Coordinated Behavior in Libya’s Regional Disinformation Conflict

Figure 1. Minute time-lapse of “The Egyptian Army” (#الجيش_المصري) hashtag, showing two suspicious spikes of tweets in a single minute.

We also found two suspicious spikes in account births. The number of accounts created on a single day can potentially indicate coordinated activity; an application or a person may create a large group of accounts at once in order to artificially inflate a hashtag. After analyzing all the accounts that tweeted this hashtag, we found two suspicious spikes in account births: 61 of the accounts were created on Jan. 5, 2017, and 62 of the accounts were created on June 8, 2020 (Figure 2). 

Figure 2. Graph of account creation dates for accounts tweeting on “The Egyptian Army” (#الجيش_المصري) hashtag, showing two suspicious spikes in account birth days.

After manually investigating these 123 accounts, we found suspicious similarities in the style of profile pictures included within each group. Many of the accounts were already flagged by Twitter for suspicious activity and shared the same or similar profiles and banner photos as other accounts. 

Figure 3. Accounts created on the two spiked account birth dates share the same or similar profile and banner photos.

Figure 4. Many of the accounts created on these two dates were already suspended or restricted by Twitter.

Analysis of the relationships between these accounts found the network to be incredibly dense, meaning that all 123 accounts were equally retweeting each other, with no single or smaller group of “influencer” accounts dominating (Figure 5). The network is an incredibly dense echo chamber, retweeting only within its own network and rarely interacting with accounts outside of those that were created on the same day. 

Figure 5. Gephi graph showing the density of the network of these accounts.

This coordinated, inauthentic campaign in support of the Egyptian army reflected changing dynamics on the ground. Whereas previous information operations strongly praised Haftar and supported his campaign for Tripoli, this online campaign did not focus on the Libyan general—indicating the departure of Haftar from the center of Egypt’s narrative on Libya. 

As Haftar withdrew, Egypt’s emphasis shifted quickly to shoring up domestic support and promoting domestic interests—namely, security along the western border. The specious promotion of the Egyptian military online demonstrates how digital manipulation is a low-cost alternative to direct military engagement. The most extreme language appears online, providing an outlet for nationalistic militarism at arm’s length from the regime. Domestically, this approach creates the perception that the regime is responding aggressively to threats to Egypt’s western border; for Egypt’s regional rivals, it clearly signals that these threats are Egypt’s red line. Bellicose rhetoric is reserved for the online theater and reflects Cairo’s underlying strategic objective: securing its porous western border.

Another hashtag, “Erdogan is a war criminal,” also exhibited suspicious characteristics. This tag trended on June 8, and we collected 12,995 tweets containing it between June 2 and 9. Tweets contained in the hashtag included vitriolic attacks on Turkish President Recep Tayyip Erdogan, with crude jokes and memes that often portrayed him as an ape. Users tweeting on the hashtag were located in Egypt, Saudi Arabia, Kuwait and the UAE; however, the importance given to this location data must be approached with caution as accounts self-report their own locations. As with the previous hashtag, there was a suspicious spike of 151 tweets in a single minute at 5:36 p.m. on June 8.

Figure 6. Minute time-lapse for the hashtag “Erdogan is a war criminal” shows a suspicious number of tweets created in a single minute.

We also identified a spike in account births, with 133 accounts created on June 8, the day the hashtag trended (Figure 7). 

Figure 7. Graph of account creation dates for accounts tweeting on “Erdogan is a war criminal” hashtag, showing one suspicious spike of account births.

Interestingly, we found that Ahmed Moussa, an Egyptian presenter on Sada El-Balad satellite channel, announced the creation of this hashtag live on his show (Figure 8). This could be part of a tactic called “hashtag laundering,” where traditional media announce and promote hashtags to obfuscate their inauthentic origins. This technique was identified in previous information operations targeting Libya. For example, Stanford’s Internet Observatory found many examples of this technique, whereby media outlets would report on inauthentic hashtags in an effort to make them appear genuine and authentic. At the same time, it is also possible that a number of Egyptians saw the presenter’s plea to tweet the hashtag, signed up for Twitter immediately, and tweeted as they were told. This demonstrates how traditional media interact with information campaigns on social media to legitimize and normalize narratives. 

Figure 8. Ahmed Moussa launches the hashtag “Erdogan is a war criminal” on the Sada El-Balad channel.

The tactics and techniques identified in these trending hashtags reflect previous research conducted on information operations targeting Libya. In September 2019, Twitter removed 271 accounts linked to digital marketing firm DotDev based in both Egypt and the UAE. Researchers analyzed the data released by Twitter and found that these accounts repeatedly spread propaganda targeting the Libyan conflict. In December 2019, Twitter removed 88,000 accounts connected with another social media marketing firm, SMAAT, based in Saudi Arabia. Twitter alleged that these accounts were part of a large state-sanctioned information operation conducted by Saudi Arabia that would target Libya. In March 2020, Facebook removed 55 pages that the company said were affiliated with a digital marketing firm named Maat, based in Egypt. Another takedown by Twitter in April 2020 removed accounts tied to Egypt, the UAE and Saudi Arabia, all of which contained evidence of operations targeted at Libya. 

These state-backed campaigns are pervasive and are conducted through the relative safety of third-party digital marketing firms that provide states with discretion and the technical knowledge to conduct complex influence operations. This digital theater of the war is dominated by non-state companies, acting on behalf of their state backers. Influence campaigns on Twitter are often connected with those on Facebook, where fake pages masquerade as legitimate news sources to further spread disinformation and propaganda narratives. News pages, while appearing neutral, act to launder and legitimize propaganda. Finally, there is clear coordination and sharing of resources between states in this regional alliance.

While the Egyptian, Emirati and Saudi axis overwhelmingly dominates information operations targeting Libya, some campaigns and hashtags in support of Turkey’s aims have surfaced as well. In June 2020, we observed two diametrically opposed hashtags, both of which exhibited suspicious behavior: “Libya, graveyard of Ottomans” and “Libya, graveyard of Sisi[.]” This phenomenon of battling hashtags with nearly identical language has been observed before in the Libyan context.

Uncovering these coordinated campaigns plays an important role in revealing foreign hands. Intervening states actively alter the discourse around important events in conflict to serve their interests; cutting through this propaganda enables a better understanding of the dynamics of these events and the views of those impacted on the ground. Moreover, uncovering these manipulated narratives leads to a better understanding of the interests these actors are pursuing. 

It’s important not to overemphasize the impact of these campaigns. Coordinated, inauthentic behavior orchestrated by foreign interveners occurs within a wider ecosystem of authentic online engagement, and assessing the extent to which these campaigns have impacted Libyan public opinion is difficult. More research is needed to understand the relationship between inauthentic activity and authentic activity, and how these contests shape domestic, regional and international attitudes toward the conflict. With only 9 percent of Libyans on Twitter, campaigns likely play out only within small circles of the country’s population. Instead, the primary target audience may have been international stakeholders, the media or perhaps the governments themselves.