Pages, groups, and accounts masqueraded as regional news outlets in a coordinated effort

In a coordinated information operation, dozens of Facebook assets associated with the Egyptian newspaper El Fagr masqueraded as regional news outlets and amplified content on domestic news and political topics.

In all, Facebook removed 163 Facebook accounts, 51 pages, 33 groups, and four Instagram accounts for coordinated inauthentic behavior originating from Egypt.

In its announcement, Facebook stated:

The people behind this activity used fake accounts — some of which had previously been disabled by our automated systems — to manage Pages posing as independent local news organizations, post in Groups, amplify their content and drive people to off-platform domains. Some of these Pages appear to be purchased and some changed names over time […] Although the people behind this activity attempted to conceal their identities, our investigation found links to an Egyptian newspaper El Fagr.

A majority of the removed pages posted content about Egyptian politics, praising the current government led by President Abdel Fattah el-Sisi and denouncing the Muslim Brotherhood for sowing chaos in Egypt. The pages also pushed narratives casting cooperation between Egypt and Saudi Arabia in a positive light, while simultaneously spreading messages critical of Qatar, Turkey, Iran, and the Houthi movement in Yemen.

The DFRLab found evidence of coordination among the pages, including identical posts within a short timeframe as well as connections to El Fagr Editor-in-Chief Mostafa Thabet. Separately, frequent changes to the names of the pages suggested that they may have been purchased and repurposed as part of this operation.

Heavily pro-Egyptian government

Among the removed assets, the DFRLab found only praise or positive spin for Egypt’s leadership, including posts that highlighted President el-Sisi’s role in developing higher education and scientific research and implementing the comprehensive health insurance system. The pages also portrayed the President as a leader who always listens to his people.

The posts above appear to have been timed to coincide with the recent protests against el-Sisi.

Inauthentic behavior

The DFRLab’s investigation corroborated Facebook’s finding that the removed pages were linked to the Egyptian newspaper El Fagr, an Arabic language weekly newspaper established in 2005 in Egypt and belonging to Al-Fagr for Printing and Publishing, Inc. The newspaper mainly covers domestic Egyptian politics and has an online presence that consists of a dedicated website and accounts on several social media platforms, such as LinkedIn and Twitter.

In addition to its coverage of Egyptian politics, El Fagr conducted a politically motivated social media campaign via its associated Facebook pages that targeted Qatar using the hashtag #Qatar_is_the_sponsor_of_terrorism. It published several articles about the high death rates of construction workers in Qatar forced to work extra hours on infrastructure projects. The newspaper also pushed a narrative that the Qatari public has suffered significant economic losses as a result of the diplomatic and trade blockade by Saudi Arabia, Bahrain, the United Arab Emirates, and Egypt that started in mid-2017.

El Fagr also spread content on Turkey’s declining economic situation, placing much of the blame on Turkish Prime Minister Recep Tayyip Erdogan. The outlet also accused Turkey of financing Boko Haram in Nigeria, claiming that it had supplied the terrorist group with weapons.

Facebook also removed the official page of El Fagr’s editor-in-chief, Mostafa Thabet. The page had over 3 million followers, and the page transparency section showed that it had changed its name three times.

The initial name of the page was Dr. Bassem Youssef. From 2011 until 2013, Youssuf hosted the popular Egyptian satire TV show “Al Bernameg,” which he patterned off of the U.S. TV show “The Daily Show with Jon Stewart” and used as a high-visibility platform from which to criticize the country’s ruling elite. Due to the growing pressure on the show and the channel airing his show by Egyptian officials, Youssef suspended his show in June 2014 and eventually left the country. Remarkably, the page changed its name in July 2014 to “Dr. Bassim Samra,” after one of the most popular, award-winning Egyptian actors. These changes may indicate that page administrators were trying to grow its audience by changing the name and purpose of the page.

While examining one of the removed pages associated with El Fagr, طامية مشاكل وحلول (“Tamiya problems and solutions”), the DFRLab found that Thabet likely also operated an account under the name “Mostafa Thabet Mohamed” that has since been removed.

To connect the disabled account to the other Thabet-related assets, the DFRLab found an article indicating that, along with his role with El Fagr, Thabet is also an advisor to the president of Fayoum University. In a post published on August 5, 2018, the operator of the disabled account congratulated the university on obtaining its ISO certificate. While the connection is imperfect, the reference to the same university alongside the same name nevertheless suggested that the disabled account may have belonged to the same Mostafa Thabet.

Both Thabet’s previously removed account and the one removed as a part of this takedown posted to the “Tamiya problems and solutions” page.

Thabet also posted content to his page criticizing Qatar, accusing it of financing the “terrorist” Houthis, the rebel movement fighting the Saudi-led coalition in Yemen.

Amplifiers of El Fagr content

Some of the removed pages appeared to serve predominantly as content amplification platforms for El Fagr content. A portion of these pages dealt explicitly with political content, while the remainder primarily posted on various lifestyle topics, including sports and entertainment.

Targeting other countries

A significant portion of the inauthentic pages associated with El Fagr focused on various other countries in the Middle East and North Africa, including Yemen, Somalia, Sudan, Tunisia, and Saudi Arabia. These pages masqueraded as independent local and regional outlets, even though they were linked to El Fagr and run by page administrators in Egypt.

The pages often posted external links to news stories published on their respective eponymous websites. Upon examining the content, the DFRLab found direct links between these pages and El Fagr, particularly with Mostafa Thabet. For instance, Sudan News 365, Gulf 365, and Saudi News 365 published anti-Qatar posts that were identical to posts on Thabet’s Facebook page, all within a very short timeframe of one another. The timeframe within which these identical posts were published — often a span of just minutes, with some posts being published within the same minute by different pages — indicated a high degree of coordination.

From Sudan to Somalia and Yemen

Many of the pages that focused on Sudan were created in December 2018 and pushed narratives against Qatar while amplifying El Fagr’s content. These pages had follower counts ranging from 90 to 17,000, and their posts amassed little to no engagement.

Some pages in the Yemen-focused set targeted the Qatar 2022 World Cup in particular, sharing the same content within a short time interval of 2–3 minutes and suggesting that the page operators coordinated their posts.

In yet another indicator of inauthentic activity, the DFRLab found that all of the pages were managed from Egypt, as well as that some of the pages had changed their names on numerous occasions.

Sometimes, a page’s final name differed drastically from its initial name. The frequent name changes may indicate that the pages had changed owners, that they were purchased for the purposes of this operation, or that the page operators had intended to deceive an initial audience as to what sort of content the pages would post.

Conclusion

Facebook attributed a majority of the removed pages to the El Fagr newspaper, which the DFRLab corroborated. These pages primarily amplified El Fagr content targeting Qatar, Iran, and the Houthi movement in Yemen, while supporting the Egyptian government under el-Sisi.

Some of the pages were rather obvious in their connection to El Fagr, as they included “El Fagr” in their names. Others, however, masqueraded as regional news outlets and linked to external websites. Many of these deceptive pages, however, still shared El Fagr content and had page managers based in Egypt, as opposed to their target country.

This operation was ideologically motivated in nature, as the content aimed to discredit Egypt’s regional rivals while encouraging cooperation with its allies. While Facebook disabled the accounts of some of these actors, it left up others.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.