Analysis: Spammers and terrorist groups exploit Egyptian protest hashtags
Interest groups appear to be exploiting Twitter hashtags surrounding anti-government protests in Egypt.
Arab observer Monitoring has noted that pro-Islamic-State groups have been using bot accounts to urge Egyptians to abandon the “futile” protests and to support the jihadist group instead.
Other analysts say that huge numbers of tweets have been sent from previously dormant accounts as well as newly created ones in crude attempts to dominate the conversation. It’s not known who was behind these spam campaigns, or why.
There have been street protests in Egypt since Friday 20 September against President Abdul Fattah al-Sisi’s government after businessman Mohamed Ali posted a series of videos online accusing the country’s leader of corruption.
On Friday, over 400,000 comments were posted on the Arabic hashtag “The people demand the fall of the regime”. Users also posted under the tags “Describe Sisi”, “Leave”, “Friday of Rage” in Arabic and #sisi_out in English.
Last week, the “Enough Sisi” tag briefly reached 1m tweets before the deletion of spam accounts reduced the figure.
Pro-Islamic-State accounts
A BBC Monitoring analysis shows that accounts aligned with Islamic State group have sought to capitalise on the protests by repeatedly posting propaganda videos onto trending hashtags.
At least 20 pro-IS accounts were observed reposting Islamic State videos onto Egypt protest hashtags.
One video, which described President Sisi as a “tyrant” allied with “Crusaders” (ie the West) and accused him of killing young Egyptians, was posted hourly by an account (@afaqq200) using a third-party automation service.
The account used trending Arabic hashtags “Leave O Sisi” and “Tahrir Square” to gain traction, and it and other accounts involved in the campaign have since been suspended.
Jihadist social media is largely concentrated on Telegram after being forced off both Twitter and Facebook. But pro-IS accounts invariably spring up occasionally to take advantage of current events, the users knowing that they will have limited longevity.
The accounts used in this case appear to have been long-dormant ones hijacked by pro-IS users.
Spam accounts
Writer Erin Gallagher noted a large number of fake accounts posting near-identical content onto Egypt protest hashtags.
Her research, posted on her Medium blog, found that up to 20 per cent of Tweets using the Arabic “Tahrir Square now” hashtag originated from bot accounts posting via the IFTTT application.
IFTTT (If This Then That) is a service that allows a user’s personal technology to carry out an operation if certain conditions are met. The IFTTT website uses the harmless example of a user’s domestic appliance app switching on the porch light when their food delivery app reports an order is on its way – but it is being used by spammers to send out multiple messages on social media.
Drawing on observations made by US-based tech researcher Lobna Gouda, Ms Gallagher pointed out that many of the spam accounts were newly-created and “used western-sounding, female first and last names, others used a series of letters such as IIIIIIIIIlII12 — with a number on the end. They were not subtle.”
Ms Gallagher points out that it’s impossible to tell who was behind the pro-IS tweets “…but someone is trying to disrupt the digital trends that correspond to the protests in Egypt,” she wrote. “The protesters do not know who is behind the campaign, and it’s entirely possible that it’s black propaganda not associated at all with the protests, but designed to discredit and malign the protesters by attempting to link them to terrorists”.
Academic Marc Owen Jones also noted a huge number of newly-created accounts spamming protest hashtags.
Prof Jones’s analysis shows that nearly 1,500 of 9,713 unique accounts posting to a single hashtag had been created in September 2019. He says that, in a typical sample size, new accounts would account for less than one per cent of posts.
Instead, he points out, they have been responsible for 378,000 tweets, with one account (now furiously retweeting random content, presumably to cover its true purpose) having tweeted nearly 13,000 times since its recent creation.
The vast majority of these new accounts failed to disclose their location, Prof Jones says.
Is this part of a trend?
Even before the protests started in Egypt last Friday, hashtag manipulation appears to have been an issue.
Last week, the Arabic hashtag “Enough Sisi” reached over 1m tweets on Twitter after Mohamed Ali’s call to make it go viral.
By the next day, the number had dropped to approximately 800,000. This, BBC Monitoring explained at the time, is almost certainly because Twitter had deleted spam accounts which had been repeatedly posting the hashtag.
While many of the tweets on the hashtag were seen to be authentic, it’s clear that some users resorted to suspicious behaviour to boost the tag over the one million tweets goal.
There have also been accusations of “dirty tricks”, with anti-Sisi campaigners accusing pro-Sisi accounts of creating variations of the original “Enough Sisi” hashtag in order to drive traffic elsewhere.
Even though only about three per cent of Egyptians use Twitter, and given that social media is now closely monitored by the government, it is still seen as a mobilising factor in dissent, and is influential enough for President Sisi to respond publicly to Mohammed Ali’s accusatory posts.
