Bahrain Mirror (Exclusive): Marc Owen Jones, a researcher and director at Bahrain Watch, writes in an article about his "discovery of thousands of fake twitter accounts" that "were polluting hashtags around the Persian Gulf with anti-Shia and anti-Iranian propaganda." He highlights that "many were promoting discourses that mirrored that of the Islamic State, such as branding the Shia as ‘rejectionist of the true Islamic faith' (Rawafid)."

In this detailed investigation, Jones notes that these thousands of accounts would, at certain times of the day, generate hundreds to thousands of tweets per hour, quickly flushing out legitimate tweets on various hashtags, including #Bahrain, #Yemen, #Saudi and others."

Marc Owen Jones is also a Research Fellow at the Institute for Arab and Islamic Studies at Exeter University. He is co-editor of Bahrain's Uprising: Resistance and Repression in the Gulf, published by Zed Books.

Jones says that about 40% of 2.4 million MENA Twitter users were based in Saudi, which amounts to up to over a million accounts.

"The data suggests at least 10,000 of tweets per day were emanating from these suspicious accounts. While thousands of the tweets contained sectarian rhetoric, the majority of the tweets from these suspicious accounts focused on hashtags on #Saudi regions, from #Riyadh to #AlQatif, with the content generally lionising the Saudi government or Saudi foreign policy," he further states, adding that a significant proportion of those tweets; however, were "also used to attack the #Bahrain and #Yemen hashtag."

Jones says that back in June 2016, Twitter informed him that they had suspended 1,800 accounts for showing spam-like activity after he submitted an investigation to them.

The tweeting of Sheikh Isa Qassim, Yemen and Bahrain

Jones highlights that the suspicious accounts that first came to his attention were "when Isa Qassim, a prominent Shia Cleric in Bahrain, had his nationality removed by the Bahrain authorities in June 2016."

"Searching on Twitter for any results related to Isa Qassim yielded hundreds of identical tweets from accounts ostensibly run by Arab looking men," he says, indicating that "these weren't retweets, but tweets that looked like they had been copied and pasted."

"Written in both English and Arabic, they were all identical. These tweets, all clearly in quick succession, suggested deliberate spamming to convince those interested in searching for information on Isa Qassim that he was indeed, a Shia terrorist," Jones stressed. "Yet after conducting preliminary searches, it was clear that the suspicious activity was not localised to hashtags related to Isa Qassim. Instead, there was similar activity on other hashtags, such as #Bahrain and #Saudi. Soon, activists following #Yemen in depth alerted me to suspicious activity on that hashtag too. The operation was larger than initially assessed."

Jones also noted that soon after the Bahraini authorities' decision to revoke Sheikh Qassim's citizenship, protests broke out in the village of Diraz, the place of Qassim's birth, stating that a study by the NGO Bahrain Watch revealed that "the authorities engaged in deliberate internet curfews on the village, a tactic designed to prevent people tweeting or dissenting on the internet."

Top Tweets Revealed Patterns

On June 21 2016, Marc Owen Jones queried Twitter's API for the phrase ‘Isa Qasim'. He said that he "received 628 tweets in return. Of these 219 were identical; that is, tweets with the text ‘Isa Qasim, the #Shiite #terrorist, telling followers to annihilate #Bahrain's Security Forces'."

On June 22, he requested tweets from the Twitter API under the #Bahrain hashtag. This returned 10887 tweets from a 12 hour period. Between 10 and 12 July, he queried the Twitter API on the ‘Yemen hashtag. 11,541 tweets were pulled from the Twitter API over an approximately 48 hour period.

Analysing the tweets, Jones stresses that they "revealed patterns that indicated, beyond reasonable doubt, that the accounts were linked to some institution, individual, or organisation for the purpose of promoting certain ideas. Some of the patterns suggest that the accounts may be deliberately automated, yet it is also feasible that they are operated by a group of people working in the same organisation/institution."

Thus, he came to the conclusion that "there are only a limited number of unique tweets, each of which is cycled repeatedly by the Twitter accounts on loop."

"Every one of the tweets from each suspicious account, with the exception of their first tweet, were launched from TweetDeck - a programme favoured by marketeers that allows one to manage multiple accounts from a single machine."

He further points out that "examining new accounts highlighted an interesting pattern. The very first tweet from one of these accounts contained an unusual idiom, saying, or phrase in Arabic. This idiomatic phrase was always launched from ‘Twitter Web Client', while the rest of the tweets were launched from TweetDeck. I tested this on about 10 of the accounts registered on 23 June 2016. One of the examples was ‘البس يحب الخناقة', the idiomatic translation of which I am told is ‘People love their oppressors lit: cats love their stranglers/cats love to fight'."

"All the accounts have a similar, low number of followers and people they follow. This tends to range between 30 and 60 followers. Most of them also follow specific, mostly Saudi-based news sites, that engage in similar propaganda," he adds, noting that "all the accounts were created in batches on consecutive days within certain months."

"Accounts created on the same day tend to have a similar number of tweets," Jones explains, further stressing that "the correlation between the date of account creation and number of tweets is interesting, especially given that the older accounts actually have less tweets."

He clarifies that "the creation date of each count defines its biographical information," saying that this would "suggest that no one is updating the old biographies."

"For example the accounts created in 2016, unlike the other accounts, have a biography and a header image. Accounts created after June 2016 also have birthplace information, and user-inputted locational information. This location is always the name of a town or city in Saudi Arabia. Certainly the filling out of this biographical data is designed to make the accounts look more credible."

He further states that "when you copy one of the Arabic tweets and paste it into Twitter's search facility, you get the Top Tweet, which in this case is the person who usually first tweets it. What almost always happens is that the first person to tweet the information was also one of the suspicious accounts. In particular, a lot of the recent tweets seem to originate with those suspicious accounts that were set up in 2016."

Jones explains that by doing a crude corpus-based aggregation, and after removing a lot of commonly occurring prepositions, "the most common word is ‘Allah', and various other religious idioms or pleasantries," stating that "this is perhaps to convey a sense that the accounts are pious or inoffensive."

CommonTweets on Isa Qassim Hashtags

Bahrain Watch's Marc Owen Jones states that the majority are actually on the #Saudi hashtag, and contain links to videos from the satellite broadcaster Saudi 24. The text in the tweets usually lionizes the Saudi government, or praises Saudi's efforts and intervention in Yemen, pointing to pro-Saudi propaganda.

He says that ongoing research by himself and Bahrain Watch "is further exploring this link with Saudi 24," noting that the sectarian tweets common on the Isa Qasim hashtags are; however, of particular interest.

"If you look at the table below, you will see that 51% (5556) of tweets on the Bahrain hashtag during the 12 hour period sampled on 22 June 2016 were most likely produced by bots or spammers with a sectarian, hate-inciting agenda. Of these 5556 tweets, there were only four unique ones, each tweeted hundreds or thousands of times by multiple different accounts."

Anti-Social Media

The relevant thing is that hundreds of what seems to be automated or spam Twitter accounts are repeating propaganda that conflates acts of violence, terrorism and unrest, with both Arab Shia and Iran.

Jones sees that "this strongly suggests that institutions, people or agencies with significant resources are deliberately creating divisive, anti-Shia sectarian propaganda and disseminating it in a robotic and voluminous fashion," stressing that "the problems here are numerous, yet such accounts can not only contribute to sectarianism (hard to infer causal relations from this), but create the impression that policies, such as the denationalisation of Isa Qasim, have widespread popular support."
"In addition, a vast majority of the accounts discovered actually tweeted nothing."

"While the notion of bot accounts is probably not news to anyone, the evidence here hopefully highlights that much online sectarian discourse is perhaps inflated by those groups or individuals with specific ideological agendas who have the resources to do so," says Jones.

He further highlights that removing all these ‘fake' accounts that are potentially up to a million, and many of which are, according to their profile, based in Saudi Arabia, would put a modest dent in Twitter's overall world-wide users," noting that "it would certainly affect regional figures, which tout Saudi as the most connected Twitter nation in the MENA region."

"In 2014 it was believed that 40% of 2.4 million MENA Twitter users were based in Saudi. If up to a million of these accounts were fake, this would almost half Saudi's Twitter subscription stats."

"Interestingly, one of the suspicious accounts we analysed whose followers mostly appear to be fake, saw a drop in followers of around 100,000 in the past few weeks," he notes.

He further says that "Whether they are bots or people paid to use TweetDeck to promote a certain agenda is not yet clear."

"It would, however, be logical to deduce from this that an organisation in Saudi, with or without government approval, is operating an anti-Iranian, anti-Shia, but pro Saudi government propaganda campaign on a massive scale."

Twitter Troll Armies

This operation fits in with the multiple variants of online troll armies, the impact of which is to insert disinformation or spread propaganda, says Jones. "In the case of what seems like a potentially automated operation, the high volume of tweets also leads to a flushing out of useful information."

"This means that those seeking legitimate information on the Gulf region are often being inundated with propaganda to such an extent, that it makes finding real tweets far more difficult when looking in real-time. This is especially true when these accounts are turned to hijack certain hashtags," he explains.

Concluding his article, Jones says that it still remains to be seen whether this is a state-sponsored operation, the work of a PR company, or a wealthy individual's unilateral project, but the scale is such that it certainly impacts upon the credibility of Twitter as a tool that allows people to share and receive ideas without barriers."

"It also sheds doubt on Twitter's ability or commitment to tackling online hate speech, he adds.

The Bahrain Watch director and researcher further states that even with the greatest intention by social media companies, "it remains a sad truism that the profound influence of certain agencies or states distorts the online public sphere by disproportionately allowing those with wealth and power to shape the nature of discourse available to other netizens."

Arabic Version