A simple slip exposed links to the Assad regime, fake accounts and a deliberate disinformation campaign. 

Sensationalist headlines, clickbait videos and wild accusations of support for terrorism stormed the virtual world in 2017 when the region’s biggest political crisis in decades erupted between Gulf Cooperation Council member states.

Behind this content stand various platforms, chief of which is QLeaks, which has been at the forefront of what appears to be a major disinformation campaign against Qatar.

A recent investigation by Eekad, an open-source intelligence platform in the Middle East, tore through layers of fake accounts, mysterious pages as well as general content that appears to target Qatar, in a bid to find the network behind QLeaks.

The four-month long investigation traced the popular online account back to the United Arab Emirates – which had been closely monitored by Eekad since the 2017 crisis.

That year saw Saudi Arabia, the UAE, Bahrain, and Egypt sever all trade and diplomatic ties with Qatar, sending the region on a political whirlwind that affected residents, citizens and decades-long alliances.

Five years on, and just two years after the dispute was brought to a head, the intelligence entity said it was able to locate QLeaks’ operational headquarters, pointing the finger towards the UAE.

The discovery was made after closely tracking Arab File, or “Malafat Arabiya”, the main  account that interacted with QLeaks. Eekad described Arab File as “the tip of the iceberg” in the investigation due to its close link to the platform.

Who are the individuals behind QLeaks?

By analysing Arab File, Eekad was able to break through with the discovery of a mass network of people behind QLeaks. 

According to Eekad, UAE-based Mohammad Dagestani is behind Arab File, or at least manages the account, which pushes out QLeaks content. 

Mohammad, who deactivated his Twitter account a week after the investigation was published, mentions on his LinkedIn page that he headed the social media accounts of UAE-based Erem News for eight years. That outlet has also been pushing out false news targeting Doha for years.

Speaking to Doha News, Dr. Mohamad Elmasry, Associate Professor in the Media and Cultural Studies Programme at the Doha Institute for Graduate Studies, said that the campaign comes against the backdrop of broader efforts by the UAE.

“The UAE government views democracy as an existential threat and has been the most antagonistic of all Arab governments vis-a-vis the Arab Spring. The Qatari government’s political, economic and media support for Arab Spring movements caused it to draw the ire of the UAE, which effectively unleashed a propaganda war against Qatar,” said Dr. Elmasry.

When speculations turn into evidence

While Arab File claims to be based in Egypt under Egy Serv management, advanced methods found that an email address linked to its YouTube page actually belongs to Mohammed.

The information was concealed via Withheld for Privacy, a virtual platform that hides online details.

The start of the great reveal began with a search into Mohammed’s online presence, a move that entailed thorough digging into Dagestani’s Twitter account. This eventually led to the discovery of three similar accounts followed by him.

One account was called Mohaqiq Istiqsa’ai, translating to “The Investigator” in Arabic; Arab Files; and QLeaks. According to the Eekad probe, all accounts shared the same type of content, including similar layouts, images and design.

It only took one mishap, however, to unravel the truth behind the rest of the anti-Qatar network. 

According to Eekad, the account operating the handle @ar_investigator on Twitter had published a QLeaks branded video on 8 April, that was never shared by the platform itself, prompting questions on whether it has a hand in the production of the material. 

Doha News is unable to find the tweet, suggesting it has since been deleted. 

Arab File also used the same software to hide its details. The key to the investigation, however, was in locating the accounts that interact with QLeaks: a network of unknown accounts.

The unknown accounts all followed the three interlinked misinformation platforms, as well as Erem News, and Dagestani. Amongst them, only one ‘real’ social media user was found, going by the name Median Rummo.

Based in the UAE, Rummo is among a list uncovered by WikiLeaks of names and entities linked to the Bashar Al Assad regime. A Google search of Rummo’s name shows his association with various companies reportedly founded by him, including 1ststep.live, EZware Technologies and TRENDUMES.

“While this is not necessarily part of an intentional foreign intelligence campaign by the Assad regime, the regime has long used propagandists and unwitting bloggers – like Rummo – as part of its global public relations effort, in order to launder its image,” Jett Goldsmith, Managing Editor of Offbeat Research, told Doha News.

Goldsmith noted that the presence of bloggers like Rummo who partake in “state-sanctioned intelligence campaigns,” whilst simultaneously propagandising for the Assad regime, displays the willingness of the UAE in “embracing and sharing the same propaganda tactics [as said regimes]. 

“Moving forward, the Assad regime may be increasingly pressured to condemn or act on Qatar in various other ways as part of this normalisation effort,” the researcher said.

Dagestani’s brother, whose name on Facebook is “Mowayad Ahmedkhanov”, is also implicated in the anti-Qatar agenda of these networks.  

Mowayad was found in QLeaks’ 49 followers on the Meta platform. Further research found that he is virtually connected with other journalists based in Russia, who also frequently interact with QLeaks. Since Eekad’s publication some of the accounts have unfollowed the platform. 

Among the journalists is Hekmat Bassmouk, who works as an adviser at Abu Dhabi’s Government Media Office, suggesting that the UAE’s government intelligence may have a role in the campaign against Doha.

A week after the investigation was published, Arab Files changed the email that linked it back to Dagestani and changed its location to the US. After deactivating his Twitter, Dagestani returned to the platform and protected his tweets, removing his previous Erem News header.

His brother, Mowayad, also hid his social media presence by changing Twitter handles and deleting a photo with his brother that had played a part in connecting the two together. 

Eekad described the moves as part of QLeaks’ attempts to hide evidence, given that the accounts and emails were removed from the internet.

GCC relations post Al-Ula

Despite ending in 2021, remnants of the GCC rift linger in the presence of disinformation platforms such as QLeaks.

The signing of the Al-Ula declaration on 5 January last year had supposedly marked a new beginning, with officials from countries within the quartet appearing to have turned the chapter. 

“Public statements and gestures from the GCC are nice, but actions of the security forces and intelligence services, such as this operation, speak to the true UAE stance on this issue,” said Goldsmith.

Several mutual high profile visits have taken place between Qatari and Emirati officials since late last year. 

Last month, Qatar’s Amir Sheikh Tamim bin Hamad Al Thani travelled to Abu Dhabi to condole UAE President Sheikh Mohammed bin Zayed Al-Nahyan (MBZ) on the death of Sheikh Khalifa bin Zayed Al-Nahyan. Qatar also participated in Expo 2020 Dubai, signalling that ties have been restored to their normal state. 

The UAE, however, is yet to reopen its embassy in Qatar.

“Despite the major breakthrough at Al-Ula, which led to the lifting of the blockade of Qatar, the root causes of the 2017-2021 Gulf crisis have not been resolved. There are still aspects of Doha’s foreign policy which, to varying degrees, upset some of Qatar’s immediate neighbours,” Giorgio Cafiero, CEO and founder of Gulf State Analytics, told Doha News. 

Cafiero further stated that these aspects “pertain to Qatar’s views on Islamist movements such as the Muslim Brotherhood, Iran, and other sensitive issues.”

A ‘difficult dilemma’

Beyond the GCC, social media platforms have been criticised for lacking policies to combat disinformation. 

Dr. Elmasry believes that social media and technology companies are currently facing “a difficult dilemma” between being seen as too restrictive and not being strict enough.

“It’s important to note, too, that the technology for identifying and censoring disinformation is not yet as sophisticated or advanced as it needs to be, a reality which causes some types of disinformation to continue to spread unabated and other forms of fair, honest, legitimate speech to be unnecessarily restricted,” he said.

Meanwhile, Goldsmith believes that the companies have failed to act due to their biased policies towards the west and the US, and a lack in Arabic content moderators. 

“Even when there are sufficient Arabic-speaking employees to deal with this content, the policies are not written in a way which favours or understands the sociopolitical dynamics involved in dealing with regions like the Gulf,” explained Goldsmith.

The apparent double-standards in combating misinformation and their bias towards the west has been demonstrated in various instances, most notably with regards to Palestinian media outlets during their coverage of the ongoing Israeli attacks against Palestinians.

The Israeli occupation, a key US ally, was found in many instances involved in the censorship of outlets and accounts pertaining to Palestinian personalities, by directly influencing social media platforms such as Facebook.

“When social media companies do take action, usually it’s done in alliance with the government – websites like Twitter will often remove social media posts if they receive a formal court order, even for countries like Turkey or the UAE,” said Goldsmith.

He added that social media platforms rarely combat fake news websites until investigations expose their campaigns

“I would not expect any sort of action from the platforms on this issue. Even a sternly worded letter written by the foreign ministry of Qatar and addressed to the platforms may not be sufficient to force action,” said Goldsmith.