Facebook Disabled Assets Linked to Egypt and UAE-Based Firms

Two digital marketing firms conducted influence campaigns targeting the Middle East and North Africa

@DFRLab
@DFRLab
Aug 14, 2019 · 8 min read
(Source: @KaranKanishk/DFRLab)

On August 1, 2019, Facebook removed 387 assets engaged in coordinated inauthentic behavior across its platforms, some of which were connected to two digital marketing companies publishing divisive socio-political content in the Middle East.

In its announcement, Facebook stated:

“They [the Facebook assets] also frequently posted about local news, politics, elections and topics including alleged support of terrorist groups by Qatar and Turkey, Iran’s activity in Yemen, the conflict in Libya, successes of the Saudi-led coalition in Yemen, and independence for Somaliland.”

Two companies were linked to this operation: New Waves in Egypt and Newave in the United Arab Emirates (UAE). The assets targeted a local and regional audience across Egypt, the UAE, and neighboring countries in the Middle East-North Africa (MENA) region. While the private companies ran the campaigns and there was no direct connection to any state government, the assets’ anti-Qatar and anti-Muslim Brotherhood narratives, in particular, largely paralleled the political interests of Saudi Arabia, the UAE, Egypt, and Bahrain.

Campaigns promoting political and ideological content, but motivated by commercial interests, are not novel; the DFRLab previously reported on an Israeli marketing firm that orchestrated a similar far-reaching influence campaign that targeted audiences in Africa, Latin America, and Southeast Asia. This most recent takedown reinforced that marketing firms continue to command inauthentic assets on social media platforms.

New Waves, one of the firms linked to the assets, has been in operation since 2015 and is based in Egypt.

The homepage formerly known as New Waves. (Source: newwaves.club/archive)
One of the many social media services New Waves offered was “creating Facebook campains [sic].” (Source: newwave.club/archive)

Open-source analysis revealed that the individual likely behind the company, Amr Hussein, has other organizations registered under his email address.

Domains connected to Mr. Hussein (Source: DomainBigData/archive)
Azomol.org, another website whose accompanying Facebook page was also taken down, claimed that it offered social media campaigns for organizations across all industries. The website was registered under Hussein’s email address, along with several other domains. (Source: ViewDNS/archive)

While examining the pages included in the Facebook takedown, the DFRLab found multiple instances in which the Egyptian digital marketing company sought to leverage the popularity of pages that had amassed large numbers of followers to promote lesser known pages run by the firm. One of the pages, A7aassess, had been active since 2015 and had managed to gain a large amount of attention, with over 2.3 million followers at the time of the takedown.

The A7aassess Facebook page had nearly 2.4 million followers at the time of the takedown. (Source: A7aassess/Facebook)
Post on the page “A7aassess” showing a photo of Ahmed Mansi, a former commander with the Egyptian armed forces who was killed in a terror attack in 2017. The post also amplified a link to the personal blog of the owner of New Waves, Amr Hussein. (Source: A7aassess/Facebook)

New Waves leveraged A7aassess’s popularity to amplify another page, Opera Bent Araby, which was also included in the takedown, as well as amplifying Hussein’s personal blog.

Post on the popular page “A7aassess” amplifying a less popular page called “Opera Bent Araby,” also run by New Waves. (Source: A7aassess/Facebook)

The second company, Newave, was a PR and marketing firm headquartered in Abu Dhabi, according to the information on its website.

A cached image of the New Wave website’s homepage. (Source: newwave.ae/archive)

The DFRLab could not determine whether the two companies were directly related, despite their highly similar names, or whether they coordinated with one another in carrying out their influence campaigns, if they were independent of each other. The DFRLab’s assessment did, however, corroborate Facebook’s statement that the pages had more than 13.7 million followers combined.

The external websites for both of the companies disappeared following Facebook’s announcement.

Multiple pages included in the takedown pushed claims that the Qatar government had sponsored terror attacks in Somalia. This narrative originated in a story initially run by The New York Times on the bitter competition between wealthy Gulf monarchies over access and control of strategically significant resources throughout the Horn of Africa.

The New York Times report included the transcripts of a leaked phone conversation between Khalifa Kayed Al-Muhanadi, a wealthy Qatari businessman with close ties to the Qatari sheikh Tamim Al-Thani, and Hassan bin Hamza Hasham, the Ambassador of Qatar to Somalia. The conversation between the two suggested that the Qatari government may have been involved in sponsoring a terror attack in the Somali port town of Bosaso, whose port is currently operated by DP World, a Dubai-based company.

The UAE-based Newave made a concerted attempt to amplify reports of Qatar’s involvement in the terror attack via pages masquerading as regional news outlets.

One of the pages, Ahrar Al Somali, presented itself as the social media arm of an online publication called Somalianow. While the page itself included posts regarding domestic political developments in Somalia, several posts on the page amplified articles run by the publication that were overtly critical of Qatari investment in Africa, as well as articles specifically highlighting the alleged Qatar-sponsored terror attack in Somalia.

The Facebook page for “Ahrar Al Somali,” showing more than 56,000 followers. (Source: Ahrar Al Somali/Facebook)

The page gained some traction, amassing more than 56,000 followers by the time of the takedown.

Photo uploaded to the Ahrar Al Somali page that criticized the Emir of Qatar, depicting him as incompetent as well as a foreign sponsor of terrorism. (Source: Ahrar Al Somali/Facebook)
Ahrar Al Somali linked to an article on Somalianow entitled (translated) “The Parliamentary Committee questions the Minister of Foreign Affairs about the charges against the State of Qatar.” The article highlighted Qatari sponsorship of terror attacks in Somalia. (Source: @disinformediain/DFRLab via Ahrar al Somali/Facebook, left; Somalianow/archive, right)

Another one of the pages included in the takedown, Arab Efiles, presented itself as a think tank that covered “global issues and provided analytics and exclusive information.”

The Arab Efiles Facebook page had just above 300,000 followers at the time of the takedown. (Source: Arab Efiles/Facebook)
Two of the page managers of the Arab Efiles page were based in Egypt. The location for 10 other page managers was hidden. (Source: Arab Efiles/Facebook)

The page carried posts overtly political in nature, with some posts repeating allegations of Qatari sponsorship of terrorism in Africa. While some of the them did not garner much engagement from followers, overall the page had a significant audience of over 300,000 followers at the time of takedown.

A post to the Arab Efiles page alleging Qatari sponsorship of terror attacks in Somalia. The same claims were repeated by other pages included in the takedown. (Source: Arab Efiles/Facebook)

The same claim was amplified by two other pages examined by the DFRLab as part of the takedown, “All News of Kuwait” and “Türkiye şimdi.” Both of these pages presented themselves as news outlets, with a number of overtly political posts referencing political developments in the MENA region and, once again, highlighting Qatari sponsorship of terror attacks.

Post on the page “All News of Kuwait” alleging that Qatar had sponsored terrorist attacks in Somalia. The same claims were also repeated by Ahrar Al Somalia. (Source: All News of Kuwait/Facebook)

The latter of the two pages, Türkiye şimdi (“Turkey Now”), amplified an article by an online publication of the same name that alluded to Turkish and Qatari sponsorship of Al Qaeda in Libya. This page also managed to gain some traction, amassing 33,332 followers by the time of the takedown.

“Türkiye şimdi” posted an article on a digital publication by the same name. The article alluded to Turkish and Qatari state support for Al Qaeda. (Source: Türkiye şimdi/Facebook)

Three of the page managers of the “Turkiye Simdi” were based in Egypt; another eight had their location hidden. (Source: Turkiye Simdi/Facebook)

Some of the pages examined by the DFRLab furthered a narrative critical of Qatari state sponsorship for the Pan-Islamic organization the Muslim Brotherhood.

One of the pages, “PalastineAlyoum,” presented itself as a magazine. It posted several political posts, some of which denounced Qatari sponsorship of the Muslim Brotherhood while repeating the allegations of Qatari sponsorship of terror attacks in Somalia. The page garnered some attention, amassing 30,442 followers by the time of the takedown.

Three of the page managers of the “Turkiye Simdi” were based in Egypt; another eight had their location hidden. (Source: Turkiye Simdi/Facebook)

Some of the pages examined by the DFRLab furthered a narrative critical of Qatari state sponsorship for the Pan-Islamic organization the Muslim Brotherhood.

One of the pages, “Palastine Alyoum” (“Palastine Today”), presented itself as a magazine. It posted several political posts, some of which denounced Qatari sponsorship of the Muslim Brotherhood while repeating the allegations of Qatari sponsorship of terror attacks in Somalia.

Palastine Alyoum had garnered nearly 30,500 followers by the time of the takedown. (Source: Palastine Alyoum/Facebook)

The page garnered a moderate following, amassing 30,442 followers, by the time of the takedown.

One of the posts that criticized Qatar’s intervention in the MENA region, saying (in Arabic): “Qatar’s support for terrorism crosses borders and continents.” The photo featured the Emir of Qatar with an ISIS flag in the background. (Source: Palastine Alyoum/Facebook)

Another page, “Sudan Alyoum” (“Sudan Today”), shared a post describing a Sudanese-Canadian journalist’s praise for the efforts of Mohamed Hamdan Dagalo, the Deputy Head of the Transitional Military Council in Sudan, for tackling the growing radical Islamic movement, including the Muslim Brotherhood.

Facebook post that praised Sudan’s Deputy Head of the Transnational Military Council and asked for cooperation on his efforts to combat the Islamic movement. (Source: Sudan Alyoum/Facebook)

Along with the above pages, other assets removed in the takedown that focused on the Muslim Brotherhood included two with the names “Algeria Today — الجزائر اليوم,” “Kalwagy Al-Iraq — كلاوجي العراق,” and “Lebanon Al-youm.”

Much of the content posted by the assets included in the takedown cut to the heart of the current diplomatic dispute between Qatar and its Gulf neighbors. In July 2017, U.S.-based magazine The Atlantic published a story, describing how Qatari support for the Muslim Brotherhood during and after the Arab Spring drove, in large part, the Saudi-led Gulf coalition’s decision to cut all political and diplomatic ties with Doha in 2014.

One of the pages, Mowatenchinguitti (“Mauritania Today”), presented itself as a local news outlet. In April 2018, the page pushed an event intending to drive participation in a two-day nationwide doctors’ strike in Mauritania, when doctors around the country halted work to demand better hospital conditions and salary increases.

Screenshot of the event attempting to mobilize doctors to join the strike. (Source: Mowatenchinguitti/Facebook)

The discovery of another substantial influence operation carried out by digital marketing companies hot on the heels of the Archimedes takedown suggests that conducting influence campaigns represents a lucrative and in-demand service offered by unscrupulous marketing firms.

By and large, the claims made by the pages targeted as part of the takedown were unsubstantiated and politically charged in nature. By presenting some of the pages as the social media arm of local news publications, those operating the pages demonstrated a willful attempt to mislead their followers and give these politically charged narratives a veneer of objectivity.


Kanishk Karan is a Research Associate with the Digital Forensic Research Lab (@DFRLab).

Ayushman Kaul is a Research Assistant, South Asia with @DFRLab and is based in New Delhi.

Mohamed Kassab is a freelance contributor to @DFRLab and is based in Egypt.

Follow along for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade