The leaking of personal photos of the Jordanian Crown Prince, Prince Hussein bin Abdullah, and his wife, Raghad Al-Sayyaf, taken during their honeymoon, coincided with a new law on cybercrimes that the government hesitated to introduce. The law was approved by Jordan's King Abdullah II after being passed by both the House of Representatives and the Senate on August 12th.

Social media platforms, especially Twitter, saw coordinated electronic campaigns in Jordan to facilitate the passage of the new Cybercrime Law. Tweets were launched to amplify and increase the popularity of hashtags supporting the new legislation. There were 24,000 tweets from accounts that did not disclose their geographic location, but the analysis revealed an Egyptian network of fake accounts contributing to the momentum around the hashtags, especially #I_support_Price_Hussein and #We_are_all_the_Jordanian_Crown_Prince 

The leaking of personal photos of the Jordanian Crown Prince, Prince Hussein bin Abdullah, and his wife, Raghad Al-Sayyaf, taken during their honeymoon, coincided with a new law on cybercrimes that the government hesitated to introduce. However, it was approved by Jordan's King Abdullah II after being passed by both the House of Representatives and the Senate on August 12th.

Amidst an atmosphere of discontent regarding the photo leak, coordinated digital campaigns emerged, possibly preparing the ground for the parliament's discussion and urgent approval of the law during an exceptional session. This raised societal and human rights concerns about its potential use for suppressing freedoms and pursuing individuals based on their social media posts.

Accounts supportive of the regime participated in the campaign. The same accounts had previously participated in advertising campaigns for the Jordanian government and the royal family on social networks. Additionally, an Egyptian network of fake accounts and others known for launching campaigns to promote the Egyptian government and attack its opponents, contributed to amplifying the campaign.

On August 16th, only a few days after ratifying the Cybercrime Law, King Abdullah II met with rights activists and journalists at the Al-Husseiniya Palace. He insisted that Jordan "is not an arbitrary state and will never be.” 

Various hashtags emerged around the #Cybercrimes_Law, expressing support for the Crown Prince with hashtags such as #I_support_Price_Hussein and #We_are_all_the_Jordanian_Crown_Prince. Others called for #Criminalizing_defamation_in_Jordan and #Protecting_Societal_Security, aligning with the government's insistence on achieving "pubic and private deterrence" through the new legislation.

These hashtags appeared just before the convening of the House of Representatives to discuss the law on July 17. The interaction patterns showed spikes at various times, with the most significant occurring on the day of the parliamentary session and the following day.

According to Meltwater estimates, the hashtags included more than 34,000 tweets, seen by 14 million accounts, with a potential visibility range of 32.5 million accounts. The retweet rate was higher than normal, around 64.5% of the total tweets, indicating coordinated activity.

Why did the hashtags spike?

Approximately 10,000 accounts participated in tweeting using the five aforementioned hashtags. These accounts included those of major Jordanian and Arab news outlets, as well as accounts expressing opposition to the law, which explains why the majority of their tweets focused on the hashtag #Cybercrimes_Law.

An analysis of the countries from which the tweets originated shows that over 24,000 tweets came from accounts that did not specify their geographic location. Saudi Arabia led among the identified locations, followed by Jordan, Palestine, Egypt, Kuwait, and Yemen.

When we closely examined the tweets from Saudi Arabia, we noticed, for example, that the majority of accounts were not necessarily engaged in expressing the topic of the hashtags. A significant number of them were low-quality commercial advertising accounts that thrive on popular hashtags to promote products, light content, or seek opportunities for exposure. Additionally, some of them were advertising their cyber services in recovering hacked accounts or offering hacking services.

Alongside this type of accounts with tens of thousands of followers, there were other Saudi accounts actively participating in the tweeting wave.

Intentional amplifying using Jordanian advocacy accounts

In Jordan, accounts actively promoting the government and the royal family, as evidenced by their continuous activity, played a role in amplifying the official narrative supporting the law. This was particularly evident in hashtags advocating for the law and opposing the posting of pictures of the Jordanian Crown Prince.

The total number of tweets from accounts with specified geographic locations in Jordan on the hashtags amounted to 1567 tweets. There were also 1170 tweets from one account that did not specify its geographic location.

The account is owned by an individual named Al-Dari Al-Maqbali, who resides in Jerash, northern Jordan. According to the information on his Facebook account, he studied history and political science at Yarmouk University. On his Twitter and Facebook account, Al-Dari shares the same data and images, with a picture of King Abdullah II replacing his profile picture. He has chosen a photo of himself with the king for the cover photo, and he writes the same phrase: "I am #AlDari, the striking serpent that you know is as venomous as a decaying snake's head."

Al-Dari is an active member of Facebook groups, including unofficial groups for general intelligence, "The Hashemite Family in the Heart, We Are Hashemite, Combating Terrorism and Combating Extremist Thought."

Al-Dari's tweets were seen by over 76,000 people and were potentially visible to over 508,000 accounts, according to Meltwater.

Other advocavy accounts have been active at unnatural tweeting rates, such as the account @أShaqAlmlk, which has over 30,000 tweets since its creation in December 2021. It participated in hashtags supporting the Cyber Crimes Law with a balance of 254 tweets, all posted by itself, mainly using the hashtag #We_are_all_the_Jordanian_Crown_Prince 

Similarly, there is an account named @Laith08932704, which tweeted 77 times on the same hashtags, especially #Defending_Societal_Security. It has accumulated over 10,000 tweets since its creation in July 2022 and has a prominent history of promoting the king and the government. This account has been suspended by Twitter before.

Fake Accounts Lead to the Trending of Jordan’s Crown Prince

The hashtag #We_are_all_the_Jordanian_Crown_Prince gained traction during the discussions in the Jordanian Parliament regarding the Cyber Crimes Law. The hashtag was among the most discussed topics in Egypt on July 18. Around 465 "Egyptian" tweets contributed to pushing the hashtag to the local trending list. Activists such as Wael Abbas, who questioned the popularity of the hashtag in Egypt, were involved. Notably, individuals known for launching online campaigns and defending the president and government, such as Luai Al-Khatib and Bassem Bakheet (Al-Maestro), also participated.

In addition to Al-Maestro and Al-Khatib, there was a cluster of fake accounts participating in the Egyptian tweeting wave on the Jordanian hashtag. These accounts were created within a close timeframe, between February and June 2023. They use archival images from the internet, and some appear to have real people's images but are likely stolen.

Additionally, there are accounts dating back to 2011, 2012, and 2014. These accounts seems to have been compromised, as tgeir handles or usernames bear foreign names that are different from the current displayed names. Examples include @DanielaTapia1D, originally created in November 2012, and @XBlieberXl, created in March 2011 and now named "Menna Ali."

These accounts almost replicate content with slight variations. They were engaged in amplifying the hashtag #Sisi_in_Saloum, with attempts by operators of these fake accounts to make their tweets appear as if they belong to real individuals. This pattern reveals a new approach by operators of fake accounts in Egypt, characterized by rare repetition of content, making it challenging for Egyptian activists and journalists to detect and capture it easily, as they could in previous years.

These practices also highlight a new pattern in the activities of fake account operators in Egypt, where there is a noticeable interest in the content of the tweets and the intended discourse. This suggests that an entity or professional company is likely behind these accounts.

The content of these accounts also includes attempts to camouflage their nature by disseminating non-political tweets, such as casual conversations or retweets of light content.