COVID-19 has directly or indirectly affected every country, providing an opportunity for comparative analysis of the ways governments use the pandemic to pursue political objectives. SIO has been conducting case studies investigating how various state media apparatuses are responding to the crisis, and the political dimensions of coronavirus misinformation around the world. Here we focus on the Kingdom of Saudi Arabia, investigating how its state media (and media formally or informally linked to the ruling royal family) have discussed the pandemic. Saudi Arabia is an important case, as its state media has many country-specific outlets, giving it wide reach with targeted focus. The Facebook Pages for these media outlets have a combined 75 million Page Likes (akin to Followers), and regionalized Pages for countries such as Tunisia, Sudan, Iran and Iraq. We investigate how the Pages discuss pandemic spread and response in other countries, whether they customize messages via their country-specific outlets, and whether they received an engagement boost from the pandemic.

Key takeaways:

• State media posts leveraged the pandemic as an opportunity to critique rival governments in Qatar, Iran and Turkey. Posts that discussed COVID-19 within Saudi Arabia focused on people recovering from the disease. Previous SIO work found that Chinese state media similarly focused on recoveries when discussing the pandemic domestically. 

• Al Arabiya and Al-Hadath’s country-specific Pages were generally neutral, and not slanted to align with the geopolitical objectives of Saudi Arabia.

• A handful of Saudi state media Facebook Pages — particularly Al Arabiya and Al-Hadath — saw substantially increased Page engagement after the pandemic began. 

Table 1: Page Likes (somewhat akin to Page Followers), total interactions and average posts per day for many of the large Saudi media Facebook Pages linked to the government, January 1, 2020 to May 31, 2020. Data: CrowdTangle

How does Saudi State Media Discuss the Pandemic in Different Countries?

We first looked at whether Saudi state media discussed COVID-19 differently across particular countries. To do this, we downloaded all posts from 14 of the main state media Facebook Pages that included the words “coronavirus” and “covid,” in English and Arabic. In total we looked at 13,694 posts. We then translated all posts to English, coded each post based on whether they mentioned one of 10 countries, and looked at words with the highest tf-idf score. The tf-idf statistic measures how important a word is to a particular set of texts. It increases as a word is repeatedly used in a text, but decreases as the word is used in other texts.

Figure 1: Words with the highest tf-idf score linked to particular countries. Data: CrowdTangle

Here are our takeaways:

• Qatar: In recent years Saudi Arabia and Qatar have had acrimonious relations. Several interesting words were unique to posts about Qatar. “Migrant,” for example, was used to criticize Qatar’s treatment of migrants — a recurring theme going back years. One post, for example, said “Defiant Qatar continues to expose migrant workers to coronavirus.” The words “exposing,” “labor,” “construction” and “nongovernmental” were similarly used to criticize treatment of migrant workers.

• US/Europe/Russia: Digging into high tf-idf words referencing the U.S., Europe and Russia, the posts appeared relatively neutral and objective.

• Iran: As with much of Saudi coverage of Iran, posts discussed Iran critically. References to Supreme Leader Ayatollah Ali Khamenei said he pushed COVID-19 conspiracies, and pointed to corruption in pandemic-related procurement. Example headlines included “Hit by coronavirus and sanctions, Iran’s oil exports fall to record low” and “Iran claims to be curbing outbreak despite 2,300 new virus cases.”

• Saudi Arabia: References to Saudi Arabia focused on COVID-19 recoveries. This finding parallels those about the way Chinese state media discussed the pandemic within China. There were dozens of posts about the number of recoveries, such as, “Saudi Arabia: COVID-19 daily recoveries exceed number of cases” and “Saudi Arabia has one of the lowest coronavirus death rates in the world and also one of the lowest total number of critical cases among COVID-19 patients.” Other posts highlighted the country’s testing abilities; emblematic headlines include  “Saudi Arabia’s Health Ministry said that it has conducted more than a million coronavirus tests in the Kingdom so far.” Additional posts highlighted ways the government was supporting small businesses during the pandemic, and noted the government’s contributions to international efforts to develop a vaccine.

