This is part of a series of investigative reports published in collaboration with Daraj media

Arabi Facts Hub 28.11.2022

Supporters of Shiite Iraqi forces utilize Facebook groups and the Telegram application to rally their supporters, encouraging them to participate in on-the-ground events as well as engage in electronic campaigns.

__________________________________________________________________________________

Arabi Facts Hub (AFH) is a specialized research project that utilizes software to support Arab fact-checking platforms. This includes establishing a unified technical standard database that aggregates content from fact-checking platforms electronically. This enables wide-ranging search and analysis tools. The project aims to integrate artificial intelligence and machine learning techniques into its framework. Additionally, the project provides services, such as the "Eye on Twitter" reports, utilizing technological tools to track and identify sources of misinformation campaigns and hashtags associated with misleading news on social media. "Daraj" publishes this report in partnership with AFH.

__________________________________________________________________________________

Iraq has been in a state of political deadlock since the parliamentary elections in 2021. This continued until the government of Mohammed Shiaa Al Sudani, candidate of the Coordination Framework, which comprises Shiite forces loyal to Iran, gained the confidence of the parliament in October of last year. The online space transformed into a battleground where these political factions clashed with Muqtada Al Sadr, a prominent Shiite leader who opposes Al Sudani.

Supporters of the Coordination Framework continued to attack the Sadr movement, which enjoys widespread popularity. However, at the beginning of October, the intensity of these attacks heightened significantly with a powerful online counter campaign.

Arabi Facts Hub attempted to trace this coordinated activity carried out through accounts of ordinary individuals along with a network of fake accounts. It also shed light on the main actors in the campaign and the mechanisms various factions use for virtual mobilization and rallying.

The campaign against Muqtada Al Sadr came after his supporters took to the streets in September, as part of a series of protests in recent months, which culminated in the storming of government headquarters, parliament, and the presidential palaces within the heavily fortified Green Zone in central Baghdad.

In June of last year, Al Sadr announced the resignation of 73 deputies from his movement in parliament, thereby granting the Coordination Framework bloc the parliamentary majority. Simultaneously, Al Sadr opposed the Framework's candidate as leader of government.

The situation in Iraq sunk into turmoil for a year, with Shiite forces grappling for power. Meanwhile, the government of the former Prime Minister Mustafa Al Kadhimi lacked the constitutional authority to decide to reorganize elections until the breakthrough occurred with the confidence given to Al Sudani.

What happened?

Protests erupted in Iraq on the anniversary of the popular independent youth movement of October 1, 2019, which had led to the ousting of former Prime Minister Adel Abdul Mahdi, who was closely associated with pro-Iranian groups. This was part of a wave of dissent against the corruption of the ruling elite and the deterioration of services and living conditions.

Hashtags surfaced, targeting Sadr movement participants in the protests at Tahrir Square and the Republic Bridge leading to the Green Zone. Notably, the hashtag #Reform_Humiliates_Security_Forces gained traction, amassing 413 tweets, 2923 retweets, and 4746 likes, with its activity peaking on October 1. "Reform" refers to the political arm of the Muqtada Al Sadr movement, while Saraya Al Salam is its military wing.

Participants used the hashtag to tweet images, videos, and text. The posts reflect a concerted effort to tarnish the image of the Sadr movement by highlighting its alleged involvement in clashes with Iraqi security forces on the Republic Bridge. Tweets specifically emphasized incidents such as "assaults using bottles and stones against riot police forces," "moral and ethical misconduct," and the "presence of weapons" during the protests. This campaign also ignited discussions about divisions between supporters of Muqtada Al Sadr and the "October Group. There was also dissemination of misleading information, including claims of a low number of participants in the protests aimed at diminishing their impact. This misinformation was debunked by the page "Sahih Iraq," which is dedicated to fact-checking news. 

Opening move

On the morning of October 1, 2022, the account "Zainab Al-Muqawama@qd_isn" kicked off tweeting under the hashtag #Reform_Humiliates_Security_Forces. The tweet featured a video showing a group of individuals hurling stones at security forces on the Republic Bridge. On taking a closer look at the account's content, we observed its involvement in other hashtags that attacked the prime minister and promoted the Coordination Framework’s candidate whom the Sadr movement opposed at the time.

