Royally Removed: Facebook Takes Down Pages Promoting Saudi Interests

Saudi government-associated assets attacked the Turkish President and Qatar’s Emir, pushed anti-Iran messages

@DFRLab
@DFRLab
Aug 14, 2019 · 8 min read
(Source:@KaranKanishk/DFRLab)

On August 1, 2019, as part of a broader takedown, Facebook removed 387 assets that had “links to individuals associated with the government of Saudi Arabia” and that propagated, among other things, content designed to undermine Turkish President Recep Tayyip Erdoğan, to attack the ruling family of Qatar, and to push anti-Iran narratives to Arabic-speaking audiences.

In its announcement, Facebook also stated:

The Page admins and account owners typically posted in Arabic about regional news and political issues, including topics like the Crown Prince Mohammad bin Salman, his economic and social reform plan “Vision 2030,” and successes of the Saudi Armed Forces, particularly during the conflict in Yemen. They also frequently shared criticism of neighboring countries including Iran, Qatar and Turkey, and called into question the credibility of Al-Jazeera news network and Amnesty International.

This is not the first influence campaign with possible links to the Saudi government. Bellingcat, an independent investigative website, previously investigated social media operations conducted by Saud Al-Qahtani, a high-level adviser to Saudi Crown Prince Mohammad bin Salman (frequently referred to by his initials, “MBS”), on behalf of the royal court. This is, however, the first time that Facebook itself has directly attributed activity on its platform to somebody with connections to the Saudi government.

Facebook shared a subset of 93 assets from the set with the DFRLab. There was insufficient open-source evidence within the subset to provide conclusive attribution of this operation to the Saudi government. Nonetheless, the pages generally supported the interests of the Saudi ruling family and military.

The assassination of the U.S.-based journalist and Saudi dissident Jamal Khashoggi in Saudi Arabia’s consulate in Istanbul, Turkey, tested Saudi-Turkish diplomatic and political relations. A month after Khashoggi’s death, Erdoğan authored an op-ed in The Washington Post, where Khashoggi had worked as a columnist, in which he implicated the Saudi government in Khashoggi’s death, though he refrained from mentioning MBS directly.

The creation dates of the pages posting content about Erdoğan indicated that they were created after Khashoggi’s disappearance, suggesting the operation may have targeted Erdoğan for his vocal stance on Khashoggi’s murder.

One of the pages from the takedown, سفر برلك (“Seferbarlik”) had over 130,000 followers on Facebook and also had an associated Instagram account.

The “Seferbarlik” Facebook page had amassed 130,000 followers since its creation on November 2, 2018. (Source: Seferbarlik/Facebook)

The affiliated Instagram account, however, had a much more modest follower count.

The seferbarlik Instagram page only had about 300 followers. (Source: seferbarlik/Instagram)

The Seferbarlik Facebook page attacked Erdoğan for his stances on Israel and the conflict in Syria, among other issues. One post, for example, stated that the Turkish President was interfering with peace negotiations around the ongoing Syrian conflict.

Screenshot of a graphic with a caption stating that Erdoğan’s interference is destabilizing peace negotiations in Syria. (Source: Seferbarlik/Facebook)

Another post to the page suggested that the Turkish President was pleased to meet with Israeli officials, an inherently inflammatory statement given Israel’s pariah status for many Middle Eastern countries.

The post suggesting that the Turkish President was pleased to meet with Israeli officials. The post was also a part of an ad campaign undertaken by the page’s operators. (Source: Seferbarlik/Facebook)

The post was also included in an ad campaign instituted by the page, as Seferbarlik ran several ads intended to amplify the reach of its posts. That the page was able to amplify its posts through paid promotion suggested that the operators of the pages had financial resources available to do so.

Screenshot of ads run by the page from the Facebook Ad Archive. (Source: Seferbarlik/Facebook)

Another page, Turk Observer, spread unsubstantiated claims about the origins of the Turkish empire and culture. This page had 46,282 followers, and the page manager was based in Saudi Arabia.

The home page of Turk Observer indicated it was created on April 1, 2018, and had over 46,000 followers at the time of the takedown. (Source: Turk Observer/Facebook)
Screenshot of a post claiming that Jews and Turks have a common relationship as settlers. (Source: Turk Observer/Facebook via Facebook Translation)
Another post on the origins of the Turkish people. (Source: Turk Observer/Facebook)

While some pages focused on attacking Erdoğan or Turkey, others attacked Hamad bin Khalifa Al Thani, the former Emir of Qatar. One of these pages, الدب الداشر (“Aldobaldasherhamad”) failed to amass much engagement with its posts, as the page had only a few hundred followers.

The “Aldobaldasherhamad” page only had 172 followers and garnered limited engagement. (Source: Aldobaldasherhamad/Facebook)
Graphic of Hamad bin Khalifa Al Thani with a hashtag labeling him as a “grizzly bear.” (Source: Aldobaldasherhamad/Facebook)
Another graphic attacking Al Thani and referring to him as a “grizzly bear.” (Source: Aldobaldasherhamad/Facebook)

A reverse search of these graphics revealed that many of them had been uploaded to Pinterest by an account called qatar-press.com.

Stitched image of Pinterest profile for Qatar-press.com, which included images and captions with hashtags trolling Al Thani. (Source: @KaranKanishk/DFRLab via Pinterest/archive)

The URL associated with the Pinterest page was no longer functional, but a LinkedIn profile by the same name listed a physical address at الدوحة, 333 (“Doha”).

