Supporters of Egypt’s army and Egyptian President Abdel Fattah al-Sisi dance and cheer as they celebrate the anniversary of Sinai Liberation Day in Cairo, April 25, 2016. (Source: Reuters/Amr Abdallah Dalsh)

A Twitter network that appears to be aligned with the Egyptian government is amplifying hashtags favorable to President Abdel Fattah El-Sisi and the police force, resulting in the hashtags trending in Egypt. The network also amplified a hashtag attacking the fact-checking organization Saheeh Masr.

The network includes twenty-one active accounts, several of which have large user bases in the tens of thousands of followers, including one with more than 54,000 followers at the time of writing. Some accounts exhibit highly suspicious posting rates and engage with pro-government hashtags during overlapping timespans. They also frequently reply to each other’s tweets with the hashtags in an apparent bid to boost amplification.  

Saheeh Masr first reported on three Twitter accounts in September 2022, noting the amplification of different hashtags supportive of El-Sisi and the Egyptian government. The outlet also noted that that the hashtags emerged after social media users criticized the government in August 2022. Saheeh Masr added that the campaigns were led by one specific account that was also present in the network the DFRLab identified, suggesting overlap in the two networks.

The DFRLab observed possible engagement and coordination between at least twelve accounts in the network that retweet, reply, and like each other’s content, all within a matter of minutes or even seconds. These accounts follow each other and appear to be coordinating to expand the reach of their tweets. Their behavior suggests an attempt to exploit trending topics on Twitter to promote pro-government narratives.

The DFRLab analyzed three pro-government hashtags: #صحيح_مصر_لجنة_ننوس_مامته (“Saheeh Masr are his mama’s boy trolls”) #هندعم_السيسي_ل2030 (“We will support El-Sisi for 2030”), and #كل_الدعم_لرجال_الشرطة (“Full support to policemen”). The first hashtag seems to have been prompted by Saheeh Masr’s September 2022 investigation, while the second and third hashtags appear to have resulted from opposition calls for anti-government protests that circulated on social media on November 11, 2022. Suspicious accounts from the network likely amplified the hashtags to construct the false perception of widespread government support, as well as objection to the protests. The popularity of the hashtags was short-lived, according to an analysis conducted using monitoring tool Meltwater Explore, indicating that the networks may have been activated to specifically respond to these events. Our analysis focused on the period from June 1, 2022 through the end of December that year.

A review of the hashtags using Meltwater Explore revealed that more than half of their activity came from retweets and quote tweets rather than original tweets.

#صحيح_مصر_لجنة_ننوس_مامته (“Saheeh Masr are his mama’s boy trolls”), the hashtag used against the fact-checking organization Saheeh Masr, was launched on September 13, the same day it reported on a network coordinating the amplification of hashtags supporting El-Sisi. The three accounts identified by Saheeh Masr overlapped with the network identified by the DFRLab. The account that Saheeh Masr claimed to be the leader of the network, @BassemElMassry, also initiated the hashtag used against the organization, which claimed the fact-checking group was part of an online network working for the sons of former Egyptian President Hosni Mubarak. The hashtag eventually reached Egypt’s trending list on September 14, when mentions of the hashtag peaked.

Several of the accounts that used the hashtag, including @BassemElMassry, later shared the two pro-government hashtags that emerged and trended following the November 11 opposition calls for protest. Tweets spreading the two hashtags typically glorified and praised the Egyptian government, El-Sisi, the Egyptian army, and the national police. The hashtag #هندعم_السيسي_ل2030 (“We will support El-Sisi for 2030”), which supports El-Sisi remaining the country’s president until 2030, emerged on October 19 and peaked on October 21 with more than 55,000 mentions. It trended in Egypt for three days beginning on October 20 and was heavily amplified by accounts in the network with large followings. Pro-government media outlets Al Masry AlYoum El Watan News, El Dostor, and Sada El Balad also amplified the hashtag. Sada El Balad also reported on the hashtag on its website and TV channel, while El Dostor tweeted it more than one hundred times in three days.

The network also promoted the hashtag supporting the Egyptian national police, #كل_الدعم_لرجال_الشرطة (“Full support to policemen”). The hashtag emerged on November 5 and received more than 8,000 mentions. It trended in Egypt on November 5 and 6. The pro-government news outlet Al Bawaba News shared the hashtag in a tweet, while the editor-in-chief of the state-owned outlet Al Youm7 retweeted the hashtag.

The account @BassemElMassry openly asked followers to use and retweet the hashtag attacking Saheeh Masr, as well as the hashtags supporting El-Sisi and the Egyptian national police. @BassemElMassry appears to change its handle and utilize backup accounts, possibly to avoid detection. Hashtag data retrieved from Meltwater Explore revealed three similar handles for this account: @BassemElMassry; @BassemElMassry1; and @BassemElMssry2. Archival material collected by the DFRLab on February 22 and March 10 shows that the account changed its handle at some point from @BassemElMassry1 to @BassemElMassry. Tweets in the DFRLab’s dataset from the account @BassemElMssry2 now lead to an account with the handle @BassemElMssry1, which uses a similar name and avatar but has fewer followers and appears to be a backup account, suggesting another account handle change.

Accounts in the network  retweeted @BassemElMassry and often replied to the account’s tweets with the same hashtag to amplify it, sometimes adding the Egyptian flag emoji. In addition to replying to @BassemElMassry, accounts also replied to each other’s tweets using the hashtags.

Additionally, the DFRLab found that twenty accounts in the network follow each other, including all of them following @BassemElMassry.

Another indication of suspicious activity from the network was the high posting rate from some of the accounts, particularly from accounts other than @BassemElMassry. For example, the account @soha_elsisi777 was among the most prolific, using the hashtag supportive of El-Sisi (#هندعم_السيسي_ل2030) more than 450 times on October 20, mostly in the form of retweets and quote retweets. On October 19, the account replied thirty-one times to different tweets from @BassemElMassry, most of the replies shared the hashtag with a fire emoji. Similarly, on October 20, the accounts @_SOLA_3 and @BaroonMSR used the same hashtag 305 and 235 times, respectively. Both accounts followed @soha_elsisi777’s pattern, mostly retweeting and quote-tweeting the hashtag, in addition to replying to other accounts with the hashtag and an emoji.

The DFRLab identified the same pattern in tweets amplifying the other pro-government hashtag supporting the national police (#كل_الدعم_لرجال_الشرطة). The account @BaroonMSR used the hashtag 107 times on November 5, mostly in replies to other accounts. Almost all the replies shared the hashtag alongside the handshake emoji and the Egyptian flag emoji. Another account displaying suspicious activity to promote the hashtag was @ilive542, which quote-tweeted the hashtag more than 400 times in less than seven hours. The DFRLab identified 161 quote tweets by the account in over half an hour, suggesting the possibility of automated activity. The account relied on hashtag-spamming by posting the same string of six to nine pro-government hashtags in quote tweets over a short period of time. For example, in the span of five minutes, @ilive542 quote retweeted @BassemElMassry eighteen times using the same set of hashtags. In another example, the account quote retweeted the pro-government media outlet El Dostor fifty-seven times in ten minutes.

As internet users in Egypt suffer from censorship and restrictions on internet freedom, online coordinated attempts to control narratives can further restrict the information environment. Various accounts in the identified network appear to be taking part in coordinated amplification efforts in favor of the Egyptian government, president, army, and police, which are then sometimes picked up and reported on by pro-government media outlets. Our investigation shows an analysis of three hashtags the network amplified and managed to push to Twitter’s trending list, thus creating a false perception of government support and discrediting fact-checking initiatives. The network continues to launch hashtags and apply similar amplification activities to other pro-government hashtags.

“Egyptian Twitter network amplifies pro-government hashtags, attacks fact-checkers,” Digital Forensic Research Lab (DFRLab), March 23, 2023, https://dfrlab.org/2023/03/23/egyptian-twitter-network-amplifies-pro-government-hashtags-attacks-fact-checkers.