This is part of a series of investigative reports published in collaboration with Daraj media

Arabi Facts Hub 08.11.2022

Arabi Facts Hub analyzed the nature of these virtual interactions during the oil crisis and highlighted active parties in the online campaign. This analysis attempts to understand how one of the largest cyber armies is organized to shape a significant part of public opinion, on one hand, and to attack opposing and critical viewpoints, going as far as discrediting, blocking, and pursuing their creators.

__________________________________________________________________________________

Arabi Facts Hub (AFH) is a specialized research project that utilizes software to support Arab fact-checking platforms. This includes establishing a unified technical standard database that aggregates content from fact-checking platforms electronically. This enables wide-ranging search and analysis tools. The project aims to integrate artificial intelligence and machine learning techniques into its framework. Additionally, the project provides services, such as the "Eye on Twitter" reports, utilizing technological tools to track and identify sources of misinformation campaigns and hashtags associated with misleading news on social media. "Daraj" publishes this report in partnership with AFH.

__________________________________________________________________________________

The announcement by the OPEC+ group on October 5, 2022, of a reduction in oil production by two million barrels per day sparked tension between Saudi Arabia and the United States. The U.S. perceived that Saudi Arabia sided with Russia, weakening the impact of Western sanctions on Moscow following Russia’s war on Ukraine.

The announcement put the administration of U.S. President Joe Biden and the Democrats in an awkward position ahead of the midterm elections, amid rising prices and inflation rates. Riyadh responded to Washington, stating that "the Kingdom does not accept dictates" and that the decision of the oil-producing bloc was motivated by economic, not political, reasons. Concurrently, with this rare response in terms of tone, an online campaign emerged to support the Saudi position.

Some hashtags were led by groups celebrated by the Saudi press, which have long engaged in online mobilization targeting Saudi Twitter users. This also involves tracking and baiting accounts critical of the government, leading to their closure and reporting to the authorities.

Activity on the hashtags appeared to be coordinated, in tandem with the escalating tension between Saudi Arabia and the United States following the Kingdom's support for the OPEC Plus decision to cut oil production, ignoring Washington's pressures to delay the decision.

Arabi Facts Hub analyzed the nature of these virtual interactions during the oil crisis and highlighted the active parties in the online campaign. This analysis attempts to understand how one of the largest cyber armies is organized to shape a significant part of public opinion, on one hand, and to attack opposing and critical viewpoints on the other, going as far as discrediting, blocking, and pursuing content creators.

What happened?

At exactly 2:07 AM on Thursday, October 13 (Saudi time), which corresponds to 6:00 PM Eastern Time in the United States, Saudi Arabia issued its first official response to the American threats and statements regarding the largest cut in oil production in OPEC's history since the spread of the COVID-19 pandemic. The Saudi response was accompanied by coordinated online activity, although it took nearly 12 hours before the first Saudi hashtag appeared expressing support for the Kingdom's statement and endorsing Crown Prince Mohammed bin Salman.

Simultaneously with the reactivation of the Twitter account of the Saudi Ministry of Foreign Affairs, the hashtag #The_Kingdom_does_not_accept_dictations was launched within a one-minute timeframe. The tweet from the ministry shared excerpts from the Saudi statement which echoed the sentiment expressed in the hashtag. It is unclear if that was a mere coincidence or if it was arranged, as the Ministry of Foreign Affairs published its tweet containing the statement at 4:28 PM Saudi time, while the hashtag appeared at 4:27 PM.

Within a week of its initiation on October 13, the hashtag garnered 1,188 tweets, 13,768 retweets, and 20,438 likes. Notably, the surge in retweet engagements (depicted in blue in the illustration below) significantly outpaces the number of original tweets from individual accounts (highlighted in orange), indicating coordinated activity and potentially inauthentic amplification of the campaign.

Verified Saudi accounts, some with hundreds of thousands of followers, played a significant and influential role in promoting the hashtag, such as the account of Munther Al AlSheikh Mubarak, which is followed by over 600,000 people. Saudi websites identify Munther as a Saudi businessman, while some sources have previously referred to him as part of "electronic flies". This term emerged years ago and initially referred to online influence campaigns originating from Saudi accounts. Eventually the term gained popularity across the Arab world.