Figure 2: Posts about COVID-19 in Saudi Arabia versus Iran

• Yemen: Saudi Arabia has been fighting Houthi rebels in Yemen since 2015. Posts about Yemen often criticized the Houthis, stating that Houthi militants will shoot and kill anyone diagnosed with coronavirus to stop its spread, and that Houthis were exploiting the pandemic to impose levies on Yemen’s healthcare sector. One post said that the Houthis were looting medical supplies sent to Yemen to fight the disease. 

• Israel: Posts about Israel often critiqued Israeli treatment of Palestinian prisoners, in light of the risk of COVID-19 spreading in prisons. 

• Turkey: Saudi Arabia and Turkey are occasional geopolitical rivals, in part over Turkey’s support for regional Muslim Brotherhood-linked actors. Posts about Turkey that referenced Erdoğan were quite negative, saying that Turkey’s coronavirus deaths could have been minimized if Erdoğan had focused on mitigation measures as opposed to political objectives. There were also critiques of the strength of democratic institutions in Turkey.

Al Arabiya and Al-Hadath

Both Al Arabiya and Al-Hadath have, in addition to their primary Facebook Pages, a handful of country-specific Pages. In this section we look at how Saudi state media discussed coronavirus when targeting people in these countries. There were 9,162 coronavirus-related posts for the Al Arabiya dataset, and 12,730 posts for the Al-Hadath dataset. As a starting point, we pulled out the top word pairs, or bigrams, for each country-specific Page.

Al Arabiya

Figure 3: Top bigrams for country-specific Al Arabiya Pages. Alarabiya.naf is a Page for North Africa. Data: CrowdTangle

The figure above suggests that while there was certainly customized content by Page, the content does not appear to be heavily slanted. We make two observations:

• Saudi Arabia: The Al Arabiya Saudi Page often used the hashtag #saudi_in_the_face_of_corona (translated), which appears to refer to a documentary. The language of the hashtag suggests that Saudi Arabia is confronting coronavirus, as if gearing up for a fight, and could be an attempt to instill national pride. 

• Syria: Saudi Arabia has supported rebel groups in Syria. Though there were only a small number of coronavirus-related posts on Al Arabiya’s Syria Page, there were some interesting bigrams. “Human rights,” for example, was once used to criticize the conditions in Syrian prisons — analogous to critiques the main state media Pages made about Israeli treatment of Palestinian prisoners.

Al-Hadath

Figure 4: Top bigrams for country-specific Al-Hadath Pages. Alhadathalyoum and Helyoum are Pages for Egypt. AlhadathYmn is a Page for Yemen. Data: CrowdTangle

Al-Hadath country-specific Pages were also not heavily slanted, though, there were two exceptions:

• Yemen: The Al-Hadath Yemen Page repeatedly referenced “Houthi Militia” in regards to coronavirus. The posts said Houthi militias were concealing COVID-19 statistics, disregarding human life and using the pandemic to blackmail the international community. 

• Libya: While the vast majority of Libyan posts were neutral, some posts that included the bigram “libyan government” (a reference to the Government of National Accord) referenced the government’s inability to provide services for Libyan citizens

Pandemic for Page Growth?

To assess whether Saudi propaganda outlets benefited (in terms of engagement) from the pandemic, we examined change before and after the start of pandemic coverage for state media Facebook Pages across engagement metrics.

Figure 5: Facebook engagement for top Saudi state media outlets before and after January 1, 2020, the date we set as the start of pandemic coverage. Data: CrowdTangle

We found, first, that several Pages saw a spike in total interactions (defined as comments + likes + other reactions, such as “wow”) after the pandemic (top left in Figure 5). Al Arabiya and Al-Hadath are most notable, though they were already on an upward trajectory prior to the pandemic, so it is hard to know whether the pandemic played a role. Al-Hadath’s top-engagement posts were general news videos and Facebook Live videos related to the pandemic. Al Arabiya’s top-engagement posts also included general, apolitical information about the disease and its spread. For these two Pages, the increase in interactions corresponded to more frequent posting (top right in Figure 5).

