Removing Coordinated Inauthentic Behavior in UAE, Egypt and Saudi Arabia

By Nathaniel Gleicher, Head of Cybersecurity Policy

This week, we removed multiple Pages, Groups and accounts that were involved in coordinated inauthentic behavior on Facebook and Instagram. We found two separate operations: one of which originated in United Arab Emirates and Egypt, and another in Saudi Arabia. The two campaigns we removed were unconnected, but both created networks of accounts to mislead others about who they were and what they were doing. We have shared information about our findings with law enforcement, industry partners and policymakers.

We’re constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. We’re taking down these Pages, Groups and accounts based on their behavior, not the content they posted. In each of these cases, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.

We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing challenge. We’re committed to continually improving to stay ahead. That means building better technology, hiring more people and working more closely with law enforcement, security experts and other companies.

What We’ve Found So Far

We removed 259 Facebook accounts, 102 Facebook Pages, five Facebook Groups, four Facebook Events and 17 Instagram accounts for engaging in coordinated inauthentic behavior that originated in the UAE and Egypt and focused on a number of countries, primarily in the Middle East and some in North and East Africa, including Libya, Sudan, Comoros, Qatar, Turkey, Lebanon, Syria, Jordan and Morocco.

The people behind this network used compromised and fake accounts — the majority of which had already been detected and disabled by our automated systems — to run Pages, disseminate their content, comment in Groups and artificially increase engagement. They also impersonated public figures and managed Pages — some of which changed names and admins — posing as local news organizations in targeted countries and promoting content about UAE. The Page admins and account owners posted about non-country specific topics like fashion, animals, humor and crafts. They also frequently posted about local news, politics, elections and topics including alleged support of terrorist groups by Qatar and Turkey, Iran’s activity in Yemen, the conflict in Libya, successes of the Saudi-led coalition in Yemen, and independence for Somaliland. Although the people behind this activity attempted to conceal their identities, our investigation found links to two marketing firms — New Waves in Egypt, and Newave in the UAE.

We identified these accounts through ongoing investigations into suspected coordinated inauthentic behavior in the region.

Below is a sample of the content posted by some of these Pages:

Page name: “I am a Son of Libya, who are you?”
Post: “Field Marshal Khalifa #Haftar #The_Libyan_National_Army controls 99% of Libya and now the time has come to finally cleanse and eliminate all terrorism from #Tripoli #Libya_Cleansed”

Page name: “Sudan Today” Caption: “A cartoon of the Sudanese popular revolution against the Muslim Brotherhood and agents of Iran in Sudan who seek chaos, destruction, rioting, terrorist values, and extremism. #General_Command_Sit-in #Sudan_Without_the_Muslim_Brotherhood #The_People’s_Army” Cartoon translation: Sudanese men on the left hold signs reading “No to Iran” and “No to the Ikhwaan [Muslim Brotherhood].” The men on the right are wearing shirts reading “Iran” and “Ikhwaan [Muslim Brotherhood].”
Page name: “Omani and Proud”
Headline in image attached to post: “How Qatar Buys Headlines in the World Media”
Post content: “New scandal reaches #AlHamdeen_Organization [referring to the Qatari ruling family] … after the Qatari regime sought to buy shares in foreign newspapers to guarantee its defense during the crisis with the Arab quartet [the United Arab Emirates, Saudi Arabia, Bahrain, and Egypt] calling to fight #terrorism funded by #Doha. At the same time, the Qatari opposition demanded the Al Hamdeen Organization [referring to the Qatari ruling family] provide this funding, because their plan is unsuccessful.”
Mike Huckabee: Commended Qatar and it’s civilization after receiving $50K and a trip to Doha
Rob Sobhani: Formally occupied the position of the president of the Qatar Foundation, a foundation that granted tens of millions of dollars to American schools and universities
Tim Constantine: Used both his column in the Times and his radio program to protect Qatar
Brookings: The notable think tank, the Brookings Institute, received tens of millions from Doha allowing the institute a luxurious center in Doha
We also removed 217 Facebook accounts, 144 Facebook Pages, five Facebook Groups and 31 Instagram accounts that were involved in coordinated inauthentic behavior originating from Saudi Arabia that focused primarily on the Middle East and Northern Africa, including Qatar, Saudi Arabia, UAE, Bahrain, Egypt, Morocco, Palestine, Lebanon and Jordan.

The individuals behind this activity posed as locals in countries targeted by this campaign — often using fake accounts — and created fictitious personas to run Pages and Groups, disseminate their content, increase engagement and drive people to an off-platform domain. They managed Pages that masqueraded as local news organizations. The Page admins and account owners typically posted in Arabic about regional news and political issues, including topics like the Crown Prince Mohammad bin Salman, his economic and social reform plan “Vision 2030,” and successes of the Saudi Armed Forces, particularly during the conflict in Yemen. They also frequently shared criticism of neighboring countries including Iran, Qatar and Turkey, and called into question the credibility of Al-Jazeera news network and Amnesty International. Although the people behind this activity attempted to conceal their identities, our review found links to individuals associated with the government of Saudi Arabia.

We identified these accounts through ongoing investigations into suspected coordinated inauthentic behavior in the region. Our investigation benefited from public reporting by Bellingcat, an open source research organization.

Below is a sample of the content posted by some of these Pages:

Arabic portion of caption: “#photo His Royal Highness Prince Mohammad bin Salman kisses the head of a wounded soldier“
Caption: “On Monday, the European Union approved a series of political and financial sanctions against Turkey for continuing illegal drilling in Cypriot territorial waters despite warnings to halt it, European sources said. #Turkey #Cyprus”
Caption: “New York Times: A voice recording of the Qatari ambassador reveals Doha’s involvement in bombings in Mogadishu for its own benefit. How many other bombings in Arab countries has Qatar conducted to achieve its own interests?”