Two digital marketing firms conducted influence campaigns targeting the Middle East and North Africa

On August 1, 2019, Facebook removed 387 assets engaged in coordinated inauthentic behavior across its platforms, some of which were connected to two digital marketing companies publishing divisive socio-political content in the Middle East.

In its announcement, Facebook stated:

“They [the Facebook assets] also frequently posted about local news, politics, elections and topics including alleged support of terrorist groups by Qatar and Turkey, Iran’s activity in Yemen, the conflict in Libya, successes of the Saudi-led coalition in Yemen, and independence for Somaliland.”

Two companies were linked to this operation: New Waves in Egypt and Newave in the United Arab Emirates (UAE). The assets targeted a local and regional audience across Egypt, the UAE, and neighboring countries in the Middle East-North Africa (MENA) region. While the private companies ran the campaigns and there was no direct connection to any state government, the assets’ anti-Qatar and anti-Muslim Brotherhood narratives, in particular, largely paralleled the political interests of Saudi Arabia, the UAE, Egypt, and Bahrain.

Campaigns promoting political and ideological content, but motivated by commercial interests, are not novel; the DFRLab previously reported on an Israeli marketing firm that orchestrated a similar far-reaching influence campaign that targeted audiences in Africa, Latin America, and Southeast Asia. This most recent takedown reinforced that marketing firms continue to command inauthentic assets on social media platforms.

New Waves from Egypt and the UAE

New Waves, one of the firms linked to the assets, has been in operation since 2015 and is based in Egypt.

Open-source analysis revealed that the individual likely behind the company, Amr Hussein, has other organizations registered under his email address.

While examining the pages included in the Facebook takedown, the DFRLab found multiple instances in which the Egyptian digital marketing company sought to leverage the popularity of pages that had amassed large numbers of followers to promote lesser known pages run by the firm. One of the pages, A7aassess, had been active since 2015 and had managed to gain a large amount of attention, with over 2.3 million followers at the time of the takedown.

New Waves leveraged A7aassess’s popularity to amplify another page, Opera Bent Araby, which was also included in the takedown, as well as amplifying Hussein’s personal blog.

The second company, Newave, was a PR and marketing firm headquartered in Abu Dhabi, according to the information on its website.

The DFRLab could not determine whether the two companies were directly related, despite their highly similar names, or whether they coordinated with one another in carrying out their influence campaigns, if they were independent of each other. The DFRLab’s assessment did, however, corroborate Facebook’s statement that the pages had more than 13.7 million followers combined.

The external websites for both of the companies disappeared following Facebook’s announcement.

Allegations of Qatari Sponsorship of Terrorism in Africa

Multiple pages included in the takedown pushed claims that the Qatar government had sponsored terror attacks in Somalia. This narrative originated in a story initially run by The New York Times on the bitter competition between wealthy Gulf monarchies over access and control of strategically significant resources throughout the Horn of Africa.

The New York Times report included the transcripts of a leaked phone conversation between Khalifa Kayed Al-Muhanadi, a wealthy Qatari businessman with close ties to the Qatari sheikh Tamim Al-Thani, and Hassan bin Hamza Hasham, the Ambassador of Qatar to Somalia. The conversation between the two suggested that the Qatari government may have been involved in sponsoring a terror attack in the Somali port town of Bosaso, whose port is currently operated by DP World, a Dubai-based company.

The UAE-based Newave made a concerted attempt to amplify reports of Qatar’s involvement in the terror attack via pages masquerading as regional news outlets.

One of the pages, Ahrar Al Somali, presented itself as the social media arm of an online publication called Somalianow. While the page itself included posts regarding domestic political developments in Somalia, several posts on the page amplified articles run by the publication that were overtly critical of Qatari investment in Africa, as well as articles specifically highlighting the alleged Qatar-sponsored terror attack in Somalia.

The page gained some traction, amassing more than 56,000 followers by the time of the takedown.

Another one of the pages included in the takedown, Arab Efiles, presented itself as a think tank that covered “global issues and provided analytics and exclusive information.”

The page carried posts overtly political in nature, with some posts repeating allegations of Qatari sponsorship of terrorism in Africa. While some of the them did not garner much engagement from followers, overall the page had a significant audience of over 300,000 followers at the time of takedown.

The same claim was amplified by two other pages examined by the DFRLab as part of the takedown, “All News of Kuwait” and “Türkiye şimdi.” Both of these pages presented themselves as news outlets, with a number of overtly political posts referencing political developments in the MENA region and, once again, highlighting Qatari sponsorship of terror attacks.

The latter of the two pages, Türkiye şimdi (“Turkey Now”), amplified an article by an online publication of the same name that alluded to Turkish and Qatari sponsorship of Al Qaeda in Libya. This page also managed to gain some traction, amassing 33,332 followers by the time of the takedown.

Three of the page managers of the “Turkiye Simdi” were based in Egypt; another eight had their location hidden. (Source: Turkiye Simdi/Facebook)

Hostile Narratives Targeting the Muslim Brotherhood

Some of the pages examined by the DFRLab furthered a narrative critical of Qatari state sponsorship for the Pan-Islamic organization the Muslim Brotherhood.

One of the pages, “PalastineAlyoum,” presented itself as a magazine. It posted several political posts, some of which denounced Qatari sponsorship of the Muslim Brotherhood while repeating the allegations of Qatari sponsorship of terror attacks in Somalia. The page garnered some attention, amassing 30,442 followers by the time of the takedown.

Hostile Narratives Targeting the Muslim Brotherhood

Some of the pages examined by the DFRLab furthered a narrative critical of Qatari state sponsorship for the Pan-Islamic organization the Muslim Brotherhood.

One of the pages, “Palastine Alyoum” (“Palastine Today”), presented itself as a magazine. It posted several political posts, some of which denounced Qatari sponsorship of the Muslim Brotherhood while repeating the allegations of Qatari sponsorship of terror attacks in Somalia.

The page garnered a moderate following, amassing 30,442 followers, by the time of the takedown.

Another page, “Sudan Alyoum” (“Sudan Today”), shared a post describing a Sudanese-Canadian journalist’s praise for the efforts of Mohamed Hamdan Dagalo, the Deputy Head of the Transitional Military Council in Sudan, for tackling the growing radical Islamic movement, including the Muslim Brotherhood.

Along with the above pages, other assets removed in the takedown that focused on the Muslim Brotherhood included two with the names “Algeria Today — الجزائر اليوم,” “Kalwagy Al-Iraq — كلاوجي العراق,” and “Lebanon Al-youm.”

Much of the content posted by the assets included in the takedown cut to the heart of the current diplomatic dispute between Qatar and its Gulf neighbors. In July 2017, U.S.-based magazine The Atlantic published a story, describing how Qatari support for the Muslim Brotherhood during and after the Arab Spring drove, in large part, the Saudi-led Gulf coalition’s decision to cut all political and diplomatic ties with Doha in 2014.

Mobilizing an Online Audience

One of the pages, Mowatenchinguitti (“Mauritania Today”), presented itself as a local news outlet. In April 2018, the page pushed an event intending to drive participation in a two-day nationwide doctors’ strike in Mauritania, when doctors around the country halted work to demand better hospital conditions and salary increases.

Conclusion

The discovery of another substantial influence operation carried out by digital marketing companies hot on the heels of the Archimedes takedown suggests that conducting influence campaigns represents a lucrative and in-demand service offered by unscrupulous marketing firms.

By and large, the claims made by the pages targeted as part of the takedown were unsubstantiated and politically charged in nature. By presenting some of the pages as the social media arm of local news publications, those operating the pages demonstrated a willful attempt to mislead their followers and give these politically charged narratives a veneer of objectivity.

Mohamed Kassab is a freelance contributor to @DFRLab and is based in Egypt.

Follow along for more in-depth analysis from our #DigitalSherlocks.