Saudi government-associated assets attacked the Turkish President and Qatar’s Emir, pushed anti-Iran messages

On August 1, 2019, as part of a broader takedown, Facebook removed 387 assets that had “links to individuals associated with the government of Saudi Arabia” and that propagated, among other things, content designed to undermine Turkish President Recep Tayyip Erdoğan, to attack the ruling family of Qatar, and to push anti-Iran narratives to Arabic-speaking audiences.

In its announcement, Facebook also stated:

The Page admins and account owners typically posted in Arabic about regional news and political issues, including topics like the Crown Prince Mohammad bin Salman, his economic and social reform plan “Vision 2030,” and successes of the Saudi Armed Forces, particularly during the conflict in Yemen. They also frequently shared criticism of neighboring countries including Iran, Qatar and Turkey, and called into question the credibility of Al-Jazeera news network and Amnesty International.

This is not the first influence campaign with possible links to the Saudi government. Bellingcat, an independent investigative website, previously investigated social media operations conducted by Saud Al-Qahtani, a high-level adviser to Saudi Crown Prince Mohammad bin Salman (frequently referred to by his initials, “MBS”), on behalf of the royal court. This is, however, the first time that Facebook itself has directly attributed activity on its platform to somebody with connections to the Saudi government.

Facebook shared a subset of 93 assets from the set with the DFRLab. There was insufficient open-source evidence within the subset to provide conclusive attribution of this operation to the Saudi government. Nonetheless, the pages generally supported the interests of the Saudi ruling family and military.

Pages Targeting Erdoğan and Turkey

The assassination of the U.S.-based journalist and Saudi dissident Jamal Khashoggi in Saudi Arabia’s consulate in Istanbul, Turkey, tested Saudi-Turkish diplomatic and political relations. A month after Khashoggi’s death, Erdoğan authored an op-ed in The Washington Post, where Khashoggi had worked as a columnist, in which he implicated the Saudi government in Khashoggi’s death, though he refrained from mentioning MBS directly.

The creation dates of the pages posting content about Erdoğan indicated that they were created after Khashoggi’s disappearance, suggesting the operation may have targeted Erdoğan for his vocal stance on Khashoggi’s murder.

One of the pages from the takedown, سفر برلك (“Seferbarlik”) had over 130,000 followers on Facebook and also had an associated Instagram account.

The affiliated Instagram account, however, had a much more modest follower count.

The Seferbarlik Facebook page attacked Erdoğan for his stances on Israel and the conflict in Syria, among other issues. One post, for example, stated that the Turkish President was interfering with peace negotiations around the ongoing Syrian conflict.

Another post to the page suggested that the Turkish President was pleased to meet with Israeli officials, an inherently inflammatory statement given Israel’s pariah status for many Middle Eastern countries.

The post was also included in an ad campaign instituted by the page, as Seferbarlik ran several ads intended to amplify the reach of its posts. That the page was able to amplify its posts through paid promotion suggested that the operators of the pages had financial resources available to do so.

Another page, Turk Observer, spread unsubstantiated claims about the origins of the Turkish empire and culture. This page had 46,282 followers, and the page manager was based in Saudi Arabia.

Trolling Qatar’s Al Thani Family

While some pages focused on attacking Erdoğan or Turkey, others attacked Hamad bin Khalifa Al Thani, the former Emir of Qatar. One of these pages, الدب الداشر (“Aldobaldasherhamad”) failed to amass much engagement with its posts, as the page had only a few hundred followers.

A reverse search of these graphics revealed that many of them had been uploaded to Pinterest by an account called qatar-press.com.

The URL associated with the Pinterest page was no longer functional, but a LinkedIn profile by the same name listed a physical address at الدوحة, 333 (“Doha”).

These posts represented an attempt to malign Al Thani’s image. Tensions between Saudi Arabia and Qatar have been rising since Hamad bin Khalifa Al Thani ascended to power in Qatar in 1995, reclaiming control over the country’s foreign affairs. After the launch of Al Jazeera, a Qatari government-funded media outlet, in 1996, relations between the two countries soured, as the Saudis levied accusations that the outlet was biased against the Saudi ruling family.

