BANNER: Journalist and activist Omar Radi waits outside court in Casablanca, Morocco, March 12, 2020. (Source: Reuters/Youssef Boudlal/File Photo)

Shortly after the European Parliament (EP) called for Morocco to release detained journalists Omar Radi, Soulaimane Raissouni, and Taoufik Bouachrine, among others, a suspicious Moroccan Twitter and Facebook network repeatedly amplified articles and posts published by pro-government media outlets attacking Radi and the EP. The network, consisting of 105 Facebook accounts, sixteen Facebook pages, and fifty-one Twitter accounts, displayed signs of possible coordinated behavior in sharing and engaging with specific content that emphasized the charges against Radi, criticized the EP and French President Emmanuel Macron, and praised Abdellatif Hammouchi, head of Morocco’s General Directorate of National Security and Territorial Surveillance. This activity gave the impression of genuine support for the Moroccan government’s response to the EP resolution.

As described in a July 2022 Human Rights Watch (HRW) report, dissidents and journalists in Morocco are exposed to threats, digital surveillance, and pro-government media attacks. The use of social media often supplements such attacks. The DFRLab previously identified a similar network of accounts on Facebook that inauthentically amplified content produced by pro-government media outlets attacking Radi, Raissouni, and other dissidents, which led Meta to take down the accounts in May 2022. The network was connected to a previous iteration, also removed by Meta in February 2021. The DFRLab has now uncovered a new network used to amplify Morocco’s response to the EP resolution. One of the Facebook accounts in the newly found network was also connected to the network Meta removed in May 2022.

On January 19, 2023, the EP adopted a resolution urging Morocco to uphold media freedoms and provide journalists jailed for politically motivated reasons with a fair trial. The EP condemned “the misuse of allegations of sexual assault” against journalists, specifically in the cases of Radi, who is serving a six-year sentence on charges of espionage and rape, in addition to Raissouni and Bouachrine, who are both serving prison sentences for alleged sexual offenses.

All three journalists are outspoken critics of the Moroccan government. Bouachrine, founder and former editor-in-chief of Akhbar Al Yaoum newspaper, regularly criticized the government in his editorials. He was charged with rape, human trafficking, and abuse of power. Raissouni, who replaced Bouachrine, was arrested two days after he published an editorial critical of Moroccan authorities. He was sentenced to five years in prison over sexual assault charges. Radi was also likely targeted because of his work as a dissident journalist and human rights defender. He has published various investigative pieces exposing corrupt officials and the country’s grim human rights record. In all three cases, similar tactics were used against the journalists as they were targeted with smear campaigns intended to discredit them. Radi was also targeted with NSO Group spyware. Human Rights Watch described the cases against the three journalists as “marred by serious violations of due process and other rights.”

The network identified by the DFRLab was active between January 17 and February 1, 2022, the period directly before and after the EP’s resolution. The network routinely amplified and engaged with content that attacked Radi and supported the Moroccan government. As of May 11, at least fifty-five of the assets are no longer on the platform.

The DFRLab identified one account on Facebook, Youssef Slimani, that is likely connected to the network Meta removed following our previous investigation, as the new account used the same name and profile picture as the removed account. (It too has now been removed.) Based on the account’s first uploaded profile picture, a useful method to determine an estimated creation date for an account, it appears the account was created around May 12, 2022.

Profiles on Facebook and Twitter displayed different indicators of inauthenticity. Of the fifty-one Twitter accounts detected, forty-five did not use a profile picture or used a stock image easily identifiable through a reverse-image search. Examples on Facebook also show similar suspicious activities. Two accounts named Rachid Elkatanie and Oussama Benyachou used the same profile picture of a landmark, with one picture being zoomed-in to appear slightly different than the other. Two other accounts, Khalid Nouali and Mohamed Reda Benani, had similar Facebook profile URLs, with one named khalid.nouali.902 and the other named khalid.nouali.750, potentially indicating the same person manages the accounts.

A query using Twitter analytics tool TruthNest found suspicious activity from all fifty-one Twitter accounts regarding their most mentioned and most retweeted users, as accounts frequently mentioned and retweeted the same pro-government media outlets, including Kafapresse, Aabbir, Al3omk.com, and Cawalisse. While all accounts in the network mentioned Kafapresse and Aabbir at least twenty times, five accounts mentioned the two outlets more than 100 times. Two accounts, @FadwaNour14 and @FatouhiKhalid, retweeted Kafapresse, Aabbir, and Cawalisse the exact same number of times during our observation period.

Other accounts also mentioned and retweeted the state-aligned media outlets many times; for example, @Karimna77139974 mentioned Kafapresse 408 times and Almoharir.com 260 times, along with more than 100 mentions for Achtari 24, Aabbir, Al3omk.com, and Cawalisse.

Further reviews of the Twitter network revealed other suspicious indicators. Through a TruthNest query to identify the percentage of tweet types based on total number of tweets, the DFRLab found that forty-three accounts had less than five percent original tweets but had higher percentages of retweets and replies; nineteen accounts did not have any original tweets. Another indicator was the low number of followers; twenty-eight accounts in the network had less than ten followers. In addition, some profiles in the network followed each other. Moreover, some accounts in the Twitter network had the same creation date. Seven accounts were created on December 12, 2020, and five accounts were created in January 2023. Three accounts were created on January 3, 4, and 5, respectively.

The DFRLab detected that some Twitter accounts appear to have parallel Facebook profiles. The DFRLab found ten accounts engaging with content from state-aligned media outlets on both Facebook and Twitter using the same names and, in some cases, the same profile picture.