The account had numerous tweets under the hashtag #Mohammed_Shia_Hope_of_Iraq, which emerged a few days after the hashtag attacking the "Reform" faction, and has since garnered 284 tweets, 2324 retweets, and 5466 likes.

While the map of the most active accounts on the first hashtag varied, the account @hussenn31331 stood out with a total of 17 tweets posted under the hashtag. The account features the logo of the Popular Mobilization Forces, closely aligned with Iran and formed in 2014 to participate in countering the terrorist invasion of ISIS into Iraqi territories. The account's profile picture displays the emblem of the Popular Mobilization Forces.

Tweets from this account include images of the Iranian Supreme Leader Ali Khamenei and the Secretary General of the Lebanese Hezbollah, Hassan Nasrallah. Hezbollah has previously engaged in regional online campaigns outside of Iraq. The account also contributed to the hashtags #Delimitation_of_Maritime_Borders and #At_Your_Service_Khamenei.

Since its creation in June 2022, the account has tweeted over 6,000 times, a clear indicator of abnormal activity. The account has "friendship" relationships and mutual followings with at least six accounts that were among the most active on the hashtag, namely @A__dam1, @najmaa_97, @ali_aldor313, @hrwf_313, @saja_d96, and @AlRshfat.

Illustration of the most active accounts on the hashtag #Reform_Humiliates_Security_Forces

Notably, one of the prominent accounts on the hashtag, @al_asaibi, had its Twitter activity suspended during our analysis, but the InVID tool was able to preserve its tweets. The account was associated with an individual named Murtadha Al Asa’ebi.

By the minute... Discovery of a script that a network of fake accounts will publish

Our investigation into the account @20yahia1920, one of the most active accounts on the hashtag #Reform_Humiliates_Security_Forces, led us to uncover a network of fake accounts that assist in amplifying and spreading hashtags supportive of the Coordination Framework. The account is part of Twitter lists containing accounts that support opponents of the Sadr movement.

On examining the account's content, we noticed its use of the term "campaign" in reference to launching promotional hashtags. For instance, in an early September tweet, it announced, "God willing, at 5 PM, a campaign by the servants of [..] Imam Al Hussein will be launched on Twitter." The account tweeted a hashtag #We_will_sue_AlKadhimi, which peaked on October 9, with a total of 616 tweets, 986 retweets, and 1451 likes.

On reviewing the hashtag's content, we noticed tweets from the account @lwny13720694 containing a script for posting specific phrases on the hashtag at certain times. The timings were extremely precise, with scripted variations from one minute to the next. It is unknown whether this script was intentionally shared on Twitter or if that was a technical error from account management. The account was created on August 11, and it has only 9 followers with over 400 tweets.

While the existence of predefined scripts to determine how fake accounts operate is a known practice, openly sharing these scripts on social media is a rare occurrence. We revisited the hashtag during these times and found that the phrases were posted by multiple accounts almost simultaneously. This strongly indicates that these are automated fake accounts posting tweets based on predefined scripts.

This hashtag emerged shortly after a statement was issued by Abu Ali Al Askari, the spokesperson for the Iraqi Hezbollah militia, on his Telegram channel at 09:53 on Friday, October 7. The first tweet, which included an image from the statement, appeared on Twitter at 10:22 PM using the hashtag.

Facebook… Notable individual accounts and pages gathering interactions

The Coordination Framework supporters' campaign on Twitter was echoed on Facebook. While active shared pages exist, the remarkable presence of individual accounts with a minimum of three thousand friends and followers is striking. Some of these accounts bear female names and do not post personal photos. Some accounts in their “friends” lists display profile pictures with the logo of the Popular Mobilization Forces and the Iraqi Hezbollah, as well as former Prime Minister Nouri Al Maliki, who leads the Coordination Framework.

The content of these accounts has zero entries of a personal nature, even though Facebook is typically more personal than Twitter, as the emotional aspect tends to dominate the platform over any other social network. Instead, these accounts fully engage in attacking Al Kadhimi’s government and the Sadr movement while actively promoting the Coordination Framework and its candidate,  Shia’ Al Sudani.

Aggressive content on these accounts regarding the Sadr demonstrations is consistently echoed, with strikingly similar posts.

