Facebook removed multiple pages, groups and accounts that were involved in coordinated inauthentic behavior from two operations in the Middle East—one originating in the United Arab Emirates and Egypt, and the other in Saudi Arabia.
Head of cybersecurity policy Nathaniel Gleicher said in a Newsroom post that the two groups were not connected, and information about the social network’s findings was shared with law enforcement, industry partners and policymakers.
The first group consisted of 259 Facebook accounts, 102 pages, five groups, four events and 17 Instagram accounts, and its content focused on countries including Libya, Sudan, Comoros, Qatar, Turkey, Lebanon, Syria, Jordan and Morocco.
Gleicher said compromised and fake accounts were used to run pages, spread content, comment in groups and artificially boost engagement, and people in this UAE- and Egypt-based group also impersonated public figures and managed pages that posed as local news organizations.
Topics covered included non-country specific topics such as fashion, animals, humor and crafts, as well as local news, politics, elections and issues including alleged support of terrorist groups by Qatar and Turkey, Iran’s activity in Yemen, the conflict in Libya, successes of the Saudi-led coalition in Yemen and independence for Somaliland.
Facebook uncovered links to two marketing firms: New Waves, based in Egypt, and UAE-based Newave.
Gleicher said over 13.7 million accounts followed one or more of the Facebook pages, while some 9,000 joined at least one of the groups and about 65,000 followed at least one of the Instagram accounts. In addition, 270 people expressed interest in at least one of the events, but Facebook could not confirm whether the events actually occurred.
This group spent around $167,000 on Facebook ads, paid primarily in U.S. dollars and UAE dirhams. Facebook shared some sample posts:
Page name: “I am a Son of Libya, who are you?” Post: “Field Marshal Khalifa #Haftar #The_Libyan_National_Army controls 99% of Libya and now the time has come to finally cleanse and eliminate all terrorism from #Tripoli #Libya_Cleansed”
Page name: “Sudan Today” Caption: “A cartoon of the Sudanese popular revolution against the Muslim Brotherhood and agents of Iran in Sudan who seek chaos, destruction, rioting, terrorist values, and extremism. #General_Command_Sit-in #Sudan_Without_the_Muslim_Brotherhood #The_People’s_Army” Cartoon translation: Sudanese men on the left hold signs reading “No to Iran” and “No to the Ikhwaan [Muslim Brotherhood].” The men on the right are wearing shirts reading “Iran” and “Ikhwaan [Muslim Brotherhood].”
Page name: “Omani and Proud” Headline in image attached to post: “How Qatar Buys Headlines in the World Media” Post content: “New scandal reaches #AlHamdeen_Organization [referring to the Qatari ruling family] … after the Qatari regime sought to buy shares in foreign newspapers to guarantee its defense during the crisis with the Arab quartet [the United Arab Emirates, Saudi Arabia, Bahrain, and Egypt] calling to fight #terrorism funded by #Doha. At the same time, the Qatari opposition demanded the Al Hamdeen Organization [referring to the Qatari ruling family] provide this funding, because their plan is unsuccessful.” Mike Huckabee: Commended Qatar and it’s civilization after receiving $50K and a trip to Doha. Rob Sobhani: Formally occupied the position of the president of the Qatar Foundation, a foundation that granted tens of millions of dollars to American schools and universities. Tim Constantine: Used both his column in the Times and his radio program to protect Qatar. Brookings: The notable think tank, the Brookings Institute, received tens of millions from Doha allowing the institute a luxurious center in Doha
The Saudi Arabia-based group consisted of 217 Facebook accounts, 144 pages, five groups and 31 Instagram accounts, which focused primarily on countries including Qatar, Saudi Arabia, the UAE, Bahrain, Egypt, Morocco, Palestine, Lebanon and Jordan.
Gleicher said fake accounts and fictitious personas were used to run pages and groups, share content, increase engagement and drive people to an off-Facebook domain.
The pages passed themselves off as local news organizations and shared content on regional news and political issues such as Crown Prince Mohammad bin Salman, his “Vision 2030” economic and social reform plan and successes of the Saudi Armed Forces, particularly during the conflict in Yemen.
They also shared content critical of neighboring countries such as Iran, Qatar and Turkey, and questioned the credibility of Al-Jazeera and Amnesty International.
Gleicher said Facebook’s review found links to individuals associated with the government of Saudi Arabia.
Some 1.4 million accounts followed one or more of the removed pages, while about 26,000 joined at least one of the groups and the banned Instagram accounts were followed by approximately 145,000 people. About $108,000 in Facebook and Instagram ads were paid for in Saudi riyal and U.S. dollars.
Gleicher shared samples of content from the removed pages:
Arabic portion of caption: “#photo His Royal Highness Prince Mohammad bin Salman kisses the head of a wounded soldier“
Caption: “New York Times: A voice recording of the Qatari ambassador reveals Doha’s involvement in bombings in Mogadishu for its own benefit. How many other bombings in Arab countries has Qatar conducted to achieve its own interests?”
Caption: “On Monday, the European Union approved a series of political and financial sanctions against Turkey for continuing illegal drilling in Cypriot territorial waters despite warnings to halt it, European sources said. #Turkey #Cyprus”
He wrote, “We’re constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. We’re taking down these pages, groups and accounts based on their behavior, not the content they posted. In each of these cases, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.”