Online comments by Omar Alaa Mubarak, the grandson of former Egyptian President Hosni Mubarak, on the economic situation in the country, sparked a backlash from supporters of President Abdel Fattah El-Sisi.

A campaign erupted after comparisons were made on social media between the current difficult conditions experienced by Egyptians and the situation during Mubarak’s reign, which lasted for 30 years, before the revolution of 2011 brought it to an end. 

Accounts that had previously participated in advertising campaigns for the Egyptian president took part in launching the campaign. They also employed fake accounts of high quality to amplify and increase the popularity of the campaign's hashtag, which garnered thousands of posts amid a cross-platform circulation of content between "X" (formerly Twitter) and Facebook."

Official media outlets affiliated with the regime, in addition to media outlets owned by the United Company, participated in the campaign. Islamist media also engaged in the ongoing debate by focusing on the statements made by the well-known presenter Lamis Al-Hadidi and the verbal clash between Mahmoud Badr and Omar Alaa Mubarak.

This comes as Egypt is facing a severe economic crisis, manifested in the decline in purchasing power due to high inflation rates, rising prices, and the country's shortage of foreign currency reserves. Central bank data indicates that Egypt is required to repay around $42.3 billion during the year 2024.

What happened?

On January 25th, Omar Alaa Mubarak began a series of posts on his social media accounts, mocking the government's performance and the economic situation in Egypt. On the afternoon of the 27th, he posted an infographic representation of the evolution of the debt starting from the last year of Mubarak's rule (2010).

Within a few hours of the tweet, the hashtag #dont_forget_Mubaraks_crimes appeared, containing about 20,000 tweets on the X platform (formerly Twitter). This included 14,000 retweets and 3,300 replies, while the total number of original tweets was only 820, according to statistics from Meltwater, a leading social media content analysis platform. It's worth noting that original tweets do not come from accounts owned by real individuals. Rather, the term implies that these tweets were directly posted without appearing as retweets or replies.

According to the diagram below depicting the interactions on the hashtag, there was both a sudden spike in hashtag usage at the same time and a 73.5% increase in the retweet rate. This usually indicates deliberate and coordinated activity rather than spontaneous engagement.

The hashtag was seen around 895,000 times, with a potential reach of about 9,680,000 other accounts.

Meltwater statistics indicate that 14,000 tweets posted under the hashtag were from accounts with an unknown geographical location. This is another indicator of organized activity. As for the accounts with known locations, the majority of tweets originated from Egypt, followed by Saudi Arabia, Yemen, Kuwait, the United Arab Emirates, Syria, Iraq, and Jordan.

Who blew the whistle?

The emergence of the hashtag was associated with accounts that are accustomed to launching promotional campaigns for the Egyptian president. Among them is 'The Maestro,' who manages a plastics products factory in the eastern suburb of Ain Shams in Cairo. Previous investigations have revealed the nature of the role he plays in the propaganda machinery for the ruling authority in Egypt.

Based on the self-chosen stage name, The Maestro leads the campaign, signaling the start or initiating the wave of tweets within his circle. He also mobilizes support through his accounts and sometimes contributes to amplifying the campaign by pumping out numerous tweets using promotional hashtags, which have appeared several times in the list of the most trending topics on 'X,' for example.

Regarding the current hashtag, The Maestro maintained the lead as the most active account with 169 tweets on the hashtag. Looking back at his history of participation, he is more directly involved in this campaign than others, in which his participation is largely limited to signaling the start and orchestrating efforts.

In addition to The Maestro, some accounts with thousands of followers also contributed to the increased popularity of the hashtag, gathering a significant amount of interactions with their tweets. These include: @sANa4327194M0h, @AlasylKmal, @EnElgenSuzy512, @MissTota_, @bntmsr50, @Maha_SalahElDin, @Ciag_Misr777, @Abosamrah101" 

Parliamentarian Mahmoud Badr, known for his support for Sisi, also engaged in the campaign through retweets, further contributing to the spread of the hashtag, relying on his follower count that exceeds 300,000. 

