Twitter has disclosed four datasets of networks containing a total of 11,318 accounts and nearly 69 million tweets that it has attributed to state-backed information operations originating in Saudi Arabia. In the February 2020 disclosure, Twitter attributed the network as originating from Saudi Arabia, but accounts were also operating out of Egypt and the United Arab Emirates (UAE). According to Stanford Internet Observatory, Twitter linked this dataset to a network operated by a digital marketing firm called DotDev, operating from Egypt and the UAE in September 2019.
Accounts in these information campaigns were active as far back as 2010 but were most prolific in the politically tense period of the Qatar blockade, when Qatar was isolated by Saudi Arabia, Egypt, Bahrain and the UAE, starting in 2017. The Government of Qatar and its royal family were common topics criticised by accounts in these datasets. Diplomatic ties between Qatar and the other Gulf countries were recently restored in 2021.
Attribution of coordinated inauthentic networks to the Saudi Arabian state has been difficult, as the actors from the UAE, Saudi Arabia and Egypt tend to work as a coalition driving disinformation in the region.
In general, accounts in the networks primarily sought to advance the foreign policy aims of the Saudi Government, praise Saudi leadership and shape perceptions about domestic and international issues occurring in the Gulf countries, such as the Yemen civil war. Tweets amplified pro-Saudi narratives of political events, such as the assassination of Saudi dissident and journalist Jamal Khashoggi at the Saudi consulate in Istanbul, Turkey. According to Stanford Internet Observatory, the ‘Sarraj the traitor of Libya’ hashtag was also boosted in response to Fayez al-Sarraj, Libya’s Prime Minister, signing an agreement with Turkey to redraw maritime boundaries. Likewise, accounts in the network contained in the Twitter dataset also sought to blame Turkey, Iran and Qatar for a range of issues throughout the Middle East.
Tweets were posted in multiple languages, including Arabic, English, Persian, Kurdish and Somali, indicating that a wide range of audiences was targeted. Accounts impersonated citizens who were critical of their governments in Syria, Yemen, Sudan, Somaliland, Mauritania, Iran and Qatar. Specifically, a group of accounts impersonated Qatari political figures, the royal family and news media organisations.
Assets in the Twitter datasets showed that sophisticated tactics were used to develop personas and content. The KSA Today news account, which was included in the Twitter disclosures, had been active for nearly a decade before being removed. Images and videos shared in the dataset were probably professionally produced, and links shared in tweets typically led to religious websites and applications. Other key tactics included mass liking, retweeting, replying and amplifying hashtags.
In addition, Twitter has disclosed 5,929 accounts that were traced to Smaat, a social media marketing and management company based in Saudi Arabia, and were linked to a state-backed information operation. Smaat is reportedly headed by Ahmed Aljbreen, who recruited two ex-employees of Twitter to spy on behalf of the Kingdom of Saudi Arabia (KSA). Twitter’s in-house technical signals indicated that Smaat had acted on behalf of—but not necessarily with the knowledge of—its political and commercial clients. An additional 88,000 accounts were also removed but not disclosed in order to protect potentially compromised accounts. Of the non-commercial content in the dataset, tweets pushed political narratives that were consistent with the objectives of the KSA, such as criticisms of the governments of Qatar, Iran and Turkey, and attacked Jamal Khashoggi.
