🇳🇬Today Facebook announced the removal of a network of accounts run by the Islamic Movement in Nigeria. My Stanford Internet Observatory team analyzed the network before it was taken down. Our report: cyber.fsi.stanford.edu/news/islamic-m…
The network was suspended not because of the content of the posts, but rather because the Facebook Pages and Groups were run by fake accounts. Facebook calls this coordinated inauthentic behavior.
The Facebook Pages and Groups advocated for the release of IMN leader Sheikh Ibrahim El-Zakzaky.
The operation primarily originated in Nigeria, but there were some interesting connections to Iran. 5 of the Pages had administrators located in Iran & the network frequently linked out to HausaTV.com, which is tied to Iranian state media.
There was also lots of Khamenei imagery.
Many Pages purported to be independent news Pages. The most common topic? Free Zakzaky protests.
The network had some anti-France content (very recently, in response to the republishing of the Charlie Hebdo prophet cartoon).
And some anti-American messaging (criticizing US intervention in Nigeria around the time of the Chibok kidnappings).
Many posts criticized the Nigerian government. Here a poster warning that a Shia genocide is imminent:
🇸🇦Today Twitter announced the takedown of 33 accounts linked to the government of Saudi Arabia. Buckle up for this one 🎢 it’s not your standard “Qatar is the worst” Saudi disinfo operation. Here’s our report: cyber.fsi.stanford.edu/news/twitter-t…
The network had “Royal Sockpuppets”, 👑🧦 fake accounts for real dissident Qatari Royals living in Saudi. The biggest account, pretending to be Fahad bin Abdullah Al-Thani, had >1mil followers. There were also accounts pretending to be an exiled Qatari interim govt.
How did these accounts get such big followings? It’s hard to say, for two reasons. First, many of the accounts engaged in handle switching. The now-suspended @QtrGov was not always @QtrGov - its mentions only go back a few months even though it has existed for years.
🇵🇰Today Facebook announced the suspension of a big network of accounts in Pakistan for coordinated inauthentic behavior. My Internet Observatory team analyzed the network before it came down. The most interesting part of the network? Mass reporting. cyber.fsi.stanford.edu/io/news/report…
The network found accounts they perceived to be critical of Islam or Pakistan & pushed links to Groups & Pages that took users directly to Facebook’s site to report an account. They even included instructions on how to open dozens of tabs simultaneously to expedite reporting. 💻
They boasted of successes frequently, but we can’t confirm whether these accounts were taken down due to reporting. Some targeted accounts had intentionally insulting fake names which were clearly in violation of Facebook's policies.
🌟📝 Today Twitter announced the takedown of 7,340 accounts linked to the youth wing of the Justice and Development Party (AKP), Turkey’s ruling party 🇹🇷. My SIO team, w/ @akis_alp, @makrevis, @JoshAGoldstein, and Katie Jonsson, analyzed the network cyber.fsi.stanford.edu/io/news/june-2…
Takeaways: 1) this was a prolific operation; there were 37 million tweets, mostly in Turkish. Dozens of accounts were managers of retweet 🔄 rings, which worked to artificially amplify pro-AKP hashtags and the accounts of AKP politicians.
2) There was a centrally managed set of compromised accounts that were also used for AKP cheerleading.
1/ 📝 Today my Stanford Internet Observatory team is releasing a report on a Twitter and Facebook takedown of accounts linked to Egypt 🇪🇬, Saudi Arabia 🇸🇦, and the UAE 🇦🇪. fsi-live.s3.us-west-1.amazonaws.com/s3fs-public/20… Highlights from the Twitter takedown here:
2/ The suspended Facebook Pages originated in Egypt, and are attributed to Maat, a social media marketing firm. They had some visually striking COVID-19 disinfo, criticizing how Europe and Qatar are handling the pandemic
3/ …and claiming the Iranian government is not giving correct information about COVID-19 to its citizens (left), and that Iran is the source of the pandemic (right)
🌍 Today Twitter announced the removal of 5,350 accounts & 36 million tweets linked to Saudi Arabia, the UAE, and Egypt. This takedown was a result of a tip the Stanford Internet Observatory shared with Twitter in December 2019. cyber.fsi.stanford.edu/io/news/april-…
The Twitter network is linked to two social media management companies: DotDev and Smaat. Our team put out a 📝 on Twitter’s Smaat takedown at the end of last year:
We alerted Twitter to #السراج_خائن_ليبيا (Sarraj the traitor of Libya), a reference to the Libyan Prime Minister signing a maritime agreement with Turkey that angered many regional actors. It had a suspicious distribution pattern:
CNN is reporting that they uncovered a Russia-linked troll farm based out of Ghana & Nigeria, operating under the front of an NGO, EBLA (Eliminating Barriers for the Liberation of Africa): cnn.com/2020/03/12/wor… Here are some prelim thoughts, with focus on the Africa dimension.
First, this is further evidence of foreign disinformation actors franchising out their activities via funding and involvement of locals, which my team reported on in other African countries last year.
These were very low engagement accounts; most were created in 7/2019. Following/follower ratios were close to 1, max follower count 9,345. They retweeted each other, perhaps trying to increase those numbers. They also regularly tweeted at/retweeted influencers...most in the USA.