Uncovering a Twitter Bot Army Mobilised Against Al Jazeera

"We Demand the Closing of the Channel of Pigs!"

Central to the Qatar Crisis has been the existence of Al Jazeera. The Saudi-led bloc had demanded its closure, as well as the closure of other channels such as the Middle East Eye. Right from the beginning of the crisis, which was prompted by the alleged hacking of the Qatar News Agency by the UAE, Al Jazeera has been targeted by propaganda bots on Twitter. Despite the fact the Saudi-led bloc have dropped the demand for Al Jazeera’s closure, they still want to stop it inciting violence and using hate speech. (The irony of this from the Saudi-led bloc is, of course, just one of the many absurdities of the crisis).

Most bots identified so far during the spat appear to be targeting Qatar, although Saud al-Qahtani, an advisor to the Saudi Royal court, claimed (without providing evidence) that they had found 23,000 fake twitter accounts launched by Qatar to attack Saudi Arabia.

Although the demands for Al Jazeera’s closure has dropped, the online propaganda war continues. Specifically, Twitter Bots have been dominating numerous hashtags related to the crisis. Yesterday, the hashtag, الجزيرة_منبع_الكذب# (Al Jazeera Is the Source of Lies” was trending in Saudi Arabia. Prior to this, on 23rd June, #نطالب_باغلاق_قناة_الخنزيرة (We Demand the Closing of the Channel of Pigs) was also trending. (For non Arabic speakers, pigs in Arabic is Khanzeer, which rhymes with Jazeer). In addition to these hashtags, at the beginning of the crisis, Bahrain Watch Director Marc Owen Jones also wrote in the Washington Post about bots generating the hashtag #AlJazeeraInsultsKingSalman

This report contains information mostly about “We Demand the Closing of the Channel of Pigs” hashtag, and is evidence of a concerted online campaign against Al Jazeera by Twitter Bots, or a Cyber Army, (or whatever you want to call it). Some of the explanations have been abridged somewhat, but you can go here for a more thorough walkthrough of finding these bots.

Summary Of Hashtag نطالب_باغلاق_قناة_الخنزيرة (We Demand the Closing of the Channel of Pigs)

As shown in the table below, two thirds of the total number of unique accounts in the sample were bots. These bots were responsible for generating approximately 71% of the total number of tweets from the hashtag. From this we can surmise that of the ‘We Demand the Closing of the Channel of Pigs’ hashtag, only 29% represented tweets from potential human accounts.

Date of Sample 23rd June 2017
Sample Size (Total Tweets) 8107
Number of Tweets from Bots ≈5800 (71%)
Total Unique Accounts ≈4116
Total Unique Bots ≈2831 (68.8% of total)

Notable Bot Networks

Within the sample are a number of bot networks. That is to say, not all the bots appeared to have the same purpose or creator. As is often the case, many of the accounts appeared to be promoting either fake follower services, trending services, and in some cases, theological messages. The table below shows a summary of the different networks:

Different Bot Networks/Fake Accounts in the sample
Network App Total Tweets From Account Description
1 نافذة تدارك تتواجد اﻵن 40 Pr- Saudi Royal Family. Have bios, banner profiles and profile pictures.
2 TWC 5214
(Unique Approx 2338)
Many created 2015 and 16, more sophisticated. Repeated tweets from other campaigns. Still active. Many have banner pictures. Based in Saudi according to profile (not accurate measure). Unique bios.
3 Tweet Deck (Two different networks) 223 One network appears to be mostly religion bots. Profile Pics and Banners. The other networks seems to be pro-Saudi and anti Qatar.
4 Tweet Caster for Android 99 Group of accounts suggesting they are hackers. Pro Saudi, almost militant. Have bios, banner images and profile pictures
5 ssy30 31 Suspended
6 r8Jb9Oos3gMQ6107099fhG6A9 42 Pro-Saudi, have bios, banner images and profile pictures
7 Mobile Web (M2) 117 Pro saudi-anti Qata. No banner, but profile pic. slightly jibberish handle
8 Metoo new 45 Seem to post a lot of flowers
Pro-saudi, anti Qatar. Bios present, profile picture present, banner picture present.
9 Metoo app 9 Same as above more or less
10 kdmat54 47 Profile pic, no banner pic, lots of advertising, promoting hashtags and followers

The Largest Network

Among the bots, and by far the most prevalent category, representing about 2338 of the unique accounts in the sample. These bots seem to exist solely for the purpose of spreading anti-Qatar, pro-Saudi, pro-Trump (and also anti-Iranian) propaganda. It makes sense to focus on this group then. Below you can see that there spikes in user account creation dates around 5th May 2016. There was also a large spike at similar period in 2015. This means an unusually high number of the Twitter accounts were created at this time.