The campaign triggered a direct clash between Mahmoud Badr and Mubarak's grandson. Badr criticized the comparison Mubarak made between the economic conditions during his grandfather's era and Egypt's current situation under Sisi.

Badr wrote in a tweet on 'X': “What Omar, the son of Alaa Mubarak, is doing is not nostalgia for his grandfather's days, because Omar was born in 2000. This means that when his grandfather left power in [2011], he had just overcome his need for diapers. But what he is doing is mocking the conditions of his country. I won't say it's ignorance, and I won't get into a story about the fact that the majority of our crises come from the current regime’s attempt to break from a very heavy legacy, and to dismantle corruption networks that his daddy knows very well.”

He added: “But what he needs to know is that mocking the country is not politics at all, not even courage. This is called a lack of upbringing, my dear. It's a shame, Omar, it's a shame, my dear. Be ashamed, and as long as your house is made of glass, don't throw stones at people, my dear.”

At that point, Omar Alaa Mubarak responded, saying: The day has come when, Mahmoud the drug addict directly addresses me.”

Fake accounts

5861 accounts actively participated in the wave of tweeting on the hashtag, including at least hundreds of fake accounts. Some of them were managed in a more sophisticated manner to escape detection by 'X' or the platform's user base, while others were operated in the classic way, characterized by repetitive content in their tweets. This suggests the possibility of the existence of two separate fake networks actively engaging with the hashtag.

Some accounts from the first fake network appeared in the list of the most interactive accounts, largely due to extensive retweet exchanges among themselves. 

Over the past few years, Meta (Facebook’s parent company) and 'X' have revealed the involvement of Egyptian companies operating in the digital marketing field in cyber campaigns inside and outside Egypt.

The activity of the first network reflects that it is managed in a more professional and skillful manner by its administrators. Each account used in the campaign has a distinctive profile picture, even if it is stolen from personal accounts or taken from the internet archive. The administrators also pay attention to enhancing the 'fake' information available about it, such as improving the 'Bio' section by providing information about the account owner. Statements such as “studies medicine” or “lives in Alexandria” are not uncommon. Sometimes, reference is made to one of the famous football clubs that the account owner supports.

The geographic location of the account is also added to its profile information, a trick known by some content creators on social media. Some experts, although it's an unconfirmed hypothesis but may have some validity, suggest that those responsible for fake accounts use this technique by adding different geographic locations and distributing them among the accounts they use.

Specialists in this field explain that the goal is to deceive 'X' by notifying it that there are tweets coming from multiple geographic points, leading to the hashtag appearing in the trending list at a faster pace.

A second distinctive feature of these 'dormant' accounts is that they appear superficially interested in entertainment content. They share quoted phrases and tweets that seem entirely personal, expressing impressions of human emotions and specific life situations. Occasionally, they engage in retweeting commercial products or celebrity accounts.

Periodically, they are summoned to participate in political campaigns with limited, non-repetitive tweets issued by each account to avoid easy detection of their activity or the observation of any connections between them. Instead, a large number of accounts are used to eventually accumulate a quantitative buildup of tweets on a specific hashtag. Retweets play a critical role in amplifying the hashtag.

For example, the account @Agj_779, which features a girl's picture and fits the aforementioned specifications, had only one tweet on the #Dont_Forget_Mubaraks_crimes hashtag. It was among the most interactive tweets, receiving retweets and replies. The account also engaged in retweet exchanges with active accounts on the hashtag, some of which indicated that they reside in Saudi Arabia but seem to be part of the network. 

Additionally, despite the account being named (Aya), it was notable that there was a phrase in the Bio written in the masculine form, stating: 'I don't know where I'm going, but I'm on my way [masculine in Arabic].”

When we attempted to search for the profile picture, Google Images linked the image results to the account. It also revealed a part of the account's activity in previous campaigns praising the government, Egyptian companies, and embellishing its involvement in the development of Benghazi, Libya, for example. It also contained promotional tweets for the president.

