By Nathaniel Gleicher, Head of Cybersecurity Policy
This week, we removed multiple Pages, Groups and accounts that were involved in coordinated inauthentic behavior on Facebook and Instagram. We found two separate operations: one of which originated in United Arab Emirates and Egypt, and another in Saudi Arabia. The two campaigns we removed were unconnected, but both created networks of accounts to mislead others about who they were and what they were doing. We have shared information about our findings with law enforcement, industry partners and policymakers.
We’re constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. We’re taking down these Pages, Groups and accounts based on their behavior, not the content they posted. In each of these cases, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.
We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing challenge. We’re committed to continually improving to stay ahead. That means building better technology, hiring more people and working more closely with law enforcement, security experts and other companies.
What We’ve Found So Far
We removed 259 Facebook accounts, 102 Facebook Pages, five Facebook Groups, four Facebook Events and 17 Instagram accounts for engaging in coordinated inauthentic behavior that originated in the UAE and Egypt and focused on a number of countries, primarily in the Middle East and some in North and East Africa, including Libya, Sudan, Comoros, Qatar, Turkey, Lebanon, Syria, Jordan and Morocco.
The people behind this network used compromised and fake accounts — the majority of which had already been detected and disabled by our automated systems — to run Pages, disseminate their content, comment in Groups and artificially increase engagement. They also impersonated public figures and managed Pages — some of which changed names and admins — posing as local news organizations in targeted countries and promoting content about UAE. The Page admins and account owners posted about non-country specific topics like fashion, animals, humor and crafts. They also frequently posted about local news, politics, elections and topics including alleged support of terrorist groups by Qatar and Turkey, Iran’s activity in Yemen, the conflict in Libya, successes of the Saudi-led coalition in Yemen, and independence for Somaliland. Although the people behind this activity attempted to conceal their identities, our investigation found links to two marketing firms — New Waves in Egypt, and Newave in the UAE.
- Presence on Facebook and Instagram: 259 Facebook accounts (200 of which had been previously disabled by our automated systems), 102 Facebook Pages, 5 Facebook Groups, 4 Facebook Events, and 17 Instagram accounts.
- Followers: More than 13.7 million accounts followed one or more of these Pages, about 9,000 accounts joined at least one of these Groups, and around 65,000 accounts followed at least one of these Instagram accounts.
- Advertising: About $167,000 spent on Facebook ads paid for primarily in US dollars and Emirati dirhams.
- Events: 4 events were hosted by these Facebook Pages. The first was scheduled for June 4, 2018, and the most recent was scheduled for June 19, 2019. Two hundred seventy people expressed interest in at least one of these events. We cannot confirm whether any of these events actually occurred.
We identified these accounts through ongoing investigations into suspected coordinated inauthentic behavior in the region.
Below is a sample of the content posted by some of these Pages:
Post: “Field Marshal Khalifa #Haftar #The_Libyan_National_Army controls 99% of Libya and now the time has come to finally cleanse and eliminate all terrorism from #Tripoli #Libya_Cleansed”
Headline in image attached to post: “How Qatar Buys Headlines in the World Media”
Post content: “New scandal reaches #AlHamdeen_Organization [referring to the Qatari ruling family] … after the Qatari regime sought to buy shares in foreign newspapers to guarantee its defense during the crisis with the Arab quartet [the United Arab Emirates, Saudi Arabia, Bahrain, and Egypt] calling to fight #terrorism funded by #Doha. At the same time, the Qatari opposition demanded the Al Hamdeen Organization [referring to the Qatari ruling family] provide this funding, because their plan is unsuccessful.”
Mike Huckabee: Commended Qatar and it’s civilization after receiving $50K and a trip to Doha
Rob Sobhani: Formally occupied the position of the president of the Qatar Foundation, a foundation that granted tens of millions of dollars to American schools and universities
Tim Constantine: Used both his column in the Times and his radio program to protect Qatar
Brookings: The notable think tank, the Brookings Institute, received tens of millions from Doha allowing the institute a luxurious center in Doha
The individuals behind this activity posed as locals in countries targeted by this campaign — often using fake accounts — and created fictitious personas to run Pages and Groups, disseminate their content, increase engagement and drive people to an off-platform domain. They managed Pages that masqueraded as local news organizations. The Page admins and account owners typically posted in Arabic about regional news and political issues, including topics like the Crown Prince Mohammad bin Salman, his economic and social reform plan “Vision 2030,” and successes of the Saudi Armed Forces, particularly during the conflict in Yemen. They also frequently shared criticism of neighboring countries including Iran, Qatar and Turkey, and called into question the credibility of Al-Jazeera news network and Amnesty International. Although the people behind this activity attempted to conceal their identities, our review found links to individuals associated with the government of Saudi Arabia.
- Presence on Facebook and Instagram: 217 Facebook accounts, 144 Facebook Pages, 5 Facebook Groups and 31 Instagram accounts.
- Followers: About 1.4 million accounts followed one or more of these Pages, about 26,000 accounts joined at least one of these Groups, and around 145,000 people followed one or more of these Instagram accounts.
- Advertising: Around $108,000 spent on Facebook and Instagram ads paid for in Saudi riyal and US dollars.
We identified these accounts through ongoing investigations into suspected coordinated inauthentic behavior in the region. Our investigation benefited from public reporting by Bellingcat, an open source research organization.
Below is a sample of the content posted by some of these Pages:
