Banner: UNRWA headquarters in Gaza City, September 19, 2018. (Source: REUTERS/Ibraheem Abu Mustafa)

This piece was written in collaboration with other members of the DFRLab team.

The DFRLab has identified more than 130 suspicious X accounts that have the hallmarks of a coordinated and targeted effort to amplify allegations against the United Nations Relief and Works Agency (UNRWA) accusing it of employing members of Hamas involved in its October 2023 surprise attack on Israel. The accounts began the campaign in the wake of reports from the New York Times andWall Street Journal regarding an Israeli intelligence dossier alleging that 10 percent of UNRWA staff in Gaza have ties to Hamas, and that at least a dozen employees were directly involved in the attack.

The identified accounts exhibited multiple indicators coordinated inauthentic behavior, including overlapping account creation dates; consistent naming conventions; consistent use of stock images; and verbatim or near-identical text, sometimes published within the same minute.  While the network of accounts targeted many different users, a large majority of them published replies to the official Twitter accounts of US politicians, including President Joe Biden, Vice President Kamala Harris, and various members of Congress.

“I was personally horrified by these accusations,” noted UN Secretary General António Guterres in a January 31, 2024 tweet. The UN terminated the contracts of nine employees and launched an investigation into their staff’s alleged involvement.

As a result of Israel’s allegations against UNRWA, a number of countries, including the United States, announced they would withhold funding to the UN agency, which provides humanitarian services to 5.9 million Palestinians in Gaza, the West Bank, and in refugee camps across the region.

According to the Journal report, “The dossier is the most detailed look yet at the widespread links between the Unrwa employees and militants. It offers telling details regarding the events of Oct. 7.” The New York Times report noted that two Western officials confirmed they had been briefed on the dossier but not yet verified it. “Although the United States has yet to corroborate the Israeli claims itself, American officials say they found them credible enough to warrant suspending aid,” it added. Additionally, US Secretary of State Antony Blinken also described Israel’s accusations against UNRWA as “highly, highly credible” during a press conference. Several news outlets, including The Daily Beast, UK broadcaster Channel 4, and France 24 have raised questions about the evidence, however.

More than 27,000 Palestinians have been killed since the start of the current conflict, according to Gaza health officials, while more than 85 percent of Gaza’s 2.3 million population has been displaced. UN officials expressed concern that cuts to UNRWA funding would be felt by the civilian population within a matter of weeks, with the UN Special Rapporteur on the Right to Food stating that “famine is now inevitable.”

An initial analysis of the inauthentic network suggests it achieved limited amounts of user engagement, but this assessment may change as the DFRLab continues to identify additional accounts, including new ones, believed to be involved in the campaign.

The network in question posted about a range of topics but recently pivoted to highlighting accusations against UNRWA. Previously, the network amplified criticism of Hamas, criticism of Ivy League universities in the United States, calls for the release of hostages, discussions regarding Russia and Iran’s responsibility in the Gaza war, and requests for Egypt to open its borders to residents of Gaza.

According to X data collected using the social media monitoring tool Meltwater Explore, many of these narratives were widely shared in replies to different popular accounts, including journalists, politicians, and influencers. For example, three accounts posted the verbatim text, “6 UNRWA workers infiltrated Israel during Hamas attack, causing casualties. Can’t believe it happened,” more than twenty times on January 30, 2024. In another example of spam behavior, the account @WalkerNath99682 posted the same reply twenty-eight times on January 17, 2024. Each reply included a post from @agenda_non.

The majority of the identified accounts interacted with and reposted context from two X accounts, @agenda_non and @mrl_alliance, whose websites were hosted on the same server, as previously reported by researcher and academic Marc Owen Jones. The accounts market themselves as news sources and magazines. They are responsible for a number of popular posts containing Israel-aligned narratives that were reposted and utilized by accounts in the network replying to the accounts of politicians, journalists, and others. The two accounts follow a limited number of accounts, however, a significant number of those accounts are of US politicians reflecting their possible targeting strategy.

On February 1, over eighty accounts distributed verbatim posts claiming that 10 percent of UNRWA staff were linked to terror groups. These posts also featured a link to a post by @agenda_non that included a screenshot from the Wall Street Journal report. In total, these accounts republished the post more than 250 times in one day, often in the form of replies to journalists and politicians. For example, the accounts @BryantBria36852, @MartinezPa45247, and @lopez_josh98990 all posted verbatim text within one minute of each other in the form of replies to US Rep. Ritchie Torres (D-NY), Sen. Jeff Merkley (D-OR), and British-American journalist Mehdi Hassan, respectively.

Other US politicians were targeted with messaging from the network, often repeatedly and using extremely similar language. In one instance, a post by Rep. Frederica S. Wilson (D-FL) received nine similar replies over the course of November 29, 2023.

Among the top reposted and interacted with posts by accounts in the network is a short video from a congressional hearing in December showing US Congressional Representative Elise Stefanik questioning then University of Pennsylvania President Elizabeth Magill over student protests. Two accounts in the network, @HughesThom10542 and @LopezJonat82050, who had larger followings than most of the identified accounts, posted the video minutes apart. The posts were critical of US Ivy League schools and called for the universities to stand against purported calls for the genocide of Jewish people. University campuses have become flashpoints in the United States for discussion, and protest, of the Israel-Palestine conflict. Both posts received multiple reposts, likes, and similar replies from accounts within the network, many of which were posted minutes apart. In replies to one of the two posts, @RwbynMykl67367 and @MorrisDani63110 posted the same reply in the same minute, writing, “I wholeheartedly agree. The suffering caused by these crimes is unacceptable, and we must take a stand against them.” Within the same minute, another account, @PattersonF30724 posted an almost identical reply, but with variations on the last few words.

Another post that received engagement from accounts in the network was from @MartinA95368060, asking why Egypt won’t allow “Palestinians to get out of Gaza.” Among the replies were posts tagging the Embassy of Egypt in the United States.

The DFRLab found a total of 114 accounts that demonstrated multiple signs of inauthenticity and possible coordination. Almost all of the accounts shared creation dates with others in the network. An analysis using Twitter ID Finder revealed that 111 accounts had been created on either September 25 or September 28, 2023, some within minutes of each other. Of the remaining three accounts, one first appeared on October 25, while the other two accounts were created the following day.

Notably, several of the identified accounts’ first posts on X referenced religious affiliation and beliefs such as @ButlerJuan76763, @JamesGeral9694, @wood_frank52829, @WalkerDani80143, and @JenkinsZac43615 describing their Christian and Jewish faiths. Some of these posts included descriptions of their gender identity with one identifying as a “a middle-aged African American woman” while using a male name and an avatar of a Black man, another identified as a “Jewish man” while using a female display name and avatar, another identified as a “white American man” yet had an avatar of a Black man.

Moreover, a reverse image search of the accounts’ avatars revealed that 108 out of 114 of them utilized publicly available stock images, including photos depicting Black, Latinx, and Jewish individuals and celebrities. In one example, the account @PhillipsAn54314 used an image that also appeared in multiple search results on Yandex, many of which used variants of the derogatory description “Curly Hair Jew” for search engine optimization purposes.

Several accounts, such as @TorresKyle53947, @DTyler73090, and @PowellGreg88984, also used the same stolen avatars. In this example, all three accounts used the same picture of the late Broadway performer Kyle Jean-Baptiste.

A closer inspection of the accounts’ handles and display names also revealed certain patterns. In addition to all accounts using alphanumeric handles, some of them also shared the same display name. For example, ten accounts in the network used the name “Rachel Cohen,” while two accounts, @RogersLarr98926 and @RogersLarr40228, used the name “Rogers Larry” in an abbreviated form.

Overall, the network’s posts on X received relatively limited engagement. This might indicate that the network has not been successful in attracting an audience beyond reposts and replies coming from within the network. The DFRLab continues to identify new accounts affiliated with the network, however, which may shed further light on the techniques used to influence public opinion and broaden our understanding of its potential impact.

Dina Sadek et al, “Suspicious accounts on X amplify allegations against UNRWA,” Digital Forensic Research Lab (DFRLab), February 14, 2024, https://dfrlab.org/2024/02/14/suspicious-accounts-on-x-amplify-allegations-against-unrwa.