As for the second network of fake accounts, its activity was characterized by classic practices, such as the repetitive use of texts and content. These accounts bear foreign names, and some of them were created more than 10 years ago. One, @ezduzit071, even dates back to 2009.But they don't tweet regularly. This may indicate that they are accounts that have been taken over or have had their content deleted.

In contrast to the activity of the first network, the accounts of the second network activated the hashtag without writing content consistent with the hashtag's message. Instead, they wrote poetry or mundane phrases about impressions and feelings. We also observed that the same phrases were reused by the same accounts to promote other hashtags.

The common denominator between the two networks is their activity on promotional hashtags supporting the Egyptian president and attacking his opponents. They previously engaged with the hashtag #Tantawi_is_an_MB_puppet, which targeted Ahmed Tantawi, who had announced his candidacy in the recent presidential elections without actually participating, citing obstacles preventing him from registering the required endorsements to support his candidacy.

Readers can also try entering the phrase 'A picture of waves resembling mountains' into the 'X' search engine to observe a massive flood of repeated tweets with the same text and image. These tweets are accompanied by hashtags, all of which were part of propaganda campaigns in support of President Sisi.

There was also a trans-platform sharing of content used in the campaign. Content on 'X' was shared on Facebook to reinforce the narrative of the hashtag and its message. For instance, excerpts from the book 'The Khamasin Years' by the late author Yasser Rizk were circulated. The book talks about a political 'deal' between the Mubarak regime and the Muslim Brotherhood.

Egypt’s Media, the Brotherhood’s Media

The official Egyptian media outlets, owned by the United Media Services Company affiliated with a “sovereign entity,” i.e. the intelligence, joined the campaign attacking Mubarak’s reign.

In her program "Final Word," the media figure Lamees El Hadidi criticized the "days of Mubarak," stating that the idea of nostalgia for the Mubarak era and comparing the living conditions during his rule to the current era of Sisi is "not a new idea, and we know who is behind it."

El Hadidi blamed Mubarak for the current situation in Egypt, saying, "The roots of what we are experiencing now go back to 30 years of Mubarak's rule. His educational policy failed, healthcare deteriorated, Hepatitis C spread among Egyptians, and the rockslide in Duweiqa destroyed people's homes. Also, what the informal settlements produced, and the tuk-tuk entered our lives, and these are many examples."

Later, newspapers, including Al-Youm Al-Sabea, Al-Watan, Al-Gomhuria, and the website Al-Gomhuria, focused on El Hadidi's statements and published multiple stories based on what she said on her program.

Meanwhile, channels and media figures close to the Muslim Brotherhood focused on Lamees El Hadidi's statements and the verbal clash between Mahmoud Badr and Mubarak's grandson.

In summary:

• Following tweets from Mubarak’s grandson, criticizing the current economic situation in Egypt, a coordinated campaign to attack Mubarak’s reign emerged on social media platforms
• The whistle-blowers behind the campaign were individuals accustomed to participating in online propaganda campaigns supporting the policies of the Egyptian president and his government.
• The campaign utilized two networks of fake accounts to help increase the spread of the hashtag #Dont_forget_Mubaraks_crimes which gathered around 20,000 tweets, with 14,000 tweets coming from accounts with unknown geographical locations. There were only 820 original tweets.
• Each of these networks of fake accounts had a distinct set of characteristics. The first employed smart methods to evade detection, while the second was easily detectable. What united them was their consistent participation in campaigns supporting the Egyptian president.
• The percentage of retweeted content reached 73.5%, indicating the campaign’s ability to manipulate X’s policies to amplify the hashtag.
• Official media outlets owned by the United Company participated in the campaign against Mubarak in their own way. Meanwhile, Brotherhood-affiliated media focused on statements by Lamees El Hadidi and the verbal clash between Mahmoud Badr and Omar Alaa Mubarak.