Next we looked at whether the interaction rate — the average number of interactions per impression — increased after the pandemic (bottom left in Figure 5). We found that it did for one Page in particular, the Al Arabiya Saudi Page. The highest engagement posts on this Page focused on coronavirus.

Last, we looked at Page Likes (bottom right in Figure 5) — i.e., the number of people who like a Page (as opposed to a particular post). This variable is analogous to Page Followers. Most Pages did not experience dramatic Page growth, with the exception of Al-Hadath and Independent Arabia.

Conclusion

It is intriguing that the large state media Facebook Pages discuss particular countries with clear slants, yet these slants do not carry over to the country-specific Pages. Perhaps the outlets believe that heavy-handed tactics could backfire when targeting directly, for example, Libyans from a clearly Saudi-affiliated media entity. Future work could select a country like Libya and examine in more depth how the country is discussed on the main Saudi state media outlets as compared to the country-specific Pages of these outlets.

On June 4, 2020 Facebook announced that it is beginning to roll out labels for state-controlled media. Currently, for example, all posts on the various RT Facebook Pages are labeled “Russian state-controlled media”. While not all of the Saudi media outlets discussed in this post would be subject to this policy, many are unequivocally state media. These Pages, however, are not yet labeled. We encourage Facebook to roll out this important policy more broadly, and to be transparent in when the labels are introduced across countries.

On March 11, 2020 Twitter shared with the Stanford Internet Observatory accounts and tweets associated with five distinct takedowns. These include:

• Saudi Arabia, UAE, and Egypt: 5,350 accounts and 36,523,977 tweets. The removed accounts were linked both to a September 2019 takedown of accounts linked to DotDev, a digital marketing firm operating out of Egypt and the UAE, and a December 2019 takedown attributed to Smaat, a Saudi Arabian digital marketing firm. This takedown was a result of a tip the Stanford Internet Observatory shared with Twitter in December 2019. 
  • Facebook also shared with the Internet Observatory 55 Pages that are linked to this operation; these Pages were run out of Egypt. Facebook attributes these Pages to Maat, a social media marketing firm.
• Egypt (El Fagr newspaper): 2,541 accounts and 7,935,267 tweets. A takedown of accounts tied to the El Fagr newspaper, an Egyptian weekly tabloid. The removed accounts were linked to an October 2019 takedown of El Fagr’s activities by Facebook.
• Honduras: 3,104 accounts and 1,165,019 tweets. A takedown of accounts linked to a staffer of Honduran president Juan Orlando Hernández.  
• Serbia: 8,558 accounts and 43,067,074 tweets. A takedown of accounts linked to the Serbian Progressive Party (SNS), the party of current President of Serbia Aleksandar Vučić. These accounts engaged in inauthentic coordinated activity to promote SNS and Vučić, to attack their political opponents, and to amplify content from news outlets favorable to them.  
• Indonesia: 795 accounts and 2,700,296 tweets. 

In this post we summarize our analysis of the first four operations. We have also written in-depth whitepapers on the Saudi Arabia/UAE/Egypt, Honduras, Serbia, and Egypt and El Fagr operations, linked at the top of the page.

The Saudi Arabia, UAE, and Egypt operation

[FULL REPORT]

In December 2019 the Stanford Internet Observatory alerted Twitter to the hashtag #السراج_خائن_ليبيا (Sarraj the traitor of Libya), a reference to the Libyan Prime Minister’s signing of a maritime agreement with Turkey that angered many regional actors. The hashtag had a suspicious distribution pattern, and was shared alongside infographics linked to an earlier Twitter takedown attributed to digital marketers DotDev. Twitter’s subsequent investigation of this hashtag revealed not just a link between this new network and DotDev, but also a link to Smaat, a Saudi Arabian digital marketing firm that Twitter suspended in December 2019 (SIO’s report on Smaat is here); Twitter believes multiple social media management firms created the accounts in this network. In April 2020 they removed 5,350 accounts, which are the subject of this assessment. 

Image

On March 25 Facebook shared 55 Pages linked to this network.

Key takeaways from the Saudia Arabia/UAE/Egypt datasets:

• Tweets supportive of Khalifa Haftar - a Libyan strongman who heads the self-styled Libyan National Army - began in 2013. This suggests Saudi Arabia/UAE/Egypt disinformation operations on Twitter targeting Libya began earlier than previously known.
• Accounts claimed to be located in a variety of Middle East and North African countries, with many claiming Sudan. They discussed domestic politics with an anti-Turkey, anti-Qatar, and anti-Iran slant. These countries are geopolitical rivals of Saudi Arabia, the UAE, and Egypt. 
• Recent posts on the Facebook Pages leveraged the COVID-19 pandemic to push these narratives.
• Many of the accounts tweeted links from a set of domains that purport to be news sites for countries like Algeria and Iran; these sites were all created on the same day and publish content with a similar anti-Qatar, -Turkey, and -Iran slant.
• Prominent narratives included discrediting recent Libyan peace talks, criticizing the Syrian government, criticizing Iranian influence in Iraq, praising the Mauritanian government, and criticism of Huthi rebels in Yemen. (We discuss these in detail in our whitepaper) 
• There were several interesting behavioral tactics observed in this Twitter data set: 
  • Hashtag laundering: A geopolitically aligned news website and YouTube channel ran stories about the DotDev-initiated hashtag, with the intent of making it seem like Libyans were (for example) so hostile to Turkey that an anti-Turkey hashtag was trending in Libya. This coverage was grossly exaggerated; the hashtags did not go viral, and the accounts whose tweets they embedded in their articles were subsequently taken down by Twitter. 
  • Jingoistic personas: The accounts were exceedingly and passionately patriotic to the point of being comedic caricatures. Their profiles emphasized their pride in their purported country, saying things like (translated) “Emirati and Proud” or “Tunisia is my passion” or “I love you, Sudan.”

A March 24, 2020 post from the now-suspended facebook.com/GulfKnights1 criticizing Qatar in the context of COVID-19.
 

The Egypt operation

[FULL REPORT]

This takedown was attributed to actors linked to the El Fagr newspaper in Egypt. El Fagr has previously been associated with influence operations, possibly on behalf of the Egyptian government, on Facebook and Instagram, which took down a network related to their activity in October 2019. 

As with several past influence operations attributed to networks operating out of Egypt (and Saudi Arabia), the content consisted of a mix of auto-generated tweets from religious apps, commercial content, geopolitical news content, as well as subversive political astroturfing pushed by accounts that appear to be personas. The political astroturf identities were often made and deployed for a specific topic, created within a short time period and immediately deployed towards a particular topic with very little additional content. 

Key takeaways:

• The topics in this Egypt-attributed data set had high overlap with topics in past Egypt-attributed takedowns: negative content about regional rivals such as Qatar and Iran, positive tone towards the Egyptian government. 
• News properties were at the center of this network. Several appeared to be legitimate organizations, such as El Fagr itself, and other outlets based in UAE and Yemen. 
• Other handles that appeared to be news outlets were fabricated properties that had Twitter accounts with “news” in the name, but did not appear to be actual news outlets - there were no signs of original content. Additionally, a few used names that tried to create the perception that they were regional affiliates of legitimate news organizations (ie, @Foxnewseurope_f). 
• Fabricated personalities were created in batches, some serving as content creators, and others serving as content amplifiers. The creators would tweet “original” messages nearly simultaneously (3-6 accounts would put out the same text but not engage with each other), and then outer networks of “disseminators” would amplify them all. 
• There was significant amplification of El Fagr’s editor, @MustafaThabetM, with over a hundred thousand retweets - not only from the paper’s own twitter handle, but from a collection of persona accounts. The retweeted content often included sensational or highly political hashtags related to Qatar. 

An example of one of the many instances in which networks of accounts created in batches  were used to amplify El Fagr’s editor, Mostafa Thabet. 

The Honduras operation

[FULL REPORT]

This takedown of over 3,000 accounts was attributed to the administration of the Honduran President.  and is related to a July 25, 2019 Facebook takedown of 181 accounts and 1,488 Pages. Among the accounts pulled down were those of the Honduran government-owned television station Televisión Nacional de Honduras, several content creator accounts, accounts linked to several presidential initiatives, and some “like-for-likes” accounts likely in the follower-building stage. Much of the tweet behavior seems targeted at drowning out negative news about the Honduran president by promoting presidential initiatives and heavily retweeting the president and news outlets favorable to his administration. Interestingly, a subset of accounts in the dataset are related to self-identified artists, writers, feminists and intellectuals who largely posted tweets critical of the Honduran president Juan Orland Hernandez (‘JOH’).

Image

Image

Key Takeaways:

• The Honduras takedown consists of 3,104 accounts and 1,165,019 tweets. 553,211 tweets were original and 611,808 were retweets. Accounts dated as far back as 2008, but roughly two thirds were created in the last year. 
• The accounts created in the last year appear largely automated. Their activity overwhelmingly involved retweeting Honduran President @JuanOrlandoH. Approximately 37% of the tweets in the dataset mentioned @JuanOrlandoH.
• The largest removed account was that of Televisión Nacional de Honduras (TNH). The government-controlled TV station’s facebook page was also removed in July 2019. TNH has new social media presence on both platforms as of March 25, 2020.
• Some of the removed accounts are associated with known television and media personalities, one of whom, Chano Rivera, is also a political consultant and publicist.
• The frequency of hashtags including (in translation) #TheNewHonduras, #HondurasAdvances, #BetterLife, #HondurasActivates, #ISupportYouJOH, #LongLiveJOH and #HondurasIsProgressing shows widespread promotion of the president’s initiatives within the dataset. Minimal mention is made of some major news events, such as the criminal conviction of the president’s brother, Tony Hernandez, suggesting that the tweets sought to drown out negative press.
• A set of roughly a dozen accounts associated with self proclaimed writers, artists and feminists formed a distinct group in the dataset. These accounts were the only accounts heavily critical of the government. They also interacted less with the dominant media landscape and the president than other accounts in the dataset. There does appear to be evidence of coordinated activity across the cluster.

The Serbia operation

[FULL REPORT]

One of the takedowns announced on April 2, 2020 was a large cluster of Serbian accounts. These accounts were primarily engaged in cheerleading current Serbian President Aleksandar Vučić and his allies, in attacking the Serbian opposition, and in artificially boosting the popularity of Vučić-aligned tweets and content. Among other things, the accounts appear to have focused on supporting Vučić’s run for president in 2017 and tamping down public support for the opposition-led protests known as “1 of 5 Million,” which began in late 2018.

One of the most popular accounts in the Serbia-related takedown, @belilav11, replying to a tweet from the Serbian Progressive Party, the party of current Serbian president Aleksandar Vučić: “The government belongs to the people, not to the yellow tycoons [i.e., the opposition] and their mentors from the west. The people decide in the election who will be in power.” Accounts like this one tweeted in support of Vučić and his allies and attacked the Serbian opposition.

Key takeaways

• The network consisted of approximately 8,558 accounts. While many of these accounts existed earlier, most of the network’s activity came in 2018 and 2019. The accounts sent more than 43 million tweets altogether. 
• The accounts served as a coordinated pro-Vučić brigade on Twitter. They tweeted constantly in support of Vučić—over 2 million tweets were sent with the hashtags #Vucic and #vucic—and derided his rivals and the “1 in 5 Million” protests. 
• The accounts worked steadily to direct Twitter users to pro-Vučić news sources. Among their tweets were over 8.5 million links to sns.org.rs, informer.rs, alor.rs, and pink.rs, the official site of Vučić’s party and three Vučić-aligned news sites, respectively.
• The accounts relied on a few core tactics to boost visibility and achieve their aims: 
  • Dogpiling onto opposition-related content. Tweets by opposition politicians and publications were swarmed by the accounts, which replied with critical or derisive comments to give the content the appearance of unpopularity.
  • Taking over opposition-related hashtags. When protesters popularized the hashtags #1od5miliona and #PočeloJe, the accounts attacked the originators and attempted to co-opt the hashtags with pro-Vučić content.
  • Retweeting Vučić-aligned accounts to boost their popularity. The accounts retweeted @avucic 1.7 million times, @sns_srbija (the official account for Vučić’s party) over 4.5 million times, and @InformerNovine (an SNS-aligned newspaper) over 1.8 million times. Many accounts were engaged solely in retweeting @avucic.

