The multi-regional operation spread anti-Qatar content online and attacked the Muslim Brotherhood

On October 3, 2019, Facebook removed dozens of assets operated by a for-profit marketing firm and originating in the United Arab Emirates (UAE) from its platform for engaging in coordinated inauthentic behavior.

According to Facebook’s statement, the pages ran operations with the aim of “artificially increas[ing] engagement” in several countries, with a focus on the Middle East-North Africa region. In terms of content, many of the assets disseminated messaging critical of the Qatari government, along with criticism of the Muslim Brotherhood.

Facebook attributed some of the assets to Charles Communication Pvt, Ltd., a UAE-based marketing firm. The DFRLab’s investigation corroborated that attribution and further suggested that the company had carried out its multiregional influence operation by delegating portions of it to actors based outside of the UAE.

The operation

Based on information gleaned from the pages themselves, the DFRLab’s analysis suggested that the operation targeted many regions, including North America, Europe, Southeast Asia, and Africa.

Many of the pages were run by page managers who were not based in the target country. The page managers for both Afghan AtoZ and PulsaIndonesia, for example, were located in India and the Philippines.

A LinkedIn search for Charles Communications revealed that the company was registered in India as a one-person company with offices in the Philippines, India, and the UAE. This finding raises the possibility that the operation may have been controlled by individuals based in several countries, operating under a single company name.

Charles Communications’ registration information in India further confirmed that the company had only a single employee and lacked significant assets. The lack of any further information provided by Charles Communications indicated that it was poorly organized and managed or, alternatively, that it might be intentionally disguising its operations.

Over the course of the DFRLab’s investigation and following Facebook’s announcement of the takedown, the Charles Communication website re-branded and ultimately ceased operation, all within a period of five days. This sort of re-branding or overall abandonment is common for disinformation contractors following exposure; after Facebook removed many of its assets, Israeli firm the Archimedes Group appeared to cease operations and its website went offline.

Information on the external domains pushed by these pages was limited, but according to an investigation by Buzzfeed, some of the domains that the assets promoted were connected to an Indian PR firm, Matrix Media Solutions, which is based in Kolkata.

According to Buzzfeed, the website was registered to the company’s general manager. While it is not clear to what extent Charles Communications and Matrix Media Solutions coordinated in this operation, these operations appear to be getting increasingly complex.

Plotting against Qatar

Two of the pages in the set, “The Crystal Eyes” and “The Foreign Code,” had eponymous associated websites that pushed narratives targeting Qatar and the Muslim Brotherhood. The same narratives appeared in a previous Facebook takedown attributed to Newave, a UAE firm that targeted the Emir of Qatar.

The above article, published on thecrysaleyes.com, argued that Qatar had “indirectly supported” the terror organizations responsible for the September 11 attacks in the United States. The article mentioned an interview with the Emir of Qatar, Tamim bin Hamad Al Thani, in which he allegedly said that Qatar “did what it thought was right.” The article also added that the country was playing a “sweet game with the United States and other nations of the world.” It provided no verifiable attribution for any of its claims.

An article published on the second site, theforeigncode.com, planted a similar narrative with regard to U.S.-Qatari relations. The article argued that, while the Emir had established a good working relationship with U.S. President Donald Trump, the relationship seemed secondary and unimportant from Qatar’s side, as the country allegedly funds terror organizations.

Some of the articles claimed Qatar had provided support to the Muslim Brotherhood, which it said had “links to terrorism and extremism.”

Conclusion

This takedown was verifiable in that the DFRLab found corroborating evidence that a marketing firm had carried out a global operation using its own network of companies. Information recovered about these companies showed that the business operated with obscured ownership, were a single or no-director company, and had very limited capital.

Charles Communications employed this emerging strategy in addition to more common tactics, which included the use of fake accounts to amplify engagement artificially and the creation of regional news outlet pages to attract a local audience. The latter tactic, in particular, is becoming increasingly popular; the DFRLab recently encountered it in Iranian as well as Ukrainian information operations. In this takedown, some of the pages used names similar to those of established news outlets, including Indian Daily Live (similar to mydailylive.com), Malaysia Now (similar to Times Now), and Afghani Mirror (Mumbai Mirror), in a possible attempt to deceive less discerning users.

In terms of content, this information operation focused on targeting Qatar and the Muslim Brotherhood, similar to a previous UAE-linked takedown from August 2019.

Follow along for more in-depth analysis from our #DigitalSherlocks.