The data suggests Coordinated Inauthentic Behavior attacks are responsible
Originally published on Global Voices
Image via Pixabay. Free use via Pixabay license.
On February 28, 2022, internet users in Sudan noticed that some posts from the resistance committees in various neighborhoods had disappeared from their Facebook timelines. The resistance committees are integral to the ongoing protests against military rule in the country, and social media platforms like Facebook are critical to their organizing work. Some users speculated that the posts were disappearing as part of a cyber-attack from Russia or the Canadian lobbying firm Dickens and Madison that had previously been retained by the Sudanese government. However, careful analysis reveals that the attack likely originated in Egypt, Sudan’s northern neighbor with a deep interest in the latter’s domestic politics.
A photo shows Mecca mosque quoting: “Like the pearls of the earth.”
Resistance committees are neighborhood-based organizations that have played a crucial role in mobilizing protests since the 2019 revolution. These committees are considered the site of the grassroots resistance in Sudan. Born during the dictatorship period of the ousted regime of Omar Al Bashir, the committees have grown in an undemocratic environment and yet managed to remain internally democratic and without a hierarchical structure through their commitment to electing officials democratically. The resistance committees are not affiliated with any political party, which makes them difficult to beat as they are not practicing politics in the way the military expects, even though they have clear goals and they are radical about accomplishing them.
A photo shows a boy with black spots on his face. The post plays on religious emotions by saying: “Glory be to the one who creates and innovates.”
Pro-democracy groups in Sudan face Coordinated Inauthentic Behaviour (CIB) attacks on Facebook and Twitter from both domestic groups like the Muslim Brotherhood and the ousted regime and foreign networks from Russia and the United Arab Emirates. CIB is when a group of pages or people work together to mislead others about who they are and or what they are doing. These attacks primarily aim to affect public opinion by spreading disinformation, but the last attack aimed at changing the feed’s algorithm to hide information on the user’s Facebook timeline.
The nature of the interference is hard to pin down from outside Facebook, but certain patterns are easily noted. First, new pages with anywhere between one and fifteen million followers unrelated to influencers or already famous people started appearing on the news feeds of Sudanese users in February 2022. Typically, these pages focus on riling up religious or emotional sentiments, which increases their engagement metrics.
A post calling for people to react with (love) for this photo because they are short.
A post shows a photo of a tree inside a mosque claiming that it’s in Cairo, Egypt.
The users behind these pages then take advantage of Facebook’s new feature that allows pages to merge. When two or more pages merge, followers and fans are migrated to a new page, and users find themselves following a page they had not subscribed to.
A screenshot shows multiple merging processes.
After merging pages in this way, those behind the pages then selected a handful of followers to follow back, reacting to their posts either positively or negatively and thereby affecting their visibility to others. As Frances Haugen revealed recently, the various responses on the Facebook reaction bar are weighted differently, and by regularly downvoting or reacting negatively to a person’s posts, large accounts essentially ensure that no one sees them. In effect, the actions create a shadowban — muting the resistance committee posts without telling them.
Preliminary evidence suggests that the Sudanese resistance committees’ Facebook accounts have been targeted this way. Several disappeared from news feeds for many days until Sudanese users confronted the situation by searching for and sharing content from the resistance committees despite the shadowbans.
The table below presents examples of some pages implicated in this behavior:
The page featured a call for its followers to join the group as shown in the photo below.
A screenshot shows the call to join the group
The owner of the group is called (Mohamed Ramadan, profile ID 100005090072733) and his account is original and active since January 2013. Mohamed’s profile says that he is from Assiut, a city in Egypt. Some of his posts are about Mohamed Abutraika and Mo Salah, the most famous Egyptian football players, and most of them are in Egyptian Arabic. Page number (5) on the above table has three admins and they are based in Egypt as shown in the photo below.
A screenshot shows the geolocation of the page’s admin
This analysis suggests that this is a planned attack that started on February 16, 2022. The accounts say that they are based in Egypt although they could be using a VPN and posting from a different location. But the Egyptian government does have a reason to be antagonistic towards Sudanese resistance committees because they called for a sit-in alongside the continental road between Egypt and Sudan, demanding local allocation of resources that travel across the road. Egypt also supports the military coup in Sudan that the resistance committees have rejected since October 25, 2021.
Similarly, it would not be unprecedented for the Egyptian government to interfere in Sudan’s digital space. In June 2019, a campaign led by an Egyptian company praised the military rule, following the massacre in Khartoum when Rapid Support Forces (RSF) killed more than one hundred Sudanese citizens during their demands for a civilian government. The campaign was led by a company owned by a former Egyptian military officer and it targeted Facebook, Twitter, Instagram, and Telegram by writing pro-military content.
These pages were deleted prior to publishing, and it is unclear whether they were deleted by Facebook or by the owners of the pages themselves. The screenshot below shows deleted contents from the “saved posts” file on Facebook.
Meta has recently increased crackdowns on CIB and this may be one instance of that. But to protect resistance committees further, Meta activists demand that simply verifying their pages would help these pillars of the Sudanese revolution from similar attacks in the future.
Post a Comment