climate of fear. In the 1990s international sanctions against the regime (for supporting terrorism) weakened Gaddafi’s patronage machine. In 2011, at the start of the Arab Spring, the Libyan people began to protest the Gaddafi regime. The government was brutal in its response, which caused further and more intense protests. With support from Qatar, the UAE, and France, rebel groups began seizing territory. In the fall of 2011, with NATO support and a US-backed no-fly zone, rebels killed Gaddafi and seized control of the government. A National Transitional Council, which included former government officials who had defected in early 2011, academics, human rights activists, and tribal leaders, took power. The Council transitioned power to an elected General National Congress in 2012.

The GNC lost legitimacy in the years that followed, primarily for failing to provide security to citizens. In response, new parliamentary elections were held in 2014 for the House of Representatives, but the results were contested. This institution’s lack of legitimacy contributed to the outbreak of militia violence later in 2014, and the Libyan government split between the Tobruk-based House of Representatives and executive leadership in Tripoli. Strongman Haftar and his House of Representatives-aligned LNA forces built support in the East. The GNA’s Prime Minister Fayez al-Sarraj maintained control in Tripoli. The most salient points of conflict between the two sides are over oil revenue and control of the Central Bank. The Central Bank is split in two, with the GNA controlling the Tripoli branch and oil revenues, and the LNA controlling an eastern branch. If the GNA were to cut off the LNA from banks, this could precipitate a national financial crisis.

There was an attempt at a peace deal in 2015; the Libyan Political Agreement, as it was known, created a Government of National Accord (GNA) but this deal never secured buy-in from the House of Representatives. In April 2019, after a series of successes in other parts of the country, Haftar began an offensive on Tripoli, bombing a migrant detention center in the process. This caused an outcry from the international community. He took some territory, but it was subsequently reclaimed by the GNA In June 2019.  

The international response to the conflict has been weak because of U.S. indifference, and disagreement among European countries about who to support. Though the US officially supports the GNA, President Trump spoke by phone with Haftar in April 2019 and praised his desire to fight terrorism.

US ambivalence has emboldened regional governments to interfere. The conflict has evolved into a proxy war, with the UAE, Saudi Arabia, and Egypt on the side of Haftar’s forces, challenging Qatar and Turkey’s support for the GNA; the GNA has incorporated elements of the Muslim Brotherhood. Both the GNA and LNA conduct drone strikes, using weapons supplied by Turkey and the UAE respectively, despite an arms embargo that has been in place since 2011.

As of October 2019 the war is at a stalemate, with neither the GNA nor the LNA open to negotiations, though Haftar recently signalled a willingness to open a dialogue. There are ongoing conflicts on the outskirts of Tripoli and in Misrata, Jufra, and Murzuq. Observers suggest that the soonest the elections could take place is early 2020, and only then if the UN can bring all factions to the negotiating table.

Potential disinformation threats

The ongoing conflict has made its way to online spaces, where all sides are spreading disinformation. This information battle is playing out primarily on Facebook and Twitter, and includes repurposing photos and videos to create false stories. For example, the Libyan affiliate of Al-Aan, an Arabic news network based in the UAE (the UAE is pro-Haftar) shared 2011 video footage of military movements, claiming they were recent. When the LNA captured a Portuguese mercenary supporting the GNA, an inauthentic Facebook account claiming to be a popular TV station pushed the untrue narrative that the mercenary was only conducting migrant smuggling surveillance for Europe. This false story went viral in Libya, and was amplified by a Saudi news network, and then The Daily Mail. 

There is compelling evidence of foreign-initiated pro-Haftar social media campaigns. In the weeks preceding Haftar’s effort to take Tripoli, there was a coordinated pro-Haftar Twitter campaign, complete with hashtags such as #SecuringTheCapital (in English and Arabic) that were amplified by bots, some of which participated in pro-UAE and anti-Qatar online campaigns in the past. On the day of the attack on Tripoli, another pro-Haftar campaign emerged with the Arabic hashtag “We support the Arab Libyan army” (#ندعم_الجيش_العربي_الليبي).  The top users of the hashtag were Twitter accounts in the UAE, Saudi Arabia, and Egypt. One account that used this hashtag had organized online campaigns for the Egyptian government in the past. Egyptian and UAE media coverage amplified the hashtag.  

There is speculation that Russia has acted to support the LNA in both the military and digital realms. However, given the uncertainty over which side will consolidate control, Russia has ongoing dialogue with the GNA, and is also considering supporting Saif Al-Islam Gaddafi, Muammar Gaddafi’s son and a possible presidential candidate. In 2018 Haftar traveled to Moscow and met with Yevgeny Prigozhin, who heads both Wagner Group, a private military company with ties to the Kremlin, as well as the Internet Research Agency, the entity involved in numerous global influence operations. Some reports suggest Wagner Group has provided mercenaries and arms to the LNA. In May 2019 Russian citizens Maxim Shugaley, Samer Khasan, and Ali Sueyfan were arrested in Tripoli, accused of attempting to meddle in the upcoming elections. They had been in Libya with Alexander Prokofiev (who escaped arrest), meeting with Saif Al-Islam Gaddafi. All three worked for the Foundation for the Protection of National Values, a Russian NGO headed by Aleksandr Malkevich, who is on the US Treasury sanctions list for spreading divisive and untrue stories on social media in the run up to the 2016 US elections. 

Findings from newly-released Twitter data

Further evidence of UAE and Egyptian ties to Libya comes from files Twitter recently released of removed accounts. Two files – one that Twitter says contains accounts originating in the UAE, and the other with accounts based in the UAE and Egypt that were managed by a company called DotDev – each contain Tweets that are supportive of Haftar, critical of the Muslim Brotherhood, and claim Qatar (and to a lesser extent Turkey) are supporting terrorism in Libya. The tweets were primarily in Arabic and English.

The first file, with accounts based in the UAE, contains 1,325,530 tweets. 2,503 of these (0.2%) contain the word Libya in English or Arabic, and 711 of the 4,248 accounts (17%) tweeted at least once about Libya. 96% of user accounts were created between 2018 and 2019, and the average account had 215 followers. The accounts claimed to be based primarily in the Middle East and North Africa. 

 
A histogram of tweets from the UAE (black) and DotDev (green) files that contain the word Libya in English or Arabic. 

The references to Libya begin in 2012, including one that praised the (translated) “secular liberal coalition” for gaining more votes than a party affiliated with the Muslim Brotherhood in Libya’s parliamentary elections. A small flurry of pro-Haftar Tweets appeared on February 14 and May 20, 2014, days in the vicinity of two Haftar coup attempts. A few of these used the hashtag #الجيش_الليبي_يحارب_الإرهاب (the Libyan Army fights terrorism). In the years that followed, the accounts mercilessly attacked Qatar, claiming Qatar supported terrorism in Libya. “Who would want to loot the capabilities of the Libyan state, overthrow institutions and stealing oil expect [sic] Qatar?” one Tweet said. Tweets also praised the UAE; the hashtag #Libya_UAE appeared 43 times in the file, accompanying statements about UAE’s contributions to security and humanitarian relief in the country. Many tweets retweeted content from @alain_4u, the handle associated with Al-ain.com, a UAE-based media outlet.

A meme an account shared that emphasized the importance of fighting terrorism in (among elsewhere) Libya, while claiming that Qatar is not committed to fighting terrorism.

Days after Haftar attempted to seize Tripoli, accounts retweeted a news headline saying the LNA was trying to liberate Tripoli, using the hashtag DFRLab researched earlier this year: “We support the Arab Libyan army” in Arabic.

Among the accounts Tweeting about Libya, we identified two likely fake online personas. Sara Bitar (@SaraBiitar) and Bilal Hamdan (@BilalHamda). They both claimed to be based in Lebanon and had about 5,500 followers. The accounts were created one day apart on September 2017, and had the same profile photo: a Lebanese woman at a protest, which appears to have been stolen from a 2012 news article. Sara claimed to be a “Political activist with a master degree in political and economics sciences.” We were unable to find any other online presence for either Sara or Bilal. The personas shared the standard narratives about Qatar and Turkey working against the interests of the Libyan people, and retweeted @qatarileaks, an account removed in the next file we discuss.

The second file – the one attributed to DotDev, contained 214,898 tweets between 2014 and 2019. 5,671 (3%) contained the word Libya, and 176 of the 271 accounts tweeted at least once about Libya.  

"The Libyan Army launches the second phase of Operation Flood of Dignity" reads this image tweeted by @binlibyaa, and retweeted by many accounts in the data in 2019.

These tweets had a near-identical tenor to the previous file, extolling the virtues of the UAE and asserting that Qatar is tearing Libya apart. One tweet in September 2017 said: “In order to avoid competing with #Libyan oil, #Qatar conspired to kill #Gaddafi and steal the #oil #QatariLeaks #boycott Qatar”. (We discuss Qatari Leaks below.) In February 2019 tweets alluded to possible Haftar movements: “Infighting Plagues #Qatar’s Arms [sic] in #Libya  #Qatar’s militias in Libya are about to be eradicated, victories of Haftar’s national army put them in a corner #Qatarileaks”. In March 2019, one tweet claimed Qatar’s militias were nearing “total collapse.” Tweets the day after Haftar’s Tripoli offensive said things like: “#Qatar and #Turkey United against Tripoli freedom The #Libyan National Army launched a final blow to terrorism in Tripoli, Seeks to purge the country from the abomination of the Muslim Brotherhood. #Qatarileaks”. A few days later a tweet stated that “Liberating #Tripoli provokes union of terrorism.”

Accounts in this file frequently retweeted @LyOffSpokesman. The account, now suspended, appears to have been a fake account for the LNA spokesman. A different account for the spokesman had denounced it as fake, showing a screenshot with @LyOffSpokesman claiming to be the spokesman's "official account." @LyOffSpokesman was likely a handle managed by DotDev. An account in the data appears with the same April 2010 account creation date (one of the earliest created accounts in the file), and a profile descirption that says it is the (translated) "news account" – perhaps a phrase added in after being called out on Twitter – "for the lieutenant Ahmad Al Mismari, the official spokesperson for the general leadership of the Libyan armed forces."

This image was tweeted by several users, including on May 23, 2019, just weeks after Haftar’s Tripoli offensive.

One of the suspended accounts claims to have been “The Official page of General Khalifa Haftar.” It was created in 2015, and had 2,896 followers. Though the handle is anonymized, engagement with the now-suspended @HaftarOfficial appeared only in May 2019, the only month that the account tweeted in the data, suggesting that may have been the suspended account. The account tweeted official-sounding statements about, for example, being well received in a meeting with the Egyptian President. Tweets from this account received on average 305 likes and 139 retweets. One tweet received 1,323 likes.

One account removed in this file was @qatarileaks, with 70,168 followers. Qatarileaks claims to be a platform to analyze information exposing Qatari support for terrorism; in practice it is simply an anti-Qatar propaganda machine. This account was among the most commonly re-tweeted accounts in both files. In the context of Libya alone, the #qatarileaks hashtag was used 352 times in the DotDev file. With tweets like “Qatar's foolish policies have contributed to the downfall of Libya, but that was the plan all along #Qatarileaks”, (from the first file) this handle linked to qatarileaks.com, a site with almost comically negative stories about Qatar. One story headlined “Death haunts passengers on Qatar Airways” contains no information about any death associated with Qatar Airways. The administrators for the affiliated Facebook Page are located in Egypt, and its Instagram account posts memes (including about Libya) that were shared frequently in the Twitter file. 

A screenshot of Qatarileaks.com/en, as seen on September 24, 2019. 

 

The about page of Qatarileaks.com.

@binlibyaa is likely another account Twitter removed in the DotDev takedown. While the screen name is hashed, the profile url linked to bnlibya.com. This account tweeted from March to May 2019, and replies to @binlibyaa covered the same time period. @binlibyaa frequently re-tweeted @LyOffSpokesman and @HaftarOfficial, along with links to bnlibya.com articles. That url was registered on April 6, 2019, two days after the start of Haftar’s Libya offensive. The account’s associated Facebook and Instagram accounts are down, and another Twitter account with a similar handle, @bnlibyaa, is suspended.

Alliances and interested parties

Non-aligned interfering party:

• Italy, with a populist right-wing government, is taking a hard line on migrants from Libya. Italy has economic interests in Tripoli and Libya’s south, and a rivalry with anti-populist French President Emmanuel Macron. France is fighting terrorism and smuggling in southern Libya.

Media environment

After the fall of Gaddafi, print, television, radio, and online media outlets flourished as a result of new press freedoms. Many of these outlets are based abroad, with information about their financial backers hard to discern. Many also have strong political slants. Militias frequently compel reporters to publish stories that push their narratives. The BBC has an overview of the slants of the main newspapers, TV stations, radio stations, and news agencies/sites. 

Facebook is the most popular social media platform for both civilians and militias in Libya.

Competing factions use Facebook, YouTube, and Twitter, the most popular social media platforms, to promote their agendas. Estimates for Facebook usage range from 53% to 60% to 65% of the population. In addition, 29% use YouTube and 8% use Twitter. Instagram usage estimates range from less than 1% to 14%. Overall, 58% of the population uses the open internet.

Narrative context

Organized social media campaigns push the following narratives:

1. Claim the opposing side committed war crimes (all)
2. Suggest that Haftar is a force for stability and security for Libya and will fight terrorism (pro-Haftar)
3. Highlight the role of the other side’s foreign backers (all)
4. Emphasize successes in securing or taking territory (all)
5. The UN is failing in its goals for Libya (pro-Haftar)

Hashtags that have likely been part of coordinated inauthentic social media campaigns:

• #SecuringTheCapital / #تأمين العاصمة (pro-Haftar, context here)
• #PeopleOfLibyaWantTheLibyanArmyToSecureTheCapital (pro-Haftar, context here)
• #ندعم_الجيش_العربي_الليبي (We support the Arab Libyan army) (pro-Haftar, context here)
• #WeAreReady (pro-Haftar)

Key takeaways and risks

Libya is a complex case: it’s a country at war, with two competing governments, and seemingly extensive foreign engagement in both the conflict theatre and the media environment. Domestic groups involved in the conflict intentionally share false and misleading content on social media platforms. Evidence suggests foreign disinformation efforts have supported the LNA as well. These efforts will likely increase when elections are scheduled, as domestic groups and foreign backers jockey for power in the new government. The Internet Observatory intends to follow campaigning around Libya’s presidential and parliamentary elections as they develop.

Challenges to studying disinformation in Libya

• Minimal impartial investigative reporting in Libya makes assessing the validity of narratives difficult.  
• Discerning media outlet bias is not always straightforward, further complicating the verification process.

For further reading 

Disinformation assessments

• Removing Coordinated Inauthentic Behavior in UAE, Egypt and Saudi Arabia, Facebook
• Walking on Hot Coals: How Disinformation Is Fueling the Fight in Libya, DFR Lab
• A Twitter Hashtag Campaign in Libya: How Jingoism Went Viral, DFR Lab
• Libyan Hashtag Campaign Has Broader Designs: Trolling Qatar, DFR Lab

News coverage

• Russia’s Wagner Mercenaries Have Moved Into Libya. Good Luck With That, Daily Beast
• A Facebook War: Libyans Battle on the Streets and on Screens, New York Times

Research

• Stopping the War for Tripoli, International Crisis Group 
• At a Glance: Libya’s Transformation 2011-2018: Power, Legitimacy, and the Economy, Democracy Reporting
• Libya Social Media Monitoring, Democracy Reporting

 Regional voices

• The Libyan Center for Freedom of the Press
• Khadeja Ramali, Social data analyst and Middle East and North Africa consultant, @k_ramali

 

We thank Katie Jonsson, Khadeja Ramali, and Lydia Sizer for helpful feedback on this document.