BANNER: Screenshot of Saud Al-Qahtani’s suspended Twitter account. (Source: @saudq1978/Twitter)

A network of twenty-eight pro-Saudi Arabia Twitter accounts appear to be coordinating to amplify a call for Elon Musk to reinstate the Twitter account of Saud Al-Qahtani, a close advisor to Saudi Arabia’s Crown Prince Mohammed bin Salman (MBS). Al-Qahtani is accused of orchestrating the 2018 murder of Saudi journalist Jamal Khashoggi. The mostly anonymous accounts displayed a pattern of using similar text and graphics to promote Al-Qahtani and the kingdom. The accounts amplified content that promotes Saudi Arabia, including tourism, its role in Ukraine mediation, and hosting Expo 2030.

Twitter permanently suspended Al-Qahtani’s account in 2019 for violating the platform’s manipulation policies. Al-Qahtani led efforts to target, harass, and spy on Saudi dissidents. Critics have dubbed him “lord of the flies” for reportedly overseeing an electronic army of accounts known to swarm their targets.

An investigation published in June by The New Arab identified several accounts calling for Musk to reinstate Al-Qahtani’s account. The Twitter activity took off after a video of Al-Qahtani emerged online on June 18, his first public appearance since 2018, when news broke of his alleged involvement in the murder of Khashoggi. The New Arab highlighted two accounts that were among the first to call for Al-Qahtani’s reinstatement. One of the identified accounts is the Riyadh-based verified Twitter influencer @AbdullahK5, who has 2.8 million followers and received favorable replies about Al-Qahtani in his Twitter post. The other account identified by The New Arab, @Motekar72, called for Al-Qahtani’s reinstatement as early as November 2022. The account claimed to be a government employee from West Java, Indonesia, however, The New Arab debunked this claim.

The DFRLab independently found a network similar to the one identified by The New Arab. The accounts in our network did not interact with the accounts identified by The New Arab. The accounts identified by the DFRLab engaged in what appears to be coordinated inauthentic behavior to call for Al-Qahtani’s reinstatement and to amplify pro-Saudi content. The DFRLab’s findings focused on posts between July and August 2023, which did not overlap with the accounts identified in The New Arab’s investigation.

Under the leadership of Musk, Twitter has reinstated controversial figures previously banned from the platform, such as former professional kickboxer Andrew Tate, US Rep. Marjorie Taylor Greene, rapper Kanye West, and former US President Donald Trump. Reinstating the accounts of individuals who violated the platform’s policies has allowed malicious actors to take advantage of the change in Twitter’s leadership to adapt their manipulation tactics, as seen in this case, without fear of consequences.

In Twitter’s September 2019 announcement on the permanent suspension of Al-Qahtani’s account, the platform said that it had “detected a small group of six accounts linked to Saudi Arabia’s state-run media apparatus which were engaged in coordinated efforts to amplify messaging that was beneficial to the Saudi government.” Three months later, Twitter announced the removal of 5,929 accounts engaged in “state-backed information operation on Twitter originating in Saudi Arabia” that were part of a more extensive network of “more than 88,000 accounts engaged in spammy behavior across a wide range of topics.”

In April 2020, Twitter announced the removal of 5,350 accounts linked to Saudi Arabia and operating out of Saudi Arabia, Egypt and the United Arab Emirates. The network amplified “content praising Saudi leadership, and critical of Qatar and Turkish activity in Yemen.”

In October 2020, Twitter removed thirty-three accounts with ties to the Saudi government that impersonated Qatari politicians.

The DFRLab identified twenty-eight Twitter accounts that appear to be promoting similar messages across different topics, including reinstating Al-Qahtani’s account. The accounts employed a technique in which they post similar, but not identical, content –which appears to be an attempt to avoid detection. However, some identified accounts tagged Musk’s Twitter handle in their tweets. The accounts tweeted primarily in English, indicating they were targeting an international audience.

The identified accounts shared messages expressing confusion regarding the reason for Al-Qahtani’s suspension. The account @LafiOtb98, created in June 2021, tweeted on August 7, 2023, “I can’t understand why this account got suspended was my number 1 Twitter account, I wish to see Saud Al-Qahtani’s account tweeting again.” Many other accounts argued for his reinstatement by noting his one million followers or describing Al-Qahtani as “a very loved person” who “enjoys great love and respect from Saudis.”