In one example, an account named Anouar Belghiti on both platforms, which uses the same profile picture, replied to a tweet from 24saa reporting on a decision by Moroccan parliament to reevaluate the country’s relationship with the EP twelve minutes before sharing the same post on Facebook.

The identified network focused on sharing and engaging with content coming from media outlets, fringe news Facebook pages, and non-media pro-government Facebook pages. Some of the media outlets, also present in the DFRLab’s previous investigation, include Chouf TV, Kafapresse, Cawalisse, Express-Temara, al3omk.com, Kifache, Aabbir, Barlamane, and Marocmedias, as well as the fringe news pages السلاويين الرجـــــــــــــولة +18 (“Machismo Slaouiyine 18+”), الدكالية doukkalia (“doukkalia vault”), and سلا مدينة القراصنة +18 (“Salé, The City of Pirates 18+”) which changed its name in August 2022 from سلا مدينة الإجـــــــــــــرام +18 (“Salé, The City of Crime 18+”).

Accounts in the Facebook network often shared and engaged with content published by the Facebook pages. For example, two accounts, Nabil Soufi and Charaf Zaoui, shared within the same minute a video critical of the European Parliament posted by a page called الخبر الزاموري (“The Zamoury News”). The next day, the two accounts did the same thing, sharing a post by سلا مدينة القراصنة +18 (“Salé, The City of Pirates 18+”) about the Moroccan Judicial Club disapproving of the so-called judicial interference from the EP.

Simultaneous posting was a common pattern identified in the behavior of Facebook accounts with public profiles, as some shared the same content from the same pro-government outlets in close or identical timespans. In one example, four profiles with the same first name, Imad, shared the same post by Express-Temara within five minutes. Further, a closer look at the profiles in the network revealed that many accounts had matching timelines that included posts made in the same minute and following the same order, suggesting possible engagement and content coordination.

In several cases, possible coordination also occurred between different Facebook pages. One example is Barlamane, which published an article on its website citing the president of the Moroccan Association for Victims’ Rights, who criticized the EP resolution. On the same day, seven fringe media pages shared a link to the article using an identical caption, with two pages posting only one minute apart and two others posting two minutes apart.

A few days after the EP resolution passed, the identified media outlets and Facebook pages posted content praising Abdellatif Hammouchi, head of Morocco’s General Directorate of National Security and Territorial Surveillance, which the network then amplified. Hammouchi previously faced lawsuits in France over the alleged use of torture. A video featuring Hammouchi and promoting cooperation between Moroccan and Saudi Arabian security forces was published on January 24 by nine media outlets, fringe news pages, and non-media pages. The fringe media pages Ben M’sik Post and Sbata Times published the video in the same minute using the same caption. Other posts were published minutes apart.

The Facebook network frequently left similar and sometimes identical comments on posts made by the media outlets, fringe media, and non-media outlets, in addition to liking the posts. The network included locked Facebook accounts that left public-facing comments and likes on posts, in addition to other accounts that shared content and sometimes liked or commented on posts. For example, fringe media pages La plume news, doukkalia, El bennouria البنورية,  and Bany Milal News اخبار بني ملال published the same video accusing the EP of corruption. The account Fati Essalmaou posted four comments on each post within nine minutes, two of which were identical.

In some cases, identical comments were repeatedly left on the same post and received a similar number of likes. For example, six accounts left the exact same comment on a Facebook post stating, “It is time to change the way we deal with this dishonest and untrustworthy union.” All six comments received similar likes, with four receiving twenty-three likes, one receiving twenty-two, and another comment garnering twenty-one likes.

A similar pattern was visible on Twitter as many accounts in the network liked each other’s replies to media outlets. The account @AbdenourWenners posted four replies to tweets from the outlets Cawalisse, Karapresse, and 24saa. The account’s replies received similar number of likes, between twelve and fifteen, all by other accounts in the network. The accounts @said64426385 and @SalahTijani5 liked all four replies.

Further, many users left the same or similar comments defending Morocco on a Facebook post. Some posted, “Morocco is the country of law and justice,” while others wrote, “Morocco is the country of law, justice, and institutions.” The same comment was also posted to Twitter by five accounts replying to tweets from the media outlets Al3omk.com and Kafapresse. In addition, the Twitter account @Salhi8Rida posted three identical replies to tweets published by 24saa, Cawalisse, and Kafapresse that were critical of the EP and Macron. The tweet said, “Morocco is a sovereign country and the European Parliament should not interfere with its affairs.”

The two networks displayed several indicators of inauthentic activity that resemble the behavior of the network the DFRLab identified last year. The similar pattern could suggest an ongoing effort to use social media platforms to amplify pro-government media outlets that attack journalists and opposition viewpoints. The activity suggests a possible attempt to evade takedowns, particularly since this network includes an account using the same name and picture as a profile removed by Meta last year for recidivism; this investigation presents a possible third case of inauthentic coordinated behavior by the Morocco network. The accounts in the network appear to be coordinating to provide legitimacy to content published by established and fringe media outlets, along with non-media accounts, attacking opponents and glorifying the government.

“Dubious Moroccan Facebook and Twitter accounts boost content critical of journalist Omar Radi and European Parliament,” Digital Forensic Research Lab (DFRLab), May 11, 2023, https://dfrlab.org/2023/05/11/dubious-moroccan-facebook-and-twitter-accounts-boost-content-critical-of-journalist-omar-radi-and-european-parliament.