AMITT/incidents/I00042.md

# Incident I00042: Saudi/Qatar bot dispute

* **Summary:** In the summer of 2017, Twitter bots—automated accounts—were deployed to boost messaging on both sides of the diplomatic dispute between Saudi Arabia and Qatar.” Calling this a “diplomatic dispute” understates the complexity of regional dynamics, at the center is an alleged report that Qatar’s emir, Sheikh Tamim bin Hamad al-Thani, had made an astonishing speech, and alleged “hack” of Qatar’s official news agency, and further woven into concerns Saudi Arabia has about the influence of public perception, the role of Al Jazeera. 

* **incident type**: incident

* **Year started:** 2017

* **Countries:** SaudiArabia , Qatar

* **Found via:** MIS

* **Date added:** 2019-02-24
 

| Technique | Description given for this incident |
| --------- | ------------------------- |
| [T0011 Hijack legitimate account](../techniques/T0011.md) | I00042T001 “hack” of Qatar’s official news agency |
| [T0021 Memes](../techniques/T0021.md) | I00042T004 memes |
| [T0024 Create fake videos and images](../techniques/T0024.md) | I00042T003 photoshopped/fake images |
| [T0054 Twitter bots amplify](../techniques/T0054.md) | I00042T002 Twitter bots amplify & manipulate |


DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW

Actor: 

* Saudi Arabia / Qatar /Turkey. 
* While the dispute is between these two Kingdoms, it’s with certainty that one can suggest Iran (both projection and the containment of its power/influence in the region) is at the center of it.

Timeframe: May - September 2017 

Date: May, 2017

Presumed goals: 

* The programmatic/synthetic amplification of respective “positions and/or plights.” 
* The respective hashtags can not be categorized as organic in nature, but launched in conjunction with the botnet deployments. As well, none of the identified bot related activity points to an effort to drown out/flood the opponents. 

Method: 

* Twitter campaign; bots/botnets seriously distorted the conversation on Twitter.
* Commercial botnets (these are created en masse and rented out to any user who is willing to pay for retweets, likes, and follow—either for their own account or for somebody else’s. They are thus the easiest and quickest way to obtain artificial amplification)
* On 24 May 2017, for example, pro-Qatar users launched the hashtag or “Qatar is not alone.”
* Supporters of Saudi Arabia also turned to apparently commercial bots to promote their messages. On 21 July, supporters of Qatar launched another hashtag, or “Tamim the Glorious,” in honor of the Emir. In response, supporters ,#تميم_المج ُد of Saudi Arabia used a botnet to attack the hashtag. The attack began when an account called @al_muhairiuae posted a photoshopped image of the Emir designed to make him look foolish.
* Combined with the Korean imagery, this suggests they were a commercial botnet that an unknown user rented to amplify the anti-Qatar tweet and to subvert the pro-Qatar hashtag, which had only just started to trend.
* At least one botnet seemed based in Turkey, joining the fray in mid-September in a bid to support Qatar.”

Counters: 

* Essentially the was a tit-for-tat campaign with a brief “incursion”/support/spike of activity most likely (but not officially verified) from Turkey in support of Qatar

* Global Research (Pro-Kremlin publication/organization located in Montreal, QC) contributed anti-Saudi spin via their blog. Global Research (anti-Saudi… campaign); Global Research (more)

Related incidents: 

* Jamal Khashoggi incident will bear hallmarks of the incident, but moves beyond a regional information operation into one of global significance. In 2018 the NY Times investigates Saudi Arabia’s Troll Army

References: 

* https://www.globalresearch.ca/saudi-arabias-march-towards-civil-war/5616699
* https://www.globalresearch.ca/the-machiavellian-plot-to-provoke-saudi-arabia-and-qatar-into-a-blood-border-war/5593870
* https://www.nytimes.com/2018/10/20/us/politics/saudi-image-campaign-twitter.html
* https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf
* https://www.washingtonpost.com/news/monkey-cage/wp/2017/06/07/hacking-bots-and-information-wars-in-the-qatar-spat/
* https://www.independent.co.uk/news/world/middle-east/russian-hackers-qatar-fake-news-gulf-diplomatic-row-fbi-doha-saudi-arabia-bahrain-uae-egypt-a7776446.html
* https://qz.com/1107023/the-inside-story-of-the-hack-that-nearly-started-another-middle-east-war/
* https://theconversation.com/the-world-cup-in-digital-and-social-the-viewers-the-tweets-and-the-trolls-99625

* https://www.bbc.com/news/blogs-trending-44294826
* https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf

Datasets:  Mining and analyzing Twitter data is unlikely to “prove” or offer much more insight than Ben Nimmo’s work.

Notes: 

Given the apparent use of commercial botnets, it’s difficult to attribute much of the activity to state actors, however it is fair to suggest some of this behavior would undoubtedly needed tacit state support… private “patriots” of the state?

This article https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf highlights the mechanics and dynamics of the bot operations/amplification in some cases to short life span of the activity and assets (quickly deleted from the platform), but doesn’t communicate the underlying political issues that drove these incidents.
 
The focus of these Arabic-language hashtags was clearly local and regional rather than international; this was a question of messaging to the domestic population and to Arabic-language rivals, rather than the non-Arabic-speaking world.
Claims of Russian involvement/hack are reported by both the Washington Post and the Independent UK (cites CNN as source). Quartz as well cites the Russian connection, further citing documentation shared with them via Qatar (flimsy at best) and further point blame for the affair at President Trump. 

Post incident - Given Qatar is hosting the 2022 World Cup of Soccer, the World Cup 2018, was a “test” ground for this ongoing online “war” while subtle was evident (Mentionmapp Analytics… John’s research)