A BuzzFeed News investigation uncovered a network of websites and accounts using Facebook, Twitter, YouTube, and other social platforms to sow propaganda targeting Iran and Qatar. The accounts, which have now been taken down, appear to have been professionally run by PR firms based in the Middle East and Africa.
In August, Facebook announced the removal of more than 350 pages and accounts it said were engaged in coordinated inauthentic activity and operated by marketing firms in Egypt and the UAE. Now, after being contacted by BuzzFeed News about another network of pages, accounts, and websites connected to those it had previously removed, Facebook has announced additional takedowns, saying the accounts removed in August were, in fact, part of larger operations run by PR firms in UAE and Nigeria.
"The August takedown is heavily linked to these entities, and disrupting parts of that network helped elucidate more about the behavior of the second network," David Agranovich, global threat disruption lead at Facebook, told BuzzFeed News in an interview.
This follows a September announcement by Twitter that it had removed 241 additional accounts linked to Egypt and the UAE. It’s now clear that these accounts were also connected to the larger operation uncovered by BuzzFeed News and targeted by Facebook today.
In total, the company removed 211 Facebook accounts, 107 Facebook Pages, 43 Facebook Groups, and 87 Instagram accounts “for engaging in coordinated inauthentic behavior that originated in the UAE, Egypt and Nigeria,” according to today’s announcement. Additionally, 62 Twitter accounts and 12 YouTube accounts uncovered by BuzzFeed News were taken down.
Facebook also announced today that it had removed accounts and pages connected to separate information operations stemming from Egypt and Indonesia.
The UAE–Nigeria network spent close to $150,000 promoting its content on Facebook, and attracted close to 1.4 million followers for the associated pages, according to the Facebook announcement. The Instagram profiles were followed by nearly 70,000 people.
The action by Facebook today reinforces how malicious actors work across different platforms, run by different companies, to create coordinated disinformation operations, and can remain active even after major platforms take action against them. The UAE–Egypt–Nigeria network also demonstrates how outsourcing of digital trolling to marketing and PR firms is an increasingly popular way to conceal who’s behind information operations.
“Increasingly, we're seeing more PR firms or strategic communication firms offer computational propaganda as a service for all sorts of clients, including governments,” Samantha Bradshaw, a researcher at the Computational Propaganda Project at Oxford University, told BuzzFeed News. “Most of the behaviors that we've seen with these firms is that they tend to work more internationally and take on more clients.”
She said governments have begun outsourcing disinformation operations to firms in the Philippines and elsewhere in Southeast Asia in order to take advantage of cheap digital labor and conceal the origins of the activity. One part of the network uncovered by BuzzFeed News had connections to a marketing firm in India, though the nature of the firm’s involvement is unclear. The firm itself was not involved in running any of the Facebook or Instagram entities, but had registered the domain names some of the websites in the network. In its announcement, Facebook also named three other PR firms involved in the operation — Flexell and Charles Communications in UAE, and MintReach in Nigeria.
"This network was linked to the takedown of an Emirati and Egyptian PR firm that we announced in August earlier this year," Agranovich said. "We were able to, essentially, capture a second set of PR firms that we saw highly synced to those first PR firms."
BuzzFeed News began investigating the network after we identified a group of 41 Twitter accounts posing as journalists. The accounts promoted real news outlets alongside four misleading ones: TheCrystalEyes.com, Diplomacy24.com, TheEconomyClub.com, and TheForeignCode.com. A network of 29 additional websites was then uncovered using historical domain registration information from DomainTools, and by identifying unique Google IDs in the sites’ source code.
“Increasingly, we're seeing more PR firms or strategic communication firms offer computational propaganda as a service for all sorts of clients, including governments.”
The websites masqueraded as news outlets but gave no address or ownership information, and authors of the articles used fake names. Each site posted real news stories, but alongside them were inflammatory articles targeting Iran, Qatar, and in some cases other regions. The posts also heavily promoted the Emirates.
There were other clues that the sites were connected. Their Facebook pages targeting the US and the UK were all created on the same day, Jan. 16, 2018. They all have managers in the United Arab Emirates, while other sites in the network also have managers in Egypt and India.
Facebook first took notice of websites and pages in the network in August when it removed hundreds of accounts linked to marketing firms in Egypt and the UAE, but did not connect them to the governments of those countries.
"We didn't have evidence on Facebook that indicated a connection to the Emirati government or any other government," Agranovich said. "Although it is notable that the content is generally foreign policy issues that align with those of the Gulf states and the Emirates."
A dive into those removed accounts by DFRLab, a Facebook partner, uncovered two marketing firms involved in the operation — New Waves in Egypt and Newave in the UAE. One of the sites from the network BuzzFeed News found was still registered to Newave. Seven others did not provide a registrant name but gave a UAE location.
Then, in September, Twitter removed 271 accounts connected to UAE and Egypt, calling the network “a multi-faceted information operation primarily targeting Qatar, and other countries such as Iran. It also amplified messaging supportive of the Saudi government.”
The accounts removed by Twitter pushed a handful of anti-Qatar websites targeting Arabic speakers. Among them were websites Bnlibya.com, tweeted 96 times, and Sudanalyoum.com, tweeted 555 times. Both had the same Google IDs as sites tweeted by the fake reporters.