While a precise connection between this network and SNS has not been established, there can be no doubt, given the content these accounts shared and the time period in which they were active, that this network was aligned with Vučić’s efforts to entrench himself and his party in power.  

The broad spectrum of takedowns in the April 2020 collection serves as a reminder that coordinated inauthentic behavior manifests globally, comes from a range of actor types, is reliant on broadcast media as well as the social media ecosystem, and that determined manipulators regenerate networks and update tactics with regularity.

4/2/2020, 11:30AM PST: THIS POST WAS UPDATED TO INCLUDE ADDITIONAL INFORMATION FROM FACEBOOK

On December 20, 2019 Twitter announced the removal of 88,000 accounts managed by Smaat, a digital marketing company based in Saudi Arabia, and attributed thousands of these accounts to involvement in “a significant state-backed information operation”. On December 17 Twitter shared with the Stanford Internet Observatory 32,054,257 tweets from 5,929 randomly sampled accounts. In this report we provide a first analysis of the data.

Smaat is notable in part because it was co-founded by Ahmed Almutairi (also known as Ahmed Aljbreen), a Saudi agent of the royal family who recruited two Twitter employees to spy on the accounts of critics of the Saudi government. Almutairi is now wanted by the FBI.

Behavioral observations:

• The accounts were high-volume; the average account had 5,406 tweets and was created in 2016, and several accounts tweeted tens of thousands of times. Many bordered on spam.  

• These accounts appeared to attempt to obscure their commercial and political activity by  tweeting an abundance of largely-automated religious, sports, and poetry content. Approximately 7% of tweets came from client apps that appeared designed to automatically tweet religious messages.

• One amplification strategy we observed in our dataset was the use of, “قروبات دعم”, which translates to Support Groups, for boosting visibility for brands and gaining followers. Other terms for this activity - which involves everyone in the group using the same hashtag, following members in the hashtag, or retweeting the hashtag - are a “retweet ring”, follow-back ring, or follow train. Smaat’s participation in these support groups appeared to have the goal of expanding the visibility of their accounts.

• The user accounts listed additional social profiles on SnapChat, WhatsApp, and some regionally-popular social sites such as Telegraph, Sarahah, and CuriousCat.

Image

Content observations:

• Much of the content was commercial in nature; this is expected given Smaat’s business objectives. According to their website, their clients included Dunkin Donuts, Coca Cola, LG, Bentley, Toyota, The Ritz Carlton, and Fanta. Tweets about Dunkin Donuts, for example, defended the brand against a scandal where they had used a four-finger hand gesture to communicate how cheap their coffee was - a hand gesture which has been used by the Muslim Brotherhood. The tweets were designed to look like the expressions of real people, as opposed to ads. Social media marketing tactics are frequently misused for influence operations and this behavior looks like it was trying to mimic grassroots enthusiasm (sometimes called “astroturfing”). 

• A large quantity of the content was political. The political narratives the accounts pushed were consistent with the objectives of the Kingdom of Saudi Arabia, such as tweets critical of the governments of Qatar, Iran, and Turkey.

• Another set of of political tweets of note, also aligned with KSA goals, attacked Jamal Khashoggi, the acclaimed Saudi journalist who was killed in the Saudi Consulate in Istanbul in 2018. After his death there were thousands of tweets denying any involvement by the Crown Prince Mohammad bin Salman. 

• We observed many tweets critical of Qatar, including tweets from accounts claiming to be Qatari citizens speaking out about abuses against them by the Qatari government. There were 78 hashtags about Qatar, including #cutting_relations_with_Qatar and #Qatar_hosts_homosexuality.

Top hashtags used in the takedown about Jamal Khashoggi.

We note that there are likely other political narratives in the 32 million tweets that merit additional study.