People connected to the government of Saudi Arabia have run a network of fake accounts and pages on Facebook to promote state propaganda and attack regional rivals, the social media giant said on Thursday.
Facebook said it had suspended more than 350 accounts and pages with about 1.4 million followers, the latest takedown in an ongoing effort to combat ‘coordinated inauthentic behaviour’ on its platform, and the first such activity it has linked to the Saudi government.
Countries in the Middle East have increasingly turned to websites such as Facebook, Twitter and Google’s YouTube to peddle covert political influence online.
Facebook has publicly announced 11 takedowns of ‘inauthentic behaviour’ stemming from 13 different countries so far this year
Reuters detailed an expansive Iranian-backed campaign last year and Riyadh has been accused of using the same tactics to attack regional rival Qatar and spread disinformation following the murder of dissident journalist Jamal Khashoggi.
Saudi Arabia has repeatedly denied any involvement in Khashoggi’s death and not responded to previous allegations about its activity on social media. Along with allies, it has imposed a trade and diplomatic boycott on Qatar, accusing it of supporting terrorism, which Qatar denies.
Facebook announces takedowns of ‘inauthentic behaviour’ as often as multiple times a month, but statements that directly link such behaviour to a government are rare.
‘For this operation, our investigators were able to confirm that the individuals behind this are associated with the government of Saudi Arabia,’ said Nathaniel Gleicher, Facebook’s head of cybersecurity policy.
‘Any time we have a link between an information operation and a government, that’s significant and people should be aware.’
Facebook also said on Thursday it had suspended a separate network of more than 350 accounts linked to marketing firms in Egypt and the United Arab Emirates. In that case it did not directly link the activity to a government.
Nathaniel Gleicher, Facebook’s head of cybersecurity policy, (right) said the Saudi campaign operated on Facebook and its Instagram photo-sharing platform
Gleicher said the Saudi campaign operated on Facebook and its Instagram photo-sharing platform, primarily targeting countries in the Middle East and North Africa, including Qatar, the UAE, Egypt and Palestine.
The operation used fake accounts posing as those countries’ citizens and pages designed to look like local news outlets. More than $100,000 was spent on advertisements, Facebook said.
‘They would typically post in Arabic about regional news and political issues. They would talk about things like Crown Prince Mohammed bin Salman – his internal and economic social reform plan, the successes of the Saudi armed forces, particularly during the conflict in Yemen,’ said Gleicher.
Social media companies are under increasing pressure to help stop illicit political influence online.
U.S. intelligence officials have said that Russia used Facebook and other platforms to interfere in the 2016 U.S. Presidential Election and are concerned it will do so again in 2020. Moscow denies such allegations.
Ben Nimmo of the Atlantic Council’s Digital Forensics Lab, which works with Facebook to analyse influence campaigns, said online information operations were becoming increasingly visible as more governments and political groups adopt the tactics and the social media companies step up efforts to take them down.
Facebook has publicly announced 11 takedowns of ‘inauthentic behaviour’ stemming from 13 different countries so far this year. The most recent announcement last week included accounts run by people in Thailand, Russia, Ukraine and Honduras.
The network based in the UAE and Egypt that was also dismantled on Thursday was separate to the Saudi campaign, Facebook said, although it targeted some of the same countries in the Middle East and Africa with messages promoting the UAE.
‘This shows how much social media has become a battleground, particularly in the Gulf, where you’ve got very strong regional rivalries and you’ve got a long tradition of working through proxies,’ Nimmo said.
‘This is almost becoming normalised,’ he added. ‘Where you get geopolitical tensions, you get stuff like this going on, and we’re moving into a space where the platforms are dealing with this almost as routine.’
Facebook’s takedown of ‘fake news’ pages
Social media companies Facebook, Twitter and Google’s YouTube are under intense pressure to help stop illicit political influence campaigns online ahead of the upcoming U.S. presidential election.
Here is a list of takedowns announced by Facebook so far this year:
Jan. 17 – 364 Facebook pages and accounts operated from Russia and targeting the Baltics, Central Asia, the Caucasus, and Central and Eastern European countries.
Jan. 31 – 783 Pages, groups and accounts engaged in ‘coordinated inauthentic behaviour tied to Iran.’ 234 accounts, pages and groups on Facebook and Instagram operating as part of a domestic network in Indonesia.
Feb. 13 – 168 Facebook accounts, 28 pages and eight Instagram accounts targeting people in Moldova. ‘Although the people behind this activity attempted to conceal their identities, our manual review found that some of this activity was linked to employees of the Moldovan government.’
March 7 – 137 Facebook and Instagram accounts, pages and groups operating as part of a domestic-focused network in Britain. 31 Facebook pages, groups, and accounts which were part of a network that operated in Romania.
March 26 – 2,632 pages, groups and accounts engaged in coordinated inauthentic behaviour on Facebook and Instagram. The operations identified were connected to Iran, Russia, Macedonia and Kosovo.
March 28 – 200 pages, groups and accounts engaged in coordinated inauthentic behaviour on Facebook and Instagram in the Philippines.
April 1 – 1,126 pages, groups and accounts linked to people and organisations in Pakistan and India. ‘The operations … engaged in coordinated inauthentic behaviour were two distinct sets of activity in India and one network in Pakistan.’
May 6 – 97 Facebook accounts, pages and groups involved in coordinated inauthentic behaviour as part of a network emanating from Russia that focused on Ukraine.
May 16 – 265 Facebook and Instagram accounts, pages, groups and events which originated in Israel. The network targeted people in Nigeria, Senegal, Togo, Angola, Niger and Tunisia, along with some activity in Latin America and Southeast Asia.
May 28 – 97 Facebook and Instagram accounts, pages and groups which originated in Iran. The accounts purported to be located in the U.S. and Europe and impersonated legitimate news organizations in the Middle East.
July 25 – Four unconnected operations that originated in Thailand, Russia, Ukraine and Honduras. ‘We didn’t find any links between the campaigns we’ve removed, but all created networks of accounts to mislead others about who they were and what they were doing.’