Attacking Iran

Other Facebook pages, such as “FreedomIran79” and “Irantag Irantag,” carried content on Iran’s local affairs. These posts were in Arabic and English. This suggested that the pages were likely not targeting an Iranian audience, given that Farsi is the predominant language in the country.

The DFRLab earlier reported on Iran’s effort of disinformation on Saudi Arabia and the neighboring countries of the Middle East. The assets in this takedown, conversely, took on Iran by pushing a Saudi-styled political stance on the former country’s domestic and international affairs.

Overall, the pages that focused on Iran had a low audience of about 3,320 followers. While the number of followers is not the perfect metric for measuring reach of a page, it provides a decent prediction for the number of accounts that might see a post in their timeline.

One of the Iran-focused pages, Irantag Irantag, primarily served as a content amplification platform for a dedicated domain of the same name. In one case, the page posted a link to an article on an eponymous website, Irantag.net, that allegedly quoted an ally of former Iranian President Mahmoud Ahmadinejad as saying, “wait until the death of old regime leaders for any improvement.” The quote could not be verified.

A Google Search produced a single result for the quote: the Irantag Irantag page’s Facebook post. (Because the original post was in English, the DFRLab searched only for the English-language version.)

Typographical Similarities Among Page Content

In at least one case, the DFRlab found typographical similarities between different pieces of content on two different pages included in the takedown.

In particular, a graphic on a page by the name of “Free Iran,” which targeted Iran, and a graphic on Aldobaldasherhamad, which targeted Al Thani, both included similar typography and had images with characteristics of Adobe Illustrator’s “Image Trace” functionality, a tool for vectorizing images. Vectorizing makes a standard photo look as if it is an artist sketch.

While vectorizing is not uncommon, the similarities alongside the close relation of the pages within the takedown set may nevertheless indicate that the same person created graphics for the two pages.

Praising the Saudi Military and Ruling Family

Many of the pages from the takedown pushed a national security agenda, disguised as military support pages. One of the pages called “Alrad3sa,” with posted content on the Saudi military and the ruling family.

Although the Facebook page had been taken down, the page had two affiliated Twitter accounts. The first, موقع الردع السعودي (Alrad3sa), was linked on the page’s profile and had more than 337,000 followers at the time of analysis. The second Twitter account, موقع الردع السعودي (Alrad3_SA), had about 18,000 followers.

Both Twitter accounts seemed primarily devoted to military affairs and national security, sometimes amplifying Saudi propaganda against Qatar and Turkey, in particular.

The Alrad3_SA Twitter account also directed followers to an external website, Alrd3.com. The content on the website was largely outdated but covered topics related to Middle East security and politics.

The DFRLab found that two additional websites shared the same domain analytics ID, which is used to track behavior across associated pages. In this case, the webpages alrd3.com, alrad3.com, and mubasher.news all had the same ID, AT-ra-571c56dbb50195af.

On Instagram, an account with the handle @mubasherna was active but had no posts. The account was not included in the initial takedown but has since been removed. On Twitter, an account with the same handle was active and posted regularly.

Conclusion

The operation focused on regional audience to further bolster the support for the Saudi royal family and pushed politically charged content on leaders from neighboring countries, including President Erdoğan in Turkey and members of the Qatari royal family.

The open-source evidence did not provide conclusive attribution to the Saudi government or even somebody linked to it, as stated by Facebook in its announcement, but the DFRLab found that the content on the pages nonetheless reflected the royal family’s interests on a range of issues.

The effectiveness of these influence campaign is hard to determine. The DFRLab found a network of sockpuppet amplifiers, however, that cross-posted content to amplify content directed at their followers.

This tactic demonstrates the pages and groups not only relied on their own audience but deployed accounts to further push content across the associated assets. As the first takedown by a major social media platform of assets linked to somebody affiliated with the Saudi government, as attributed by Facebook, this takedown provided valuable insight into online influence tactics undertaken on behalf of the country.

Follow along for more in-depth analysis from our #DigitalSherlocks.