Closer investigations highlight that most of these bots tweet from Twitter Web Client (e.g. an internet browser). The below pie chart shows that the majority of these bots were created in April and May 2016. Of these 2338 bots, 818 accounts created in May 2016 and 610 accounts created in April 2016.

At the risk of redundancy, the below chart just gives an idea of when the most accounts were created. Clearly 2016 was a bumper year for bots, but production dropped off in May 2016 with resurgence in August/September 2016.

Content

As far as political bots go, these accounts, broadly speaking, look relatively sophisticated. They contain banner images, profile pictures, and unique biographies. The Twitter handles are not gibberish, and their names are legitimate Arabic names as opposed to some of the names we have discovered before. Remember Cherill Humberto? The follower numbers for each account range from a few hundred to over 20,000. Below you can see sample tweets with translations. The general message on the accounts recent tweets are shared is pro-Saudi, anti Qatar, anti-Tamim, and specifically Al Jazeera. They tend to accuse Qatar of supporting Da’ish, Muslim Brotherhood, Zionists, Israel, and most bizarrely, ‘Terrorism generally’.

Sample Tweets
Account Name Original Text Translation
@AleheM1989 #نطالب_باغلاق_قناة_الخنزيرة القطريين هم من يثير الفتنه في جميع الدول العربية لإراحة اسرائيل Qataris are the ones spreading fitna in all of the Arab Countries to the convenience of Israel
@FlaA8 #نطالب_باغلاق_قناة_الخنزيرة الله يلعن قطر اللي قاعده تدعم الإرهاب God damn Qatar which is the leader in supporting terrorism
@AlmhmdeA62 #نطالب_باغلاق_قناة_الخنزيرة قطر راعيه وداعمه لكل ماهو خراب ودمار للدول العربية Qatar is the patron and supporter of everything that destroys and devastates the Arab World
@951aljreoe3 #نطالب_باغلاق_قناة_الخنزيرة قطر خانت العرب بدعمها ووقفتها مع ايران Qatar betrayed the Arabs with its support and stance with Iran
@rfedal7122 #نطالب_باغلاق_قناة_الخنزيرة قطر طريقها واضح هو دعم الاخوان وداعش والارهاب بشكل عام Qatar's method is clear, it is to support the Muslim Brotherhood and Daesh and terrorism in general
@fnesan_alfreh72 #نطالب_باغلاق_قناة_الخنزيرة الله يمحيكم من الوجود يا صهيانة يا داعمين لداعش واسرائيل God erase you from existence you Zionists and supporters of Daesh and Israel

Some unusual behaviours

The same bots discussed above were also responsible for the hashtag “Al Jazeera is the source of all lies” (الجزيرة_منبع_الكذب) which was trending on 19th July 2017. An analysis of this hashtag highlights some interesting behaviours that may exist to help the bots avoid detection. The clearest example of this is that most of the tweets appear to have been deleted. The reason they can be analysed is that they were downloaded around the time they were created, before they disappeared. Yet if you attempt to go to the link for the offending tweet, you get and expired webpage “Sorry, that page doesn’t exist”.

Webpage

Given that these tweets were downloaded on 19th July, and this was written on the 21st, the tweets are clearly deleted soon after they are posted. In addition to tweets being deleted, retweets are also undone en masse. For example, the tweet below, which is a cartoon showing how Al Jazeera pours petrol on the conflicts of the Arab World, was retweeted over 300 times during the hashtag campaign on July. As you can see from the below image, which was taken on 21st July 2017 there are only 22 retweets.

However, when we downloaded retweets of this image, we counted 323 individual tweets. Therefore of these retweets around 300 were made by bot accounts. This is possibly a new behaviour. If you scroll down the bot accounts you will see plenty of other past hashtags that have not been deleted. If it is not a new behaviour there must be some other criteria for their deletion.

Since the start of the crisis, there have been at least three Twitter trends directed at Al Jazeera, and populated mostly by bots. At least one of those bot networks, the main one discussed in this post, has been active since 2015, and has thus evaded Twitter spam detection algorithms for two years. On this particular network, there are around at least 2000 individual unique accounts. Their activity reflects, broadly speaking, Saudi foreign policy. They have previously condemned Al Jazeera, Iran, and supported Donald Trump. It is not clear who is behind the accounts, although the ones appearing in this post clearly seem to focus on a political message, as opposed to being deployed in the services of advertising. As we have seen, there are a lot of services out there advertising trending services and Twitter followers, with varying levels of sophistication.