Hacked Twitter accounts used to promote Saudi Arabia, leadership

Several verified Twitter accounts have been taken over by pro-Saudi operatives and some have been used to promote Saudi Arabia or its leadership, according to an academic who researches digital propaganda and Twitter bots.

At least four verified Twitter accounts, including one that belonged to a US meteorologist who died over two years ago, appear to have been hacked and sold to pro-Saudi entities, Marc Owen Jones wrote in a blog post on Saturday.

A verified Twitter account usually signals that the person maintaining it is who they claim to be.

One of the verified hacked accounts originally belonged to Weather Channel meteorologist David Schwartz who died in 2016.

That account, @TWCDaveSchwartz, has now been followed by dozens of pro-Saudi and Saudi-based accounts.

The account itself appears to have posted a single tweet, which praises the al-Qassim region of Saudi Arabia, and its governor, Prince Faisal bin Mishal. But a screenshot of the same account taken in 2018 shows it was used to promote tourism in Saudi Arabia at the time.

So you hijack a man who died of cancers account to promote tourism with a rubbish resolution background. FAIL pic.twitter.com/DnPm7XdMKP

— Spectrum (@spectrumaots) March 16, 2018

Jones, an assistant professor in Middle East Studies and Digital Humanities at Hamad Bin Khalifa University in Qatar, said that verified accounts were more desirable as users are more likely to accept them as a legitimate source of information.

“[A verified account] would gain credibility and followers more rapidly than a non-verified account,” Jones told Al Jazeera.

“In practice, it is limited by the fact you cannot change the handle, meaning anything obviously incongruous would stand out in the local context,” he added.

Jones identified several other profiles that were taken over, including one belonging to Sheyna Steiner, a personal finance writer who previously appeared as an analyst on Fox News. 

In practice, it is limited by the fact you cannot change the handle, meaning anything obviously incongruous would stand out in the local context

Marc Owen Jones

Steiner’s account has posted and re-tweeted dozens of pro-Saudi posts in recent days. On Sunday, the account lost the blue “verified” tick mark it had a day earlier, but it continued to tweet messages promoting Saudi King Salman and Crown Prince Mohammed bin Salman (also known as MBS).

One of the messages included a picture of King Salman and Prince Mohammed, saying “we are all Salman, we are all Mohammed”.

Another tweet from the account said: “I tell those idiots who have been reporting my account since yesterday, do so… Your actions will not stop me from defending my country,” and then claimed that “if my account is shut down there are a thousand others”.

The tweet also included several hashtags calling Saudi Arabia and the Saudi leadership a “red line”, a reference to Saudi Minister of State for Foreign Affairs Adel al-Jubeir’s comments that calls for a change in leadership in Saudi Arabia are a “red line”.

Steiner’s account has posted tweets promoting Saudi leaders [Al Jazeera]

Another verified account, seemingly hacked, is that of Australian Nicole Jade Parks, a former Winter Olympian.

Although the profile has no recent tweets, it is followed by numerous pro-Saudi and Saudi-based accounts, similar to the accounts that follow the Schwartz and Steiner accounts.

‘Manipulate Twitter en masse’

Over the past year, Saudi Arabia’s use of Twitter has come under increased scrutiny.

Research by the Digital Forensic Research (DFR) lab, part of the Atlantic Council think-tank, uncovered fake accounts spreading pro-government tweets that cast doubt on reports that Khashoggi was murdered.

According to that research, a YouTube video containing an unfounded conspiracy theory that Khashoggi was still alive was spread using a combination of real Saudi Twitter influencers and a large number of fake accounts.

“Twitter has emerged as a major battleground in Saudi Arabia’s diplomatic conflicts, though it’s difficult to differentiate between regime-controlled use and pro-regime, voluntary use,” Ben Nimmo, head of DFR lab, told Al Jazeera. 

“We saw a surge in automated, bot-driven activity during the Saudi-Qatar dispute which started in the summer of 2017, [although] it’s only fair to mention that a lot of bots were used to boost pro-Qatar messaging in 2017, too,” Nimmo said. “So this is not unique to Saudi Arabia.”

That drive was aimed mostly at the Arabic-speaking audience whereas, following Khashoggi’s murder last year, there was a bigger English-language component to the traffic.

Silencing critics

In October, the New York Times published an investigation into how Saudi Arabia used Twitter accounts to stifle dissent and silence critics on the social media platform. 

“In one conversation viewed by The Times, dozens of leaders decided to mute critics of Saudi Arabia’s military attacks on Yemen by reporting the messages to Twitter as ‘sensitive’,” the report said.

“Such reported posts are one of the things Twitter considers as signals when it decides to hide content from other users, blunting its impact,” the New York Times said.

The same article also alleges that Twitter fired one of its employees in 2015 after the Saudi Arabian government approached that person to spy on the company on the country’s behalf.

So far, Twitter has removed the verified status, including the blue check mark, for at least two of the suspicious accounts.

Al Jazeera contacted Twitter about those accounts but had not received a response at the time of publication. Al Jazeera also contacted Saudi Arabia’s Ministry of Interior for comment.

“Given the ever-expanding amount of evidence highlighting Saudi’s manipulation of Twitter, whether through moles in Twitter’s San Francisco HQ, or through massive troll armies, it is not improbable to wager that these accounts may have been obtained by some nefarious entity for some sinister purpose,” Jones wrote in his analysis on the takeover of the verified accounts.

The tactical goal is to get hashtags which support the monarchy to trend, either locally or globally. Once a hashtag trends, far more users will see it

Ben Nimmo

“While such a risky strategy would likely be found out at some point, it is also possible that there are numerous far more credible instances of verified accounts being stolen and used,” he told Al Jazeera.

“Often Saudi strategy is to manipulate Twitter en masse, as opposed to be concerned about the consequences of people finding individual accounts suspicious,” he said.

But, according to Nimmo, the effects of trying to manipulate Twitter in such large numbers might be minimal.

“The tactical goal is to get hashtags which support the monarchy to trend, either locally or globally. Once a hashtag trends, far more users will see it,” said Nimmo. 

“At best, they’ll click on it to see the message; at the very least, it can have a subliminal effect on perception. The challenge is that Twitter isn’t a vacuum.”

What’s strange too is that @twcdaveschwartz ‘s account is still verified, but its name has changed since yesterday. It is no longer “فعاليات القصيم’ but just a full stop. So that means someone is doing something to it, just not removing verified status. Odd…

— Marc Owen Jones (@marcowenjones) February 10, 2019

Buying accounts from hackers

Last year, Twitter suspended its verification programme because many users interpreted the blue mark that accompanies verified accounts as an endorsement by the company.

As a result, access to verified accounts has become coveted among hackers, who sell the login information online.

“Verified accounts are a particularly attractive target for fraudsters because the assumption is that it is a legitimate account,” said Nimmo.

According to Jones, it is not unlikely that the pro-Saudi operatives bought access to these pages on one of the many forums where access to hacked accounts is sold.

“Mashable did a report saying people would pay upwards of $1,200 for a verified Instagram account,” he said.

2 / Verification has long been perceived as an endorsement. We gave verified accounts visual prominence on the service which deepened this perception. We should have addressed this earlier but did not prioritize the work as we should have.

— Twitter Support (@TwitterSupport) November 15, 2017