We also noticed replicated content that was copied from the primary campaign's accounts and pages, subsequently posted on other Facebook pages. What sets these pages apart is that their content archives reveal a tendency to share recycled content from diverse Iraqi factions, coupled with general posts about life and emotions. This helped in garnering interaction from an audience beyond the mere followers of a specific political faction or inclination.

How supporters of the Sadr movement engage on social media

Much like many political forces and factions, the Sadr movement utilizes Telegram channels to mobilize supporters for on-the-ground events and to propagate online campaigns across various social networks. Typically, each faction maintains multiple channels.

In a Telegram channel affiliated with the Sadr movement, known as 'Twitter Call' and  boasting over 24,000 followers, calls are issued to disseminate hashtags, endorse them, and rally support for the movement's stances. Another notable channel is named 'One Maysan.' Hashtags are in circulation constantly on these Telegram channels. This is probably to sustain the engagement and participation of audiences, amplify visibility, and showcase the movement's influence and impact.

With the shift in political dynamics, Prime Minister Mohammed Shia’ Al Sudani and his political allies, the Coordination Framework, have become more susceptible to smear campaigns and criticisms from supporters of the Sadr movement. 

Throughout November, Telegram groups affiliated with the Sadr supporters were filled with hashtags opposing the government. The normalization with Israel was a particularly contentious topic, sparking attacks directed at the Coordination Framework and the government, while celebrating Muqtada Al Sadr's stance against establishing relations with the state of Israel. This was triggered by the appearance of Iraqi President Abdul Latif Rashid in close proximity to Israeli Environment Minister Tamar Zandberg, with Greek Prime Minister Kyriakos Mitsotakis separating them, as shown in official footage from Egypt during the COP27 Climate Summit in Sharm El-Sheikh.

In coordination with the 'Twitter Call' group, Telegram groups, such as the 'One Baghdad' group closely associated with the Sadr movement and boasting over 85,000 members, orchestrated the promotion of several hashtags attacking Rashid, Al Sudani's government, and the Coordination Framework.

These hashtags included: "#Coordination_Framework_Normalizes", "#Normalization_of_the_Coordination_Government_Will_Not_Pass", "#Coordination_Framework's_Normalization_Is_Shameful_and_Reckless", "#Leave_Normalizer", "#Coordination_Framework_Votes_for_a_Normalizing_President" (in reference to the Coordination Framework's vote in favor of electing Rashid as president).

The last detected hashtag by Sadr supporters before there migration to Telegram was #Iran_Violates_Iraqi_Sovereignty, in condemnation of ongoing Iranian airstrikes in the Kurdistan region.

The Sadr movement also utilizes Facebook groups to mobilize supporters in the virtual space. One such group, bearing the name of Muqtada Al Sadr's minister, Mohammed Saleh Al Iraqi, has approximately 64,000 members. The group issues calls to participate in 'elevating' hashtags on Twitter's trending lists, indicating that the Facebook group serves as a launching pad to other social media platforms.

During September, the hashtag #he_Phony_Will_Not_Rule Us was active on Twitter, seemingly referring to the Coordination Framework's candidate. The hashtag appeared several times in the 'Twitter Call' channel on Telegram starting from September 7, the same day it peaked. It then resurged strongly on September 26, 27, and 28. According to the graph below, tweets (indicated in orange) and retweets () indicated in blue) were often close, indicating that the activity around the hashtag is probably organic.

According to InVID estimates, the hashtag garnered 1119 tweets, 676 retweets, and 5617 likes.

While the activity of 751 participating accounts on the hashtag seemed normal, it was noteworthy to find multiple accounts identifying themselves as social media influencers.

In summary

• Supporters of the Coordination Framework rely on short-term campaigns, focusing less on the content they disseminate and more on the consistent presence of hashtags to support the framework's ideas and discourse.
• Supporters of the Coordination Framework employed a network of fake accounts to amplify specific hashtags.
• Some accounts participating in the Coordination Framework campaigns were part of or engaged in other regional online campaigns.
• Supporters of shiite Iraqi factions use Facebook groups and Telegram to mobilize for on-the-ground events and online campaigns.
• Twitter suspended one prominent account in the Coordination Framework campaign.