Projects:
The Qatar Plot

Use of OSINT to investigate and expose a massive covert influence operation exploiting and propagating xenophobia in the course of attacking the emirate of Qatar and pushing other geopolitical objectives.

The operation used proxies from the Vietnamese platform hacking/astroturfing service economy to push messaging — including through an estimated minimum USD ~250K of advertising and other forms of inorganic boosting (now confirmed by Meta to be USD ~1.2M on their platforms alone) — across Facebook, Twitter/X, Telegram, Wikimedia, YouTube, and TikTok; reaching at least tens of millions in the EU, the UK, the US, KSA, and Lebanon; during a globally significant hot conflict and multiple election seasons in those places.

The operation also deployed AI-generated propaganda images, profile pictures, and video narration, and at least one "cheapfake". It created websites for certain campaigns, and name-dropped NGO-styled organizations that didn't exist in the real world, to lend its online and offline activities a veneer of legitimacy. Engagement also involved propagating xenophobic content from existing ecosystems in the course of linking them to and vilifying Qatar. Sampled user engagement with the artificially boosted xenophobic content included comments expressing anti-immigrant/-Muslim sentiment, as well as occasional antisemitic sentiment.

The cyber-mercenaries used several patterns and tactics to repeatedly outmaneuver platform coordinated inauthentic behaviour countermeasures and ad moderation policy, paying for ads in Vietnamese currency, sponsoring ads using dedicated collections of "burner" assets, using starter ads and inauthentic engagement networks to give operation content momentum/validation, and cycling them through collections. It even made its way into billboards in Times Square NYC and and a video ad at the Conservative Political Action Conference 2024 — all while concealing links among differently-branded campaigns executed in coordination.

Together with Northwestern University Qatar's Dr Marc Owen Jones, I tracked this campaign for months using open-source intelligence techniques, finally exposing it — and the gaps in platform transparency/defences — in early July 2