LinkedIn profile claiming that the office for Qatar Press had 20 employees, with a headquarters in Qatar. (Source: Qatar Press/archive)

These posts represented an attempt to malign Al Thani’s image. Tensions between Saudi Arabia and Qatar have been rising since Hamad bin Khalifa Al Thani ascended to power in Qatar in 1995, reclaiming control over the country’s foreign affairs. After the launch of Al Jazeera, a Qatari government-funded media outlet, in 1996, relations between the two countries soured, as the Saudis levied accusations that the outlet was biased against the Saudi ruling family.

Other Facebook pages, such as “FreedomIran79” and “Irantag Irantag,” carried content on Iran’s local affairs. These posts were in Arabic and English. This suggested that the pages were likely not targeting an Iranian audience, given that Farsi is the predominant language in the country.

The DFRLab earlier reported on Iran’s effort of disinformation on Saudi Arabia and the neighboring countries of the Middle East. The assets in this takedown, conversely, took on Iran by pushing a Saudi-styled political stance on the former country’s domestic and international affairs.

Overall, the pages that focused on Iran had a low audience of about 3,320 followers. While the number of followers is not the perfect metric for measuring reach of a page, it provides a decent prediction for the number of accounts that might see a post in their timeline.

One of the Iran-focused pages, Irantag Irantag, primarily served as a content amplification platform for a dedicated domain of the same name. In one case, the page posted a link to an article on an eponymous website, Irantag.net, that allegedly quoted an ally of former Iranian President Mahmoud Ahmadinejad as saying, “wait until the death of old regime leaders for any improvement.” The quote could not be verified.

The Irantag Irantag page linked to a piece on Irantag.net with an unverified quote attributed to an “Ahmadinejad ally.” The post has since been removed from the website. (Source: Irantag Irantag/Facebook)

A Google Search produced a single result for the quote: the Irantag Irantag page’s Facebook post. (Because the original post was in English, the DFRLab searched only for the English-language version.)

Reverse searching the quote produced only one result: the post by the Irantag Irantag Facebook page. (Source: Google/archive)

In at least one case, the DFRlab found typographical similarities between different pieces of content on two different pages included in the takedown.

In particular, a graphic on a page by the name of “Free Iran,” which targeted Iran, and a graphic on Aldobaldasherhamad, which targeted Al Thani, both included similar typography and had images with characteristics of Adobe Illustrator’s “Image Trace” functionality, a tool for vectorizing images. Vectorizing makes a standard photo look as if it is an artist sketch.

These graphics from two separate pages included in the takedown both had characteristics — as seen in the examples in the red boxes — of Adobe Illustrator’s “Image Trace” functionality. The typography was also similar. (Source: Free Iran/Facebook, left; Aldobaldasherhamad/Facebook, right)

While vectorizing is not uncommon, the similarities alongside the close relation of the pages within the takedown set may nevertheless indicate that the same person created graphics for the two pages.

Many of the pages from the takedown pushed a national security agenda, disguised as military support pages. One of the pages called “Alrad3sa,” with posted content on the Saudi military and the ruling family.

Home page of Alrad3sa. (Source: Alrad3sa/Facebook)

Although the Facebook page had been taken down, the page had two affiliated Twitter accounts. The first, موقع الردع السعودي (Alrad3sa), was linked on the page’s profile and had more than 337,000 followers at the time of analysis. The second Twitter account, موقع الردع السعودي (Alrad3_SA), had about 18,000 followers.

Both Twitter accounts seemed primarily devoted to military affairs and national security, sometimes amplifying Saudi propaganda against Qatar and Turkey, in particular.

The Twitter account @Alrad3_SA, which was linked to a Facebook page included in the takedown, retweeted a cartoon that depicted Al Jazeera as a sponsor of terror. (Source: Alrad3_SA/archive)

The Alrad3_SA Twitter account also directed followers to an external website, Alrd3.com. The content on the website was largely outdated but covered topics related to Middle East security and politics.

The Alrd3.com homepage, as of August 7, 2019. (Source: Alrd3.com/archive)

The DFRLab found that two additional websites shared the same domain analytics ID, which is used to track behavior across associated pages. In this case, the webpages alrd3.com, alrad3.com, and mubasher.news all had the same ID, AT-ra-571c56dbb50195af.

Three websites related to the removed assets shared the same analytics ID: “alrd3.com,” “alrad3.com,” and “mubasher.news.” (Source: @KaranKanishk/DFRLab via BuiltWith)

On Instagram, an account with the handle @mubasherna was active but had no posts. The account was not included in the initial takedown but has since been removed. On Twitter, an account with the same handle was active and posted regularly.

The Mubasherna Twitter account directed users to the external mubasher.news site, which shared the same domain analytics ID as two other websites associated with assets included in the takedown. (Source: mubasherna/archive)

The operation focused on regional audience to further bolster the support for the Saudi royal family and pushed politically charged content on leaders from neighboring countries, including President Erdoğan in Turkey and members of the Qatari royal family.

The open-source evidence did not provide conclusive attribution to the Saudi government or even somebody linked to it, as stated by Facebook in its announcement, but the DFRLab found that the content on the pages nonetheless reflected the royal family’s interests on a range of issues.

The effectiveness of these influence campaign is hard to determine. The DFRLab found a network of sockpuppet amplifiers, however, that cross-posted content to amplify content directed at their followers.

Saudi sockpuppet accounts that amplified the same content at the same time for their own audience in order to further boost engagement with the pages. (Source: @KaranKanishk/DFRLab via Facebook)

This tactic demonstrates the pages and groups not only relied on their own audience but deployed accounts to further push content across the associated assets. As the first takedown by a major social media platform of assets linked to somebody affiliated with the Saudi government, as attributed by Facebook, this takedown provided valuable insight into online influence tactics undertaken on behalf of the country.


Kanishk Karan is a Research Assistant with the Digital Forensic Research Lab.

Follow along for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade