Royal Sockpuppets and Handle Switching: How a Saudi Arabia-Linked Twitter Network Stoked Rumors of a Coup in Qatar

On October 8, 2020 Twitter announced the takedown of 33 accounts linked to the government of Saudi Arabia. Twitter shared this network with the Stanford Internet Observatory on September 24, 2020. The network includes 220,254 tweets and dates back to 2010. Its early tweets are similar to other Saudi-linked disinformation operations. For example, accounts in the network used tools to automatically tweet verses of the Quran, likely to mask their true intent. From the end of 2018 through 2020, we believe the accounts began to change their usernames, in some cases to assume the identity of dissident Qatari royals and an exiled Qatari transitional government. One of these accounts had over a million followers, and several had tens of thousands. In May 2020 several accounts in the network pushed unsubstantiated rumors of a supposed coup attempt in Qatar. Much of the network appears to have been suspended in that same month. This report builds on investigations Marc Owen Jones (an assistant professor at Hamad bin Khalifa University, in Qatar) conducted at the time, when he independently discovered a portion of this network and verified that the coup attempt rumors were fabricated. While this network’s brazenness sets it apart in many ways from previous Saudi-linked disinformation operations, this is not the first time social media platforms have suspended Saudi-linked accounts. In December 2019 Twitter suspended 88,000 accounts linked to Smaat, a Saudi digital marketing firm co-founded by an individual with links to the Saudi royal family. This network was critical of the kingdom’s regional rivals – Qatar, Iran, and Turkey. In April 2020 Twitter announced another takedown linked to Smaat. This network included accounts that claimed to belong to ordinary citizens in various Middle Eastern and North African countries; their tweets expressed support for Saudi Arabia’s allies in their supposed home countries. Facebook suspended similar activity at the end of 2019. Key takeaways:
• The operation created fake Twitter accounts that assumed the identity of dissident members of the Qatari royal family, including Fahad bin Abdullah Al-Thani, who lives in Saudi Arabia. Prior to its suspension, Al-Thani’s account had more than one million followers.
• The operation also included a number of accounts that pretended to represent a Qatari government in exile. We believe that one of these accounts, @QtrGov, was the first user to mention the unsubstantiated rumor of the Qatar coup attempt on Twitter.
• Several of these accounts appear to have changed their usernames over time and wiped their earlier tweets. These tactics can increase account legitimacy; for example, the accounts could have engaged in spammy audience-building tactics (such as follow-back rings) for years, wiped those tweets, and then changed their name to, e.g., @QtrGov.
• While tweets about the supposed coup attempt received a few thousand interactions (quote retweets + retweets + replies + likes), Marc Owen Jones, an academic researcher, quickly identified and publicized the inauthentic network.
• The network spread fabricated Amnesty International and Human Rights Watch statements alleging that Fahad bin Abdullah Al-Thani was tortured in a Qatari prison.
• Many accounts in this network retweeted each other and/or engaged with each other’s tweets. A few accounts retweeted their own tweets.
• The network’s non-coup-related content is consistent with other Saudilinked disinformation operations we have analyzed in the past. For example, it pushed narratives critical of Turkey’s role in Libya and mocked Qatar with long hashtags.