Posted by & filed under AmanTech, Spy Watch.

Bahrain Watch recently published our IP spy report, which explored how the Government apparently used malicious links to identify and jail anonymous Twitter users for “insulting the King.”  Since publishing, we have received new information from a number of sources.  Some of this new information concerns the case of Ali Faisal Al-Shufa, a 17-year-old student currently serving one year in prison for allegedly insulting the King using the @alkawarahnews account.  Court documents show that the Government took issue with Tweets published by the account calling King Hamad a “dictator/tyrant” (الطاغية) and “fallen one/illegitimate” (الساقط).  New evidence indicates that Ali was apparently identified by an IP spy link sent from the account of an arrested activist.  However, no evidence indicates that Ali posted the Tweets in question.


Identification and Arrest

Ali was arrested on 12 March 2013, but new court documents show that Ali’s IP address was linked to the @alkawarahnews account on 9 December 2012 at 19:57:18.  The first is a letter sent from the Public Prosecution, requesting the name and address of the person who was using IP address “” at that time.  The letter was filed by the Public Prosecution in Ali’s case.



The second document is a statement from the Ministry of Interior’s Cyber Crime Unit, explaining how Ali was arrested.


We have translated the relevant portion below:

Investigations were conducted into a number of Twitter users who are insulting His Majesty the King by spreading insulting terms through their accounts that are followed by a large number of Twitter users. Through these investigations we came across one of those individuals and it is the user of (@alkawarahnews) using protocol number from Batelco on [9 December 2012]. After receiving permission from the Public Prosecutor to gain information about the user of the protocol number, we found that the user is registered under the name of Faisal Ali Ibrahim Mohammed Al Shufa. Through the investigations that we conducted it is clear that the person running the account is the named person’s son Ali Faisal Ali Ibrahim Al Shufa. The individual is spreading tweets insulting His Majesty the King, such as “Al Kawarah/ Burning images of the dictator Hamad…” and “the mercenaries of the fallen Hamad are violently suppressing now…”

We contacted @alkawarahnews to see if they received any suspicious links in their Twitter or Facebook account around December 2012.  They found the following message in their Facebook account, from Facebook user, linked to the Twitter account @RedSky446:



We looked up the URL in the API, and found the following:

 "kind": "urlshortener#url",
 "id": "",
 "longUrl": "",
 "status": "OK",
 "created": "2012-12-08T19:05:36.019+00:00",
 "analytics": {
  "allTime": {
   "shortUrlClicks": "1",
   "longUrlClicks": "1",
   "referrers": [
     "count": "1",
     "id": ""
   "countries": [
     "count": "1",
     "id": "BH"

The information indicates that the link is an IP spy link (it uses the service, and has only ever been clicked once.  The person who clicked on the link was located in Bahrain, and clicked from Facebook.  The link was created on 8 December 2012 at 22:05:36 Bahrain time, which is approximately 22 hours before the Government linked the IP “” to @alkawarahnews.  It seems likely that the click on this link led to the identification of Ali’s IP address.


Who was @RedSky446?

Our IP spy report notes that accounts belonging to @RedSky446 suddenly changed their behavior on 17 October 2012.  We were unable to locate anyone who knew @RedSky446 in real life.  However, after publication, several users provided information about @RedSky446.  A Twitter user publicly claimed to have met @RedSky446 while in prison.  We were contacted by another individual who revealed the following details about @RedSky446:

  • @RedSky446 was one of the Twitter users arrested in October 2012 for insulting the King on Twitter.
  • He was convicted, and sentenced to four months in prison.
  • After he was released, @RedSky446 noticed that the passwords to his e-mail, Twitter, Facebook, and other online accounts had been changed.  Thus, he was unsure about how to recover his accounts



The new evidence we have received indicates that the Government probably stole @RedSky446’s accounts when he was arrested, and used them to target activists with IP spy links.  At least one activist who clicked on an IP spy link sent from @RedSky446’s account was apparently arrested as a result.

We reiterate that evidence obtained from these types of IP spy links is inherently unreliable.  In this case, it is clear that @alkawarahnews is operated by several different people, who all have the ability to post Tweets.  Thus, it is not clear that Ali posted the Tweets in question.  Although court documents in his case do include a confession that Ali posted the Tweets, the confession is highly suspect and indicative of coercion, as Ali also confesses to “being tricked by the revolution,” and denies that “mercenaries” have killed or tortured protesters:



I would like to inform you that I opened the twitter account (@alkawarahnews) to spread news of events in the village (Kawarah) and after the situation in Bahrain, I began to spread tweets on the clashes that occurred there…I was tricked by the revolution and believed the rumors of bringing mercenaries from the outside to suppress protesters, kill them and torture them, however I found out that these are untrue.

Comments are closed.