Munther emerged as a prominent figure on social media, actively engaging in discussions on various Saudi and regional issues, including those pertaining to Yemen, Iraq, Iran, Syria, and Turkey. He quickly joined the conversation around the hashtag, being the second person to utilize it just 10 minutes after its inception. He tweeted, "The time for talk is over. #The_Kingdom_does_not_accept_dictates. Subsequently, Munther celebrated the sustained prominence of the hashtag among the most trending topics in Saudi Arabia for three consecutive days.

General Aziz and the Salmani cyber army

On our first encounter with the initial tweet posted under #The_Kingdom_does_not_accept_dictates, we noticed that Hamad Al Kariri's account, which posted 11 tweets on its own, added another hashtag to it: #The_Salmani_Cyber_Army. This refers to "an electronic national volunteer force...that has chosen Twitter as its platform with the aim of defending religion, leadership, and the nation." This campaign was founded by an individual named Aziz Al Qahtani on December 17, 2015.

But who is Aziz Al Qahtani, and what is the "Cyber Army," what are its objectives and operational methods?

Aziz calls himself the "Cyber Warfare General''. Not much information is available about Aziz, except for a photoshopped image that is attributed to him. His family name is linked to Saud Al Qahtani, former royal court adviser accused of orchestrating the 2019 murder of journalist Jamal Khashoggi in the Saudi consulate in Istanbul. Numerous reports described Saud Al Qahtani’s involvement in online campaigns and trolling. 

*Design for Aziz Al-Qahtani published on the Salmani Army website.

Aziz used the @mozmgr account to initiate the Salmani Cyber Army campaign before Twitter suspended it in 2017, as indicated by the latest interactions with that account. Aziz has other accounts, some he refers to as "war booty," suggesting that he took them over from accounts critical of Saudi Arabia, according to a comment on Twitter. He subsequently changed the name to match his primary account with the addition of the letter Z, so that it is @mozzmgr. But Twitter also suspended that account. There is also a third closed account under the name m0zmgr@jennifer.

The Salmani Cyber Army

The Salmani Cyber Army has been associated with numerous online influence campaigns on Twitter in recent years. It supported the government and Crown Prince Mohammed bin Salman during significant events, particularly the Gulf blockade of Qatar (2017–2021) and the campaign to arrest senior state officials and several Saudi princes on charges of corruption in November 2017.

The "Electronic Defense Line," has garnered notable attention from Saudi media since its inception. Interviews with its officials, including Aziz Al Qahtani, have revealed some details about it. The newspaper "Okaz" described it as the "largest voluntary national bloc in the Middle East" dedicated to defending against hostile cyberattacks. In statements to the newspaper in June 2017, Al Qahtani stated, "Our ambition is for the Salmani Army to be a national force supported by the nation’s citizens, including businessmen, media professionals, and officials, to contribute to noble volunteer work and repel the fierce cyberattacks against our country."

The group comprises 700 individuals, including ordinary people and journalists. Al Qahtani hopes to increase that number to 1000, as he wants "modern equipment and good programs to compete with hostile online blocs."

New members undergo a "20-day online course, during which they refine their skills and abilities, receiving electronic and intellectual support," according to statements by the official spokesperson for the electronic team, Ahmed bin Naqi, to Al Riyadh newspaper in September 2016.

The Cyber Army encompasses over 10 diverse subgroups, each with specific missions.

As per Al Qahtani, the operation is orchestrated "by allocating multiple groups, each assigned a distinct objective and pre-established modus operandi. There's a team of tweeps dedicated to raising awareness and sharing national achievements, another focused on reporting terrorist or anti-national accounts which oppose the nation, its leadership and people. Additionally, there are groups for graphic design and editing, technical support to bolster national accounts, monitoring tags and hashtags, infiltrated accounts, and operations, as well as a group for the training and qualification of new members. Each group is overseen by both a male and female member to facilitate task management."

In late 2017, the Saudi website "Nashr" published an illustrative diagram of the administrative structure of the campaign alongside an interview with its Deputy Commander, Ibn Zayed Al Qahtani, on the occasion of the second anniversary of the establishment of the "Saudi Cyber Army."

Ibn Zayed clarified that the leadership of the group includes Aziz Al Qahtani as the commander and founder, Saad Al Qahtani as the deputy, bint Salman as another deputy, Ibn Zayed Al Qahtani as a deputy, along with administrators and general supervision by: Mohammed Al Shamrani and bint Al-Sulaimi.

He also mentioned that there are "a number of supervisors, both male and female, who play active and distinctive roles within the group, each working in their respective areas, guiding members, and training newcomers on the work process, starting from scratch with each member."

By monitoring the activities and accounts of the group we noticed there has been focus on another name, Saad Al Qahtani, the deputy commander of the Saudi Cyber Army, led by Aziz Al Qahtani. We are not aware of the relationship between all individuals sharing the same family name, but there seems to be a connection among them. According to comments on Twitter, the man plays a significant role in managing the affairs of the “Army" and its affiliated subgroups. Available information suggests that he has a military background.

In an interview published by the Saudi website "Al Orouba Al Yawm" on December 21, 2021, the official spokesperson for the Saudi Cyber Army, Abdulhamid Essam Rajeh Al Harbi, stated: "I would like to express my heartfelt thanks to all my brothers and sisters in the Saudi Cyber Army, led by the dear and precious Saad Al Qahtani, who is responsible for the Saudi Cyber Army groups. He served for more than 30 years in the military sector, and after his retirement, he chose to continue as a dedicated soldier to his religion, country, and leaders, stationed on social media platforms, passionately expressing his views."

We found several accounts for Saad Al Qahtani @KSASAAdQ, @ssq_75, @Agahtanisaad, in addition to his account @kq_assq, which showed a screenshot of one of his followers depicting what the account looked like. Twitter closed Saad’s account @A_ABIN_SAAD in 2020, according to the latest interaction with this account.

Monitoring and targeting "opposing" accounts... Were opponents the victims of reports from the Saudi Cyber Army?

The Saudi Cyber Army includes a team called the "Cyber Reports Team," whose task is to "report terrorist accounts and accounts that oppose the nation, leadership, and people," as stated by Aziz Al Qahtani in his interview with the newspaper Okaz.

The campaign aims to “raise national hashtags to trending lists and tweet for the nation and leadership”. Its objectives include monitoring opposing accounts and actively working towards their closure.

In his interview with Nashr, Sa’eed bin Zayed Al Qahtani stated that the campaign is interested in "raising security awareness" and monitoring "provocative hashtags." “When an abusive account is detected, we find out who follows it, who supports it with retweets or opinions, and we collect the usernames and IDs, create lists and share them with reporting groups for joint action to achieve goals and close accounts." This is in addition to campaigns that "target" and "destroy" content on YouTube, according to statements by the spokesperson for the Saudi Volunteer Cyber Army, Ahmed Al Naqi, in an interview published on November 13, 2016.

Al Qahtani estimated the number of accounts closed monthly to be between 600 to 800 accounts. However the latest overall statistics published by the campaign in November 2021 indicate that the total number of closed accounts since the establishment of the Saudi Cyber Army exceeds 168,000 accounts. This is according to a Facebook post by Aziz Al Qahtani which contained a tweet from a female leader of the campaign who is responsible for design work.

Saudi authorities have made available the "Kollona Amn" (We Are All Security) app, which allows them to receive reports from ordinary citizens about incidents, including those on social media. It remains unclear whether the Saudi Cyber Army played a role in the arrests of Twitter users.

In recent years, Saudi Arabia has arrested numerous individuals, handing down lengthy prison sentences due to their tweets. This includes American-Saudi national Saad Al Madi (sentenced to 16 years in prison), activist Salma Al Shaibi (sentenced to 34 years), and preacher Salman Al Ouda, who has been detained since September 2017 following a tweet expressing hope for potential reconciliation between Qatar and Saudi Arabia.

An article by The Guardian published on August 17, 2021, suggested that the Kollona Amn app may have played a role in the arrest of Leeds University Ph.D. student Salma Al Shaibi. The report indicated that on November 15, 2020, Salma received a message from someone using a Saudi account, after posting a mildly critical tweet in response to a post by the Saudi government. At that time, the account owner informed Salma that they had reported her through the Kollona Amn app. While it is unclear whether Saudi officials directly responded to the report, Salma, a 34-year-old mother, was arrested two months later.

The Guardian also published a similar report on Saad Al Madi (72 years old), suggesting that he may have been arrested due to tweets criticizing the Saudi government seven years ago when he was residing in Florida, USA.

A tweet from the verified Twitter account of Saleh Al Sobeih, considered a "hero" of the Saudi Cyber Army, included a list of accounts who are described to be "fighting Arab media personalities, writers, and journalists, and libeling government officials, ministries, government departments, preachers, and scholars through their filthy Twitter accounts." Saleh's intention is unclear, as all the accounts he mentioned had already been shut down by Twitter. However, the tweet may provide an insight into how these groups organize their activities in pursuing those who criticize government authorities and supporters.

10 Apple watches for a tweet and an image of the Crown Prince

Among the popular hashtags discussing the Saudi response to American statements regarding OPEC Plus' decision, there were two hashtags emerged on the evening of October 13, with the same content: #Unifying_Mohammed_Bin_Salman’s_Picture and #Unifying_the_Crown_Prince’s_Picture_on_Twitter.

The first hashtag garnered 7,028 tweets, 27,305 retweets, and 44,237 likes. The first tweet using this hashtag was simultaneously posted by two accounts @_Columbuos, and @iRug, each publishing a tweet at 08:44 in the evening of October 13.

The first account, which brandishes the camel emoji and the flag of Saudi Arabia, did not post much but still gained significant engagement through the hashtag, accumulating over 5,000 retweets. The account has over 320,000 followers and is listed on Twitter lists created by Saudis, including one named "Saudi Shield." This list includes members such as Badr Al Asaker, the director of the office of the Saudi Crown Prince, along with accounts from State Security, General Security, the Ministry of the National Guard, the Kollona Amn app, as well as Munther Al AlSheikh's account.

He identifies himself as a "someone who enjoys exploration by focusing a microscope on counter-media and discovering the truth that has been hidden from people." The account never tweeted about the Saudi Cyber Army, but several accounts affiliated with the Army have interacted with its tweets.

The hashtag #Salmani_Cyber_Army appeared in conjunction with the hashtag #The_Kingdom_Rejects_Dictates in tweets that attacked U.S. President Joe Biden, referring to him as "an old ogre”. The tweets were accompanied by Saudi songs and scenes from Saudi drama.

Salman Cyber Army accounts were present in the hashtags #Unifying_Mohammed_Bin_Salman’s_Picture and #Unifying_the_Crown_Prince’s_Picture_on_Twitter.

Some promoters of these hashtags resorted to traditional marketing methods, such as offering prizes for the most active participants in tweeting or those expressing loyalty and support for the Saudi government and Crown Prince. On the morning of October 14, Saudi businessman Abdulaziz Ahmed Baghlaf (587K followers) announced prizes in the form of 10 Apple watches "a gift for those participating, a picture of my lord the Crown Prince as your avatar is a condition for the gift with the hashtag #Unifying_the_Crown_Prince’s_Picture_on_Twitter". 

The total number of tweets using the hashtag was 2,653, with 16,159 retweets and 24,308 likes. Abdulaziz Baghlaf's share of these included 634 tweets that featured the hashtag and were directed to his account through replies and mentions. In addition, his tweet received 3,000 retweets and 3 likes.

Later, Baghlaf announced the winning accounts in a tweet.

Baghlaf's estimated wealth is around 200 million Saudi Riyals (53 million dollars), and he is active in the real estate sector. He is also a prominent donor to Saudi sports club Al Nassr.

In summary: 

• Hashtags emerged with coordinated activity, coinciding with the tension between Saudi Arabia and the United States following the Kingdom's support for OPEC Plus’ decision to cut oil production, disregarding Washington's pressures to delay the decision.
• The coordinated activity was led by the so-called Saudi Cyber Army, which has been involved in various campaigns of targeting and influence in relation to significant events involving Saudi Arabia, such as the Gulf blockade of Qatar and the stance on the Muslim Brotherhood and Turkey.
• The Saudi Cyber Army is led by individuals with military backgrounds, including Saad Al Qahtani.
• The rare and confrontational Saudi response to the United States was accompanied by an organized campaign through the hashtag #The_Kingdom_Rejects_Dictates.
• Accounts with large numbers of followers, some of which are verified, contributed to the promulgation of the hashtags.
• Saudi businessmen, social media influencers, and journalists participated in the campaign. Some of them employed marketing techniques by offering prizes to those who promote the hashtags and demonstrate loyalty and support to the government and the Crown Prince.
• Some accounts used fake names or aliases and were part of previous electronic campaigns.

Tools used:

InVID Verification Plugin

Twitter Search

Gephi

Mever

Twitonomy