The variety of the content and targeted regions could mean that the firm or group of people running the operation have multiple customers, said Marc Owen Jones, assistant professor of Middle Eastern Studies at Qatar's Hamad Bin Khalifa University. He studies and uncovers social media manipulation networks.
“Maybe there's an entity who runs these kinds of sites and presumably if they have changing clients, they may have changing discourses,” said Jones.
After reviewing a sampling of the websites, he said it’s unlikely the goal is just to make money with inflammatory content.
“I don't see this as a clickbait site — my inclination is that this is a propaganda site,” he said of Theforeigncode.com, one of the four bogus sites. “I don't see an obvious marketing strategy. I don't see them selling a product on any of these sites.”
While the current owners of the site in the network are hidden, a search of registration details using DomainTools shows that a marketing company called Matrix Media Solutions based in Kolkata, India, initially registered nine of the domains. The sites were registered by the company’s general manager, Abhishek Tarafder, who did not respond to multiple emailed questions about his company’s role in the operation.
On its website, Matrix Solutions says it offers website creation, online marketing, content writing, and search engine optimization services. Its homepage says the company has delivered services in 36 countries, but many of the testimonials praising Matrix Media use stock photos instead of images of real customers.
It’s not clear whether Matrix Media is still involved, or if it played a role in creating and managing social media accounts promoting the sites. According to Twitter’s takedown notice, another firm based in Abu Dhabi with an office in Egypt, DotDev, was managing the profiles it removed. Twitter said all accounts associated with DotDev were permanently suspended from its site. The new firms Facebook named in its investigation today will also be banned from its platforms.
"We saw that they used a large volume of fake accounts, and those accounts were used for one of two purposes," said Agranovich. "Either to run Pages ... or using fake accounts to engage directly on their content."
Many of them used fake profiles to boost the network’s credibility.
"The idea there was to post comments as if they were unconnected individuals or to reshare their own posts but make it look like it wasn't them doing it," he said.
Not all the content posted to the websites promoted by the fake reporters was inflammatory or political. Diplomacy24.com, for example, posted about "Storm Area 51" day on Instagram in a likely bid to generate engagement. On Pinterest, TheEconomyClub.com regularly shares cryptocurrency stories. The sites in the network all have accounts on most major social media platforms, including YouTube, Facebook, Tumblr, Instagram, Twitter, and Pinterest.
None of the fake journalist accounts found by BuzzFeed News were removed by Twitter as part of the takedowns announced last month, though some were temporarily restricted — which means that the account violated Twitter rules. The social media giant deleted the fake reporters after being asked for comment by BuzzFeed News, but some of the profiles related to other websites in the network remained unpenalized.
“I think a lot of the problem with disinformation and the security measures that platforms have introduced is that it's still a cat and mouse game,” Bradshaw said. “They still focus on the content instead of the structures and algorithms that incentivize this.”
One example of a fake reporter account targeting Americans is “Jenny Powell,” a self-described Washington-based journalist, volunteer, and environmental activist. At first glance, Powell’s Twitter timeline looks like it belongs to a young and eager reporter amplifying her interests. But her profile photo is a stock image, and many of her links go to the propaganda sites.
Powell, who joined the platform just last month, shares links to stories from major US news media outlets, retweets local news about Washington, DC, and regularly promotes content from TheForeignCode.com and TheEconomyClub.com. Other fake journalist accounts behaved similarly to Powell and had generic descriptions. One of the accounts, for a fake Bruce Lopez in Louisiana, has a bio that describes him as a “Correspondent Traveler noun|linking verb|noun/verb/adjective|,” which appears to reveal the formula used to write Twitter bios for the accounts.
“It's almost a highjacking of credibility,” Bradshaw said of the use of fake journalist profiles.
The fake reporters weren’t particularly popular or effective at spreading disinformation, but they were all created in August and September of this year. Most used stock images of young women that claimed to be based in the US or the UK and amplified real news sites in addition to those that were part of the campaign. They did not share personal viewpoints or even original tweets other than copy and pasted news alerts.
“There's merit in the sheer volume. It's not enough to have one blog. They're going for the same audience. There's a credibility, legitimacy aspect. It gives depth to the propaganda,” said Jones. “There's clearly this kind of industry around the world, and a lot of it seems to be in the Middle East, that's creating this illusion of a diversity of sources.”
While the sites and social media accounts didn’t get much traction, it’s possible the campaign was in its infancy. The corresponding Facebook pages generally had between 20,000 and 40,000 followers. The most popular page in the network, Libya.Liv, had over 300,000. On YouTube, a page called Balakona Com amassed over 600,000 total views.
“This is the kind of influence operation that we're seeing more and more of,” said Jones.
Posts from the accounts removed by Twitter clearly illustrated the network’s goals. They targeted Qatar and invited people to send in damaging material.
“#Bought_by_qatar Trump set to benefit as #Qatar buys $6.5m apartment in #New_York tower This article is more than 11 months old The acquisition in Trump World Tower came soon after a lawsuit that tried to stop president benefiting from such deals was dismissed!! #qatar,” one tweet said.
“We are interested in publishing large collections of material that expose the Qatar regime in supporting terrorism and corruption in the Arab world,” said another.