Fake news network vs bots: the online war around Khashoggi killing

[November 01, 2018]  By Jack Stubbs, Katie Paul and Tuqa Khalid

LONDON/DUBAI (Reuters) - On Oct. 20, Arabic-language website alawatanews.com published a report that Saudi Crown Prince Mohammed bin Salman had been forced out of power.

Citing the official Saudi Press Agency (SPA), it said King Salman had signed a decree removing the prince "against the backdrop of growing pressure that accompanies the disappearance of journalist Jamal Khashoggi."

The report was false. The SPA has never published such an article, the wording and picture were lifted from a year-old royal court announcement about the removal of a former crown prince and MbS, as he is widely known, remains in his position.

The story and the website that published it are part of a fierce information war being waged online over the killing of Khashoggi, a prominent critic of the Saudi government last seen entering Riyadh's consulate in Istanbul on Oct. 2.

Automated accounts known as bots have flooded social media in recent weeks, many of them promoting messages which support Saudi Arabia and are intended to cast doubt on allegations that the kingdom was involved in Khashoggi's death.

But another effort has also sought to muddy the waters more broadly, using fake news websites and associated bots to sow confusion about developments inside the Saudi government.

Alawatanews.com is part of a network of at least 53 websites which, posing as authentic Arabic-language news outlets, have spread false information about the Saudi government and Khashoggi's murder, a Reuters analysis shows.

Investigators at Israeli cybersecurity firm ClearSky said a review of host-server addresses and registration details showed the websites were operating as part of the same network. Many of them also have near-identical design layouts and web addresses, or have published the same or similar fake news reports.

The alawatanews.com report, which said MbS had been replaced by his brother because of the fallout from Khashoggi's death, was typical of those articles. Another, published by a website called awwtarnews.com on Oct. 22, said an MbS aide had also been replaced for the same reason, which was not true.

After being published online, the false news articles were shared on Twitter by automated bot accounts -- many of which repeatedly posted links to multiple sites from the network.

Twitter suspended the accounts shortly after receiving questions about them from Reuters. Alawatanews.com, awwtarnews.com, the Saudi government and SPA did not respond to requests for comment.

A person called Mohammed Trabay with a registered address in Egypt is listed online as the owner and operator of the majority of the 53 websites. When reached by phone, a man who identified himself as Mohammed Trabay confirmed he was the owner of the websites but hung up when asked for further details.

In subsequent emailed comments he denied any connection to the network and said he had not understood the questions when asked by phone.

"Sorry, I can't help you," he said. "I don't have any relation with the sites you mention."



SAUDI ARABIA'S ELECTRONIC ARMY

The Saudi government initially said that it did not know what had happened to Khashoggi, a U.S. resident who wrote columns for the Washington Post, when he disappeared after entering its consulate in Turkey.

Under pressure to say more about Khashoggi's fate, and following Turkey asserting that he had been killed, Riyadh later changed its version of events to say he had died in a fight in the Istanbul consulate.

When that statement was also widely questioned, Riyadh offered a new explanation, blaming Khashoggi's death on a premeditated "rogue operation" in which Saudi individuals exceeded their authority.

U.S. President Donald Trump has said Saudi authorities staged the "worst cover-up ever" but has also made more conciliatory remarks that highlight Riyadh's role as a U.S. ally against Iran and Islamist militants, as well as a purchaser of U.S. arms.

Online, the journalist's death has served to show how governments and people are increasingly able to manipulate information and social media to further their political agendas, said Lisa-Maria Neudert, a researcher at the Oxford Internet Institute, a department of Oxford University.

"Setting up misinformation pages purporting to be real news, leveraging highly divisive and controversial current issues, and using fake accounts and personas to conceal the originators of attacks are somewhat of the ABCs of computational propaganda," she said.

A Saudi flag flutters atop Saudi Arabia's consulate in Istanbul, Turkey October 20, 2018. REUTERS/Huseyin Aldemir/File Photo

At the center of Saudi Arabia's online efforts is Saud al-Qahtani, a close aide to the Crown Prince who was hired in the early 2000s to run an electronic media army tasked with protecting Saudi Arabia's image, according to a source with ties to the royal court.

When Riyadh led an economic boycott against Qatar in June 2017, Qahtani was at the forefront of online attacks against the small Gulf state. On Twitter, he urged Saudis to tweet the names of anyone showing sympathy with Qatar under the Arabic hashtag "The Black List".

Qahtani was sacked on Oct. 20 over allegations that he was involved in Khashoggi's murder. A senior Saudi official said he had authorized one of his subordinates to conduct what was meant to be a negotiation for Khashoggi's return to Saudi Arabia. Qahtani did not respond to questions from Reuters at the time.

Saudi authorities have not disclosed whether or not he is in detention and the status of his "flies", as his electronic army is known, is unclear. The Saudi authorities did not respond to a request for comment.

Opponents of the Saudi authorities have also been active online. Facebook and other companies identified a suspected Iranian influence operation in August which used a network of sham news sites and fake social media personas to spread disinformation, some of it targeted at Saudi Arabia. Iranian officials have dismissed the allegations as "ridiculous".

MYSTERY PERPETRATOR

Twitter said it has removed large numbers of accounts for breaching its terms of use over the last two weeks, many of them originating from the Gulf region.

"Targeted platform manipulation and coordinated spam are a violation of the Twitter Rules and we will continue to enforce our policies vigorously," a Twitter spokesman said.

Reuters has found such bot accounts and influential Saudi users repeatedly posting hashtags on Twitter including "Qatari intelligence kills Khashoggi" and "Saudi Arabia the greatest," although it found no evidence Qahtani or the Saudi government controlled or directed those accounts.

Saudi Arabia's biggest online newspaper Sabq has also accused the international media, including Reuters, of using Khashoggi's disappearance to try to undermine the government, and released a statement on Oct. 21 saying a fake news story was being circulated under its name.

The websites identified by Reuters as spreading false news about the Saudi government have operated as part of the same network since 2017, said ClearSky analyst Ohad Zaidenberg.

All bar three of the websites have been taken down, although it is not clear who dismantled the network, when or why, said Zaidenberg, who previously tracked online influence campaigns for Israel's elite 8200 intelligence unit.

But the sites which are still online, as well as archived copies of those which are now disabled, provide an insight into the network's operations and aims -- to undermine the official Saudi version of events and spread confusion around its government.

"Saudi Arabia is considered to be one of the main powers in the Middle East. Accordingly, many operators of fake news infrastructure target the Saudi Arabian audience with increasing frequency," Zaidenberg said, adding that a perpetrator could not be identified at this stage.

Web-hosting and support companies Hetzner, GoDaddy and Cloudflare all declined to give any information about the websites' operator, citing client confidentiality.

(Additional reporting by Christopher Bing in WASHINGTON and Nafisa Eltahir in DUBAI; Editing by Timothy Heritage)

[© 2018 Thomson Reuters. All rights reserved.]

Copyright 2018 Reuters. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.  Thompson Reuters is solely responsible for this content.