A Doha News investigation exposes sinister manipulation campaigns targeting Qatar online.

• More than 80% of tweets used under a teachers rights hashtag sourced from fake accounts
• Hashtags were able to trend despite only being used in one tweet
• Mysterious account with less than 5,000 followers was able to push multiple hashtags to top of Qatar’s trending list

New data analysis obtained by Doha News reveals how hashtags that trended in Qatar in recent months have involved thousands of dubious accounts and suspected bots designed to disseminate and amplify information critical of the Gulf state.

The data, which examines nearly 100,000 tweets, identified several highly active users that produced thousands of tweets featuring specific hashtags in an unusual period of time, all of which attempt to promote alleged public dissatisfaction towards Qatar’s government.

Among the hashtags that surfaced on Twitter’s top trending list are those that take aim at the purported lack of teachers rights in Qatar, the character of Qatari citizens, the amir of the Gulf state himself, Shia rights, as well as most recently, the upcoming Shura council elections.

While Doha News is unable to determine beyond doubt who is deploying the fake bots, reports have pointed towards authoritarian regimes in the Arab world who have in recent months and years been exposed for utilising this tool to maintain further control on citizens – extending social media to their existing, vast and ever-evolving repressive global security apparatus.

In the case of Qatar, the Gulf state found itself at the forefront of a major cyber warfare tactic in the months leading up to the 5 June 2017 blockade, when millions of online bots were deployed in a coordinated campaign to manipulate social discourse on the unravelling political dispute.

The fairly modern yet crafty government tactic helps in disseminating propaganda en masse, often attacking dissidents and opponents and encouraging authentic users to imitate similar attitudes against the target, as notoriously exposed in the case of Saudi journalist Jamal Khashoggi, who faced months of online attacks before being murdered by the kingdom’s agents inside its Istanbul consulate in 2018.

Since the high-level case made global headlines, Twitter has faced immense pressure to take action against perpetrators, with many questioning why tech giants allow for their platforms to be misused in such a way.

“Bots are frequently used to promote government propaganda by mass retweeting or spreading a particular message or hashtag,” Marc Own Jones, an assistant professor of Middle East studies at Hamad bin Khalifa University in Doha who specialises in disinformation on social media, told Doha News.

“They create the illusion of consensus rapidly, and can also help drown out information critical of the government by drowning out legitimate information,” Jones added.

To simplify the complicated operation, technical teams in IT labs produce an army of fake bots that are programmed to ‘retweet’ posts from specific accounts in a bid to amplify specific rhetoric, sentiments or information of biased nature.

“Eight months after Qatar and the former blockading quartet appeared to bury the hatchet with the signing of the Al-Ula Declaration, it poses a question on whether the Gulf crisis has genuinely come to an end.”

Naturally, the tweets gain traction among human-users who soon buy into the conversation and provide their own opinions, usually echoing those of fake bots, on said matter.

“It is important to distinguish between bots and trolls. Bots are automated accounts, while trolls are real people that harass others online. There is no one way to spot a bot, and often you can only detect them by observing large similarities between groups of accounts acting in unison,” Jones noted.

While it may be convenient to dismiss the campaigns as minor interferences or mere nuisance, the recent consistent pattern of emerging trends targeting Qatar indicates that there could be something more serious underway. With Doha gearing up for the Shura council elections, such instigation could pose a significant disruption to the historic vote. 

Speaking to Doha News, Gulf expert and Fellow for the Middle East, Rice University’s Baker Institute for Public Policy, Dr. Kristian Coates Ulrichsen said this strategy could be an attempt to portray a fake “grassroots” movement.

“If any of the anti-Qatar disinformation can be traced back to regional governments, directly or indirectly, it would cast doubt upon their commitment to the process of reconciliation and adherence to the commitments made at Al-Ula in January,” Dr Ulrichsen said.

“Obviously the fact that Qatar has its Shura Council elections coming up provides a potential opportunity for any regional critics to try and spread disinformation or plant stories that cast doubt on the credibility or legitimacy of the electoral process.

“Using social media influencers could be a way for state actors to distance themselves from such campaigns and make them look more ‘grassroots’ rather than officially sanctioned,” he added. 

Since the killing of Khashoggi and subsequent evidence that revealed how Twitter employees were compromised to work on behalf of the Saudi government, thousands of fake state-backed Saudi Twitter accounts created using names of Qatari royals and governmental bodies have been taken down by the media giant as part of its anti-disinformation campaign. 

Similarly, thousands of accounts linked to the UAE and Egypt have also been wiped out, many of which were “engaged in coordinated efforts to amplify messaging that was beneficial” to their respective governments, Twitter said at the time.

“Rigorous investigations by our Site Integrity team have allowed us to attribute these accounts to a significant state-backed information operation on Twitter originating in Saudi Arabia,” Twitter said in 2019.

A year later in April 2020, Twitter confirmed the removal of 2,541 accounts in an Egypt-based network, known as the El Fagr network, which it said created inauthentic accounts to push messaging critical of Iran, Qatar and Turkey. 

“Information we gained externally indicates it was taking direction from the Egyptian government,” Twitter said.

Similarly, “a network of accounts associated with Saudi Arabia and operating out of multiple countries including KSA, Egypt and UAE, were amplifying content praising Saudi leadership, and critical of Qatar and Turkish activity in Yemen. A total of 5,350 accounts were removed,” it added.

According to Stanford Internet Observatory, controlled accounts regularly change the name of their handle and clear out previous tweets in a bid to increase perceived legitimacy, including what could be audience-building spam tweets.

Fabricated coup

Accounts had also spread rumours of a military coup in Qatar and fabricated statements from global rights organisations such as Amnesty International and Human Rights Watch (HRW).

Some of the fake Twitter accounts, with one million followers, impersonated the identity of members of the Qatari royal family, including Fahad bin Abdullah Al-Thani who currently resides in Saudi Arabia. The pages fabricated statements by Amnesty and Human Rights Watch and claimed the royal was being tortured in a Qatari prison.

In May 2020, an account under the handle “@QtrGov” spread rumours of a military coup in Qatar. However, in a Twitter analysis, Jones traced back the doctored videos and found they had incorporated clips and audios from different countries, including China and Saudi Arabia – none from Qatar.

Meanwhile, an Al Jazeera documentary dubbed “Distance Zero” found that Saudi Arabia, the UAE and Egypt created 80,000 fake Twitter accounts that were used to promote the hashtag “Qatar Supports Terrorism”.

According to the probe, the hashtag was traced back to 2013, four years before the blockade, and was ready to be activated a month ahead of the June 2017 crisis.

“This trend is clearly misleading, mostly dominated by disinformation, paid spambots, non-Qataris (UAE/Saudi) and an Israeli” 

In that same year, an anti-Qatar website, equipped with its own branches of social media accounts, suddenly emerged online. The account was traced back to an apartment in Ahmed Abdulaziz Street in Cairo, and according to a former ‘QatariLeaks’ employee, Emirati company Dot_Dev began preparing the platform at the end of 2016.

In just over a year, QatariLeaks grew to more than 51,500 followers and sent more than 27,500 tweets in that same time period. 

Content created on the account included tweets in both Arabic and English, infographics and exposé style videos that gained an average of 1,500 views in a matter of minutes – all of which rack up time, effort and large sums of money for its client. 

By any standards, such considerable growth for a political account is somewhat unsubstantiated, and can only be achieved through unconventional methods, including use of PR companies, fake Twitter bots and a lot of dollars – or dirhams.

The latest data analysis falls short of identifying a culprit for the amplification of the hashtags. However, eight months after Qatar and the former blockading quartet appeared to bury the hatchet with the signing of the Al-Ula Declaration, it poses a question on whether the Gulf crisis has genuinely come to an end.

A dive into the ‘trending’ hashtags

‘Shura elections’

Among the most recent of hashtags is “#Qatar_Revolts” which attempts to exaggerate a small-scale demonstration launched by a tribe protesting against the “exclusion” of Qataris that have been deemed ineligible to vote, as per current law.

The hashtag is carried and amplified by two particular hacked but verified accounts – one belonging to ABC News producer Joel Zander and the other Indian linked to entrepreneur Ishita Anand. While both personas are not known to engage in such internal Qatari politics, their tweets were retweeted by hundreds of other fake accounts.

In the same month, #The_People_Boycott_Shura_Elections was a number one trending topic that surfaced on Sunday 1 August, coinciding with the first day that voters in Qatar could register for the October elections.

While hashtags trend on Twitter if they are used by thousands of social media users, or if sponsored by a particular company, or if Twitter itself – whose MENA office is based in the United Arab Emirates – pushes it to the forefront, this particular hashtag reached to the top of the list despite only being used in one tweet.

While there is no reason to suggest it is a fake or bot account, it is questionable how its one boycott tweet managed to secure a top trend spot. 

Days later on 3 August, the trend appeared once more, this time garnering more engagement on Twitter. According to independent analysis by digital analytics expert Marc Owen Jones, the hashtag pulled 300 interactions from around 250 unique accounts.

“However, the most retweeted account is a digital marketing account that literally offers trend promoting services,” Jones said in a tweet.

Diving deeper into the account, Jones identifies the most “influential” handle on the hashtag as @EdyCohen – an Israeli account who has previously tweeted disinformation about Qatar and the Muslim Brotherhood.

“This trend is clearly misleading, mostly dominated by disinformation, paid spambots, non-Qataris (UAE/Saudi) and an Israeli,” he concludes.

Shia rights

Among the other most recent hashtags to trend is #Shia_Rights_in_Qatar, which first appeared on 5 July in a tweet by Bahrain-based account @maryam22700288. At the peak of the hashtag’s activity, between 5-6 July, the hashtag was used in a total of 12,464 tweets – mostly retweets (12,026) – by 1,005 unique users.

According to data analysis, the campaign was spearheaded by two teams. The first team was located in close proximity to Bahraini user groups, signalling that they are from the same country. The group was mainly influenced by prominent Bahraini politician and Former Minister of Foreign Affairs Khalid bin Ahmed Al Khalifa, despite the fact that he did not post a direct tweet using the hashtag.

The second team, found to be influenced by the UAE’s Deputy Chief of Police and General Security Dhahi Khalfan, is a mix between Emirati, Bahraini and US-claimed users, the report said. Interestingly, 17 of the top 20 tweeting accounts posted exactly 22 tweets containing the hashtag.

Furthermore, analysis of account creation dates illustrates that a large percentage, including anomalous spikes in creation dates which reflects batch creation, were made shortly before the initiation of the campaign.

‘Teachers rights’

#Teachers_Rights_In_Qatar (#حقوق_المعلمين_في_قطر) and four variable hashtags produced some 56,986 total tweets between April 8th – when it first appeared – and April 15th. Only 6,177 consisted of original tweets, whereas 52,326 were mere retweets.

The hashtags relate to a recent decision by Qatar’s Ministry of Education that confirmed all teachers will be required to attend schools to carry out their jobs despite students adopting distance learning measures. They were also sparked by false rumours on an alleged deduction in salaries for educators requiring sick leave due to Covid-19 reasons, as was reported by Doha News.

Data analysis shows some accounts taking part in the trend had sent out on average hundreds of tweets per day, a clear sign that the hashtags are being pushed by inauthentic accounts. 

The vast majority of users self-report to be based in Qatar, but there is no evidence that they actually are as this is a metric that can be easily manipulated. 

According to a report by a renowned digital forensics firm commissioned by Doha News, the very first use of the hashtag was produced by a user who claims to be a Qatar University graduate and social studies teacher. However, the account produced a whopping 861 tweets specific to the hashtags since 8 April. This indicates that this is highly unlikely to be an authentic user. 

Meanwhile, @jastme97916440 was found to be the most active user, posting tweets with the hashtags #TeachersRights_In_Qatar3 and #TeachersRights_In_Qatar4. The account itself was created on 9 April, just four days before the hashtag gained traction. Bizarrely, in just six days, the account posted 705 tweets, clear evidence that the account was created to amplify the trending hashtags.

At least 15 other users were identified as producing over 1,000 tweets featuring these hashtags, all within a time period of just 7 days. 

Of the 2,950 users identified participating in the hashtag, 405 accounts were created in 2012, representing 14% of the total number. 548 accounts were created during 2020, with 326 created in 2021 so far – 30% of total users.

“When analysing by month, we identified that 200 accounts were created in March and April 2021, representing a significant spike in the creation date of accounts. This suggests a network of inauthentic accounts created to amplify the teachers’ rights hashtag, the digital investigators told Doha News.

‘Qatari character’

This was the case in numerous other hashtags that emerged in the month of April. 

#The_Qatari_Character (#الشخصيه_القطريه) appeared to have surfaced after user @AlthaniAljnob created a Twitter thread on 10 April describing his assessment of a typical Qatari personality and character. The tweet was highly critical in tone. 

One day later, data shows an increased usage of the hashtag with the largest spike in activity taking place another day later.

The 4,178 tweets featuring the hashtag were produced by a total of 1,341 users. An analysis of the creation dates of these accounts reveals a wide range of dates, with a small spike in March and April 2021 – similar to what was seen for the teachers rights hashtag. Again, this indicates accounts that were created to artificially amplify the anti-Qatar narratives.

A total of 801 tweets were original while 3,377 were retweets, highlighting a high ratio of amplification versus original content. Of the 1,341 users 5.5% were created in March or April.

“Much of the content of tweets using the hashtag appears to be pushing back against @AlthaniAljnob’s narrative and is heavily pro-Qatari. However, there are other instances of strong anti-Qatar messages,” the commissioned report found.

Some tweets are also supportive of Qatari people but critical of the government. These may have been posted as part of a coordinated astroturfing campaign, in which accounts were engineered to appear as though they were based in Qatar.

One such tweet accused the Qatari government of stealing from its people. @wak1BERGOdJdeg5, who notably joined Twitter just a month before the June 2017 blockade on Qatar, retweeted 99 posts to amplify the hashtag. The one and only original tweet posted by @wak1BERGOdJdeg5 using the hashtag said: “The problem is they steal from the people’s money and the people advise them. If we are truly a democratic state then they would be in prison.”

That aforementioned account is among some 658 that engaged in both the Qatari personality and teachers rights campaigns, presenting some evidence that there exists a network of accounts pushing these hashtag campaigns artificially. 

‘Goodness and glory’

The hashtag #Tidings_of_Goodness_and_Glory depicts a phrase that gained popularity in the wake of the 2017 blockade when it was used by Amir Tamim bin Hamad Al Thani in response to a request from a citizen. In Arabic, it suggests the request has been granted.

“The first account deploying the hashtag in the recent hostile campaign is @ra21112. In his tweets on 14 Apr 2021, Al Marri deplored the Qatari emir’s pardoning of prisoners for Ramadan,” the report noted, referencing the account highlighted in previous trends.

“Thereafter, accounts purporting to be Qatari were identified promoting the campaign. Many of the accounts display inauthenticity through their account naming conventions. Around 20% of these accounts were created shortly before the campaign. Some of these were identified engaging in a separate recent hostile anti-Qatar campaign,” it added.