UAE Facebook pages targeted Qatar and Muslim Brotherhood

The multi-regional operation spread anti-Qatar content online and attacked the Muslim Brotherhood

@DFRLab
@DFRLab
Oct 15, 2019 · 5 min read
(Source: @KaranKanishk/DFRLab)

On October 3, 2019, Facebook removed dozens of assets operated by a for-profit marketing firm and originating in the United Arab Emirates (UAE) from its platform for engaging in coordinated inauthentic behavior.

According to Facebook’s statement, the pages ran operations with the aim of “artificially increas[ing] engagement” in several countries, with a focus on the Middle East-North Africa region. In terms of content, many of the assets disseminated messaging critical of the Qatari government, along with criticism of the Muslim Brotherhood.

Facebook attributed some of the assets to Charles Communication Pvt, Ltd., a UAE-based marketing firm. The DFRLab’s investigation corroborated that attribution and further suggested that the company had carried out its multiregional influence operation by delegating portions of it to actors based outside of the UAE.

The operation

Facebook pages according to target countries. (Source: @KaranKanishk/DFRLab)

Many of the pages were run by page managers who were not based in the target country. The page managers for both Afghan AtoZ and PulsaIndonesia, for example, were located in India and the Philippines.

Page Transparency sections for four of the removed pages. (Source: Facebook)

A LinkedIn search for Charles Communications revealed that the company was registered in India as a one-person company with offices in the Philippines, India, and the UAE. This finding raises the possibility that the operation may have been controlled by individuals based in several countries, operating under a single company name.

According to Charles Communications’ LinkedIn page, the company has offices in three locations. (Source: LinkedIn)

Charles Communications’ registration information in India further confirmed that the company had only a single employee and lacked significant assets. The lack of any further information provided by Charles Communications indicated that it was poorly organized and managed or, alternatively, that it might be intentionally disguising its operations.

Charles Communications’s entry in the Indian Ministry of Corporate Affairs’ registry. (Source: Instafinancials)

Over the course of the DFRLab’s investigation and following Facebook’s announcement of the takedown, the Charles Communication website re-branded and ultimately ceased operation, all within a period of five days. This sort of re-branding or overall abandonment is common for disinformation contractors following exposure; after Facebook removed many of its assets, Israeli firm the Archimedes Group appeared to cease operations and its website went offline.

Charles Communications website over the course of five days went from re-branding (top right) to offline completely (bottom right). (Source: charlescomms.com)

Information on the external domains pushed by these pages was limited, but according to an investigation by Buzzfeed, some of the domains that the assets promoted were connected to an Indian PR firm, Matrix Media Solutions, which is based in Kolkata.

According to Buzzfeed, the website was registered to the company’s general manager. While it is not clear to what extent Charles Communications and Matrix Media Solutions coordinated in this operation, these operations appear to be getting increasingly complex.

Plotting against Qatar

An anti-Qatar article featured on one of the websites amplified by the assets included in the takedown. (Source: thecrystaleyes/archive)

The above article, published on thecrysaleyes.com, argued that Qatar had “indirectly supported” the terror organizations responsible for the September 11 attacks in the United States. The article mentioned an interview with the Emir of Qatar, Tamim bin Hamad Al Thani, in which he allegedly said that Qatar “did what it thought was right.” The article also added that the country was playing a “sweet game with the United States and other nations of the world.” It provided no verifiable attribution for any of its claims.

An article published on the second site, theforeigncode.com, planted a similar narrative with regard to U.S.-Qatari relations. The article argued that, while the Emir had established a good working relationship with U.S. President Donald Trump, the relationship seemed secondary and unimportant from Qatar’s side, as the country allegedly funds terror organizations.

Another narrative attacking against Qatar. (Source: theforeigncode/archive)

Some of the articles claimed Qatar had provided support to the Muslim Brotherhood, which it said had “links to terrorism and extremism.”

Narrative targeting Qatar’s alleged support for the Muslim Brotherhood. (Source: thecrystaleye/archive)

Conclusion

Charles Communications employed this emerging strategy in addition to more common tactics, which included the use of fake accounts to amplify engagement artificially and the creation of regional news outlet pages to attract a local audience. The latter tactic, in particular, is becoming increasingly popular; the DFRLab recently encountered it in Iranian as well as Ukrainian information operations. In this takedown, some of the pages used names similar to those of established news outlets, including Indian Daily Live (similar to mydailylive.com), Malaysia Now (similar to Times Now), and Afghani Mirror (Mumbai Mirror), in a possible attempt to deceive less discerning users.

In terms of content, this information operation focused on targeting Qatar and the Muslim Brotherhood, similar to a previous UAE-linked takedown from August 2019.


Kanishk Karan is a Research Assistant with the Digital Forensic Research Lab (@DFRLab).

Max Rizzuto is an intern with @DFRLab and is based in Washington, DC.

Alyssa Kann is an intern with @DFRLab and is based in Washington, DC.

Follow along for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade