Qatar say their official news agency website was hacked

Twitter Bots suggest they may have a point

As part of examining bots, let's have a look how anti Qatar hashtags may have been inflated by fake accounts and/or propaganda.By looking at Twitter hashtags related to the Qatar spat, we can determine whether there is any validity to claims of an ongoing smear campaign, and perhaps infer whether Qatar is facing some form of broader cyber assault that may include hacks. To locate Twitter bots and propaganda, pattern analysis can be conducted. Broadly speaking, this involves looking at lists of Twitter accounts to identify multiple similarities that suggest accounts are part of a network. A sample of around 33,300 was collected from the hashtag #قناه_الجزيره_تسيء_للملك_سلمان (Al Jazeera disrespects King Salman).

These Tweets were extracted over a six hour period on 28th May. There have been multiple hashtags related to Qatar and the Emir’s comments. This one appeared after Al Jazeera tweeted a cartoon that implied King Salman was collaborating with General Sisi to promote fake news.

Duplicate accounts were removed, leaving 21897 Tweets from individual (unique) Twitter Accounts. By looking at patterns in user creation date, we can see there was a spike around April and May 2017.Of the 33,300 tweets, there were about 21897 unique accounts in the sample, and approximately 4375 are likely fake, approximately 20%. While some of the accounts were crude bots marketing various products on political hashtags, a large proportion were political bots tweeting anti-Qatari propaganda.

A closer look at Tweets from around this date reveal numerous accounts. As we know from before, most bot accounts use bespoke apps or Twitter Web Client. For the sake of ease, the results were filtered to reveal accounts that Tweeted from Twitter Web Client. This still leaves 5335 unique accounts. This time the creation dates of these 5335 accounts were analysed to see if there were any days where an unusually high number of accounts were created. Typically, with large sample sizes, the ‘grey’ area of the chart marked Other usually represents genuine accounts. It’s important to remember that in a sample this size, 1% represents approximately 53 unique accounts, which is still a significant number. As bots are also created in batches across consecutive days, it is important to look at the months as opposed to just individual days.

Pie Chart Showing Account Creation Date of Users Tweeting From Twitter Web Client on the hashtag

Bot Typology and Political Bots from Sample

The below table is a typology of distinct groups of bots from the sample. It is not comprehensive, but identifies some of the largest segments of dodgy data. The largest segments are crude marketing bots (see annex at bottom), that still may play a role in generating trends, but as we are focusing on political bots, you can skip to the end to read about the advertising portion.

The Anti Al Thani Qatar Bots

Approximately 253 of the accounts from one of the bot networks have been created to appear that they are from Qatar. There are a number of things though, beyond the creation date and location, that indicate that the accounts are either bots or operated by a group or individual. Although the repetition is less obvious, you can see from the sample a lot of the tweets occur in pairs, as if they are being reused.

Of these 253 accounts, all of which were created on 2nd April 2017, all are critical of the al Thani family. Indeed, the accounts seem to have been set up solely to attack the Qatari ruling family.Unlike many of the other accounts, instead of retweeting, these accounts tend to tweet as if they were writing their own tweets. There is also a greater amount of variation with the amount of followers and following. They all tweet against the Al Thani family from Qatar. Indeed, a brief corpus based analysis of their bios in the form of a word cloud shows that apart from Qatar, the most common words (excluding prepositions and articles) are Thani, Allah, Al Akhwan (the Muslim Brotherhood), Tamim, and Opposition.

A closer look at the bios reveal they are indeed, anti the Al Thani family, and many criticise the Ruling Family for supporting the Muslim Brotherhood. The below table shows a sample of these bios and their translation

As well as these similarities, and relatively clear ideological line (whoever runs this operation clearly doesn’t like the Al Thanis...), you can look beyond the sample to see that the tweets used by the accounts are repeated through previous months, by other accounts who are ‘located’ in different places (I used the term location in inverted commas as it is user input data, and the case of bots/propaganda accounts, not likely a good indicator of true location). To give you a visual aid, let’s take one of the tweets from these anti Al Thani accounts. Say this one (pictured below) which translates as “#ALJazeeraInsultsKingSalman... The Qatari Pigs radiate terrorism and support it”.

If you simply copy and paste the Arabic tweet into the Twitter Search, then click on latest, you should get something like the following image, which shows accounts going back to April Tweeting exactly the same, esoteric phrase.

If you click on any of the accounts, you will find that they follow the same agenda; criticising Qatar, praising Saudi Arabia, and supporting Trump. There are also some ‘humanizing’ tweets/retweets thrown in for good measure.

If we look for the kind of themes that have emerged in Qatar accusations of being hacked, then you can also see that the accounts in question have also Tweeted about Al Jazeera (and perhaps Tamim), being a servant of Iran. (The Tweet below, which is also repeated, says ‘all Al Jazeera officials are agents of Iran’). The earliest goes back to April.

While it is perhaps that this network of tweeters is in fact, a network of Tweeters, the syntax errors in the Tweets are also similar, suggesting the same script is being applied (assuming they are automated).

The Saudi Network

Also tweeting on the hashtag were a network of about 590 bots ‘located’ in Saudi Arabia. Again, the location on such an account is generally, meaningless, although it also adds to the similarities between the accounts, along with creation date, similar Retweets, and a preoccupation with the same topics . Below you can see that around 67% of these 590 accounts were created on consecutive months (March, April and May 2016). Again, that would be disproportionately high for a random sample of user accounts.

The content of the tweets is interesting. They are more convincing than some bots. They often have a fairly ‘believeable’ number of followers and accounts that they follow. They also do not simply retweet other accounts, but post tweets that appeared to be written by account users. However, these tweets tend to be phrases that are replicated across different accounts (If you remember earlier studies, it was common for those creating the accounts to have their first tweet as an arabic idiom). To give an example, if I go to one of the accounts in the sample, e.g. @@8812al3jme_jmel created in July 2015, and scroll down until I find a tweet from the account (as opposed to a retweet), we can copy and paste it into Twitter search.

This tweet in question reads, ‘كيف تعطس باللغه الانجليزيه ؟؟ \"It \'s you \". كيف ؟ ضبطت ياقلبي ع اللي يجرب هههه’, which is borderline gibberish. It is not a common aphorism or phrase that a number of people may tweet purposefully by coincidence. What we find is that 23 unique accounts have tweeted this exact tweet in May 2017. See below for a snapshot.

What’s also interesting is that when the search terms were returned, the account I copied the tweet from (@8812al3jme_jmel ) wasn’t returned in the search results, implying that there are a lot more of these accounts that have used this term.

What do they tweet?

Well in their recent timeline, this network has been tweeting criticising Qatar and Al Tamim in particular. Most salient among the themes are conflating Al Tamim with Iran, or Qatar with Israel. See below to see some of the fairly slick posters that have been designed, erm, for this hate campaign.

In the post below entitled “Qatar’s media snake”, it outlines on the right a number of news organizations based in Qatar, including Al Jazeera, Arabi 21, Al Quds Al Arabi, the New Gulf, Middle East Eye, Al-Monitor, Huff Po Arabic and Al Arabi Al Jadeed. On the left it has a list of members of the ‘cell’ of ‘media abuse’. It includes Al Jazeera journalist Azmi Bishara and Wadah Khanfar, Middle East Eye Editor in Chief David Hearst, and Yasir Zatara. Their leader, Al Arab chief editor Abdullah Al Athbah of course.

Meanwhile, the below image, which was presumably designed by the same person who did the above post, carries a similar message. Its title reads ‘Methods of Qatari Media Misinformation’. Then, in descending order, it reads, ‘defends the Palestinian Issue despite economic relations with Israel’, ‘demands democracy in Arab countries but imprisoners those who call for it in Qatar’, ‘gives a platform for the Muslim Brotherhood to earn sympathy from the people of the Gulf’. ‘Stands with freedom of the people despite oppressing Qatari people’.

If we download a list of the accounts that retweeted it, we can see that the majority of them are fake. In fact, approximately 1070 of the 1082 (this number is higher than what is displayed on twitter for some reason) collected by the archiver are probably retweets by fake accounts. The below pie chart shows how out of the the 1082 accounts, 64% were created in April and May of 2016. A significant proportion were also created in June, July, August and September 2016 .

If you break the user account creation by day, you will see that within May and April 2016, for example, most of the accounts were created on three or four consecutive days.

Overview of some other Hashtags

Qatarael and its treachery

Sample size = 15712 Individual accounts = 7624 Twitter Web C = 1960 ... Fake Approx = 1843 Number of Fake Tweets = 56%, Number of fake accounts = 40% Data link Qatar the treasury of terrorism #قطر_خزينة_الارهاب

Sample size = 15000 Individual accounts = 4032 Number of Fake Tweets = approx 56% Data Link:


Marketing Bots

The biggest ‘slice’ in the sample are those accounts created on 12/04/2017 (16.3%) (Approx 872 unique accounts). Below you can get an idea of the data, all the bots have a similar number of followers, following, retweets etc. All the names are a little odd, and I can’t imagine someone called Sherrika Churchill, for example, being outraged at Al Jazeera’s treatment of King Salman, although I could be wrong.

Anyway, if we take a random sample of these, let’s say “Hmoob Pearline” and “Bojie Tonk” and put them side by side, you can sort of see that they are advertising bots, that presumably either help generate trends, or promote products on trending topics, or both. If you scroll down their timelines you will find more adverts.

More Crude marketing bots

Those accounts created on 29/05/2017 seem to be similar to the above, crude accounts that Retweet certain hashtags. There around 559 of these accounts in the sample. See below for a sample of these accounts, as you can see, they retweet the same things, often in the same order.

Most of the Tweets in the recent timeline relate to different hashtags discussing Qatar. These include #تميم_لاكرامه_ولامروه ( ) #تصريحات_تميم , among others.