Another prevalent narrative used to defend Al-Qahtani and make the case for his return to Twitter was built around the 2018 Guinness World Record that he accepted on behalf of the kingdom when he served as the Head of the Federation for Cybersecurity, Programming, and Drones. Accounts shared a photo of him accepting the award and praised his contribution to Saudi Arabia, with some falsely and vaguely claiming the award was granted for Saudi Arabia’s cyber security efforts. In actuality, the photo is from a 2018 hackathon held in Jeddah, which aimed to create technology that can make the Hajj experience more comfortable for pilgrims. The event broke the Guinness World Record for the largest hackathon in the world.

The network also posted pro-Saudi content unrelated to Al-Qahtani. These posts often promoted the kingdom’s tourism, efforts to combat climate change, and the country’s bid to host Expo 2030. For example, four accounts posted similar clips from a video that showed MBS in Paris attending Saudi Arabia’s official reception for its bid to host the World Expo 2030. Three of the four tweets were posted minutes apart, with one tweet sent at 10:52 pm Gulf Standard Time (GST), another at 10:53 pm, and the third at 10:55 pm, suggesting possible coordination between the accounts. The fourth tweet was sent at 11:12 pm.

In another example, three accounts promoted tourism in Saudi Arabia by reposting a video from the TikTok account of Finnish influencer @blueabaya. The accounts posted the video on different days in August 2023 but used similar captions.

Moreover, accounts in the network frequently published similar generic content separate from their pro-Saudi content, possibly to appear more authentic. In one example, the accounts @aljhilan and @Mansour76892984 tweeted the same video from an animated short film seconds apart at 3:12 pm GST on August 14, 2023. Accounts also often retweeted the same content.

While the network bears various signs of inauthenticity, the most prevalent is the use of publicly available photos for profile photos. At least twenty accounts used stock or stolen photos easily identifiable using reverse image tools like Yandex and TinEye. In one example, an account used the picture of a real Instagram user with a public profile. Another account with a high posting rate for pro-Saudi tweets appears to have stolen its profile picture from another Twitter user’s April 2022 post.

In addition to posting original tweets, at least four accounts replied to tweets critical of Saudi Arabia and defended the kingdom. They also replied to tweets praising the Gulf country with supportive text. The account @Naifalsalem5 used similar text to defend Saudi Arabia in replies to tweets by Human Rights Watch (HRW) and Reuters about a report accusing Saudi Arabia of killing “hundreds of Ethiopian migrants and asylum seekers who tried to cross the Yemeni-Saudi border.”

Prince Alwaleed bin Talal, a Saudi businessman and chairman of the Kingdom Holding Company (KHC), is the second largest Twitter investor, owning roughly 4% of the company’s shares. Prince Alwaleed maintained his shares following Musk’s takeover of the company. In 2017, Prince Alwaleed was detained during the Saudi purge that saw elites kept under house arrest at the Ritz Carlton; soon after, he sold 16.87 % of KHC to the Public Investment Fund (PIF), which has been linked to human rights abuses. This transfer links the Crown Prince of Saudi Arabia to the ownership of the social media platform that Saudi Arabian authorities use to target and imprison Saudi citizens for voicing their opinions.

In 2019, the United States charged former Twitter employees for using their access to company data and users’ personal information to spy on dissidents on behalf of the Saudi government. One of the accused, dual US-Lebanese national Ahmad Abouammo, was found guilty in 2022 in a US court of spying on dissidents for Saudi Arabia in exchange for more than $300,000 paid by Badr Al-Asaker, an aid of MBS. The other two accused, Ali Alzabarah and Ahmed Almutairi, are Saudi nationals believed to be in Saudi Arabia currently; both are on the FBI’s wanted list for “acting as an unregistered agent of a foreign government.” Bader Al-Asaker, who facilitated funding for the Twitter spying operation, maintains a verified Twitter account with more than two million followers and lists in his bio the position of “Head of The Private Office of HRH [His Royal Highness] The Crown Prince.”

Al-Qahtani’s supporters appear to have taken note of the changing winds at Twitter. They seem to be taking advantage of the platform’s relatively relaxed policies and its new owner’s laissez-faire attitude towards inauthentic coordinated behavior. In August 2023, Musk remained silent after Saudi Arabia sentenced retired Saudi teacher Muhammad al-Ghamdi to death over his activity on Twitter and YouTube. It remains unclear whether Twitter will reinstate Al-Qahtani’s account.

Dina Sadek, “Suspicious Twitter accounts promote Saudi Arabia, call for reinstating Saud Al-Qahtani,” Digital Forensic Research Lab (DFRLab), October 4, 2023, https://dfrlab.org/2023/10/03/suspicious-twitter-accounts-promote-saudi-arabia-call-for-reinstating-saud-al-qahtani.