George Ishak during a protest in front of the High Court in Cairo in 2010. Source: Reuters

A network of twenty-seven accounts bearing multiple signs of inauthenticity launched a hashtag in 2022 targeting and attacking Egyptian human rights advocate George Ishak. The attack timeline suggests the network was activated for a short period to respond to a specific critique issued by Ishak against the Egyptian government, with the likely goal of reaching Twitter’s trending list. 

George Ishak is a member of the National Council for Human Rights (NCHR), an advisory human rights organization to the Egyptian government. He criticized the country’s prisons and human rights situation in an interview with Al Jazeera that aired on August 10, 2022. Ishak was quickly condemned for his remarks. The NCHR released an official statement calling his comments “unacceptable,” while a  TV presenter deemed the comments “baseless.” Meanwhile, parliament member Tarek Radwan criticized Ishak on the pro-government TV channel Sada El Balad. 

Despite calls for a national dialogue from Egyptian President Abdel Fattah El-Sisi and the launch of a national human rights strategy, the government has repeatedly doled harsh punishments for dissidents. A Human Rights Watch report said Egyptian authorities “failed to ease the ongoing repression campaign against critics in 2022 or repeal laws curtailing basic freedoms.” Another report from Amnesty International said that Egypt is in “the midst of a deep-rooted human rights crisis,” demonstrated by consistent repression of any dissent online and offline.  

The DFRLab analyzed a hashtag that emerged online after Ishak made his comments. The accounts promoting the hashtag demonstrated signs of possible coordination and inauthenticity, tweeting identical content amplifying the same narratives against Ishak. Tweets were often published minutes and sometimes seconds apart.  

The DFRLab examined the hashtag #جورج_اسحاق_منافق (“George Ishak is a hypocrite”), which spread denigrating narratives about Ishak. The network’s activity promoting the hashtag was short-lived, according to an analysis of tweet volume using the social media monitoring tool Meltwater Explore. This indicates that the accounts were likely activated to respond to Ishak’s critical comments before turning their attention elsewhere; the DFRLab found evidence of the network spreading narratives against other dissidents.  

The hashtag began spreading soon after Ishak’s interview with Al Jazeera and peaked on the same day with more than 4,200 mentions, accounting for nearly all traffic on the hashtag that month; beyond the immediate period surrounding Ishak’s August 2022 interview, the hashtag was not used elsewhere on Twitter over the course of 2022. According to a Meltwater Explore query, more than half of the hashtag’s activity was from retweets and quote tweets (74.3 percent) and not from original tweets (25.2 percent).

Notably, the pro-government media outlet Sada El Balad amplified the hashtag on their Twitter account and published a report on August 11 claiming the hashtag had trended on Twitter. However, trending data collected by the Trending Archive tracker and Trendinalia Worldwide reveals that the hashtag did not reach Egypt’s trending list on August 11 or 12. Further, the DFRLab found that seven of the eight retweets Sada El Balad received on their tweet came from accounts in the network. The emphasis placed on reaching the trending list could serve as an indication of the network’s goals. 

Accounts from the network amplified the hashtag in a possible attempt to construct the false perception of a broader objection to Ishak’s comments and defame the human rights advocate. All twenty-seven accounts in the network promoted a narrative that described Ishak as an agent seeking funding and a traitor to his country for trying to sabotage government progress.  

The network included several accounts with high posting rates. For example, over three days, an account named @ahmedhany21234 used the hashtag 468 times, while another account named @llmy26648159 used the hashtag 441 times. However, most of the activity occurred on August 11, 2022, when @ahmedhany21234 used the hashtag more than 298 times, and @llmy26648159 used the hashtag 305 times. Eleven accounts used the hashtag more than seventy-five times, and five accounts used the hashtag ninety-four times.  

The amplification of the hashtag attacking Ishak relied on the spread of identical content, which was sometimes posted by multiple accounts within the same minute. In one example, four accounts published the same tweet within the same minute on August 11, saying in Arabic, “George Ishak just wants dollars.”

In another example, six accounts published identical tweets, referring to Ishak as a hypocrite. The tweets were all posted minutes apart. This could indicate a copypasta campaign that was carried out manually rather than being automated.  

Some accounts also mass-retweeted content created by others. One account named @elseedymohamed5 retweeted posts containing the Ishak hashtag fifty times within two hours, with twelve retweets sent in the same minute. One minute later, the account @lyalansary1 retweeted ten tweets containing the Ishak hashtag in the same minute. 

Another indicator of possible inauthenticity present in the network was the use of alphanumeric handles that follow Twitter’s autogenerated handle formula of using the first name and a string of characters. The DFRLab found fourteen accounts with alphanumeric handles in the network. Moreover, sixteen accounts showed signs of anonymity as they used either generic profile photos of the Egyptian flag, pictures of celebrities or public figures, publicly available stock images, or did not use any profile picture. 

In one example, two accounts in the network used the same avatar of Egyptian soccer player Mohamed Salah. The names of the two accounts were also similar, with the first account using the name in English and the second account using the same name but in Arabic. The second account also used the first account’s last and first name as its handle. Three different accounts also used other pictures of Salah. 

In addition, an examination of followers revealed that eleven accounts in the network follow each other.

Since initiating this investigation, the DFRLab has observed other coordinated attacks by the network against other dissidents, media personalities, and opposition figures. The network has applied similar amplification strategies to other short-lived hashtags that attack dissidents. In addition, the DFRLab has identified newly created accounts in the network suggesting the operation is growing. The network appears to focus on specific targets and is only activated to respond to events or criticism. Moreover, the use of a pro-government media outlet to promote the hashtag and report on its activities further suggests attempts to inflate a false perception of objection to dissent. 

“Suspicious Twitter accounts promote hashtag attacking Egyptian human rights defender,” Digital Forensic Research Lab (DFRLab), March 23, 2023, https://dfrlab.org/2023/03/23/suspicious-twitter-accounts-promote-hashtag-attacking-egyptian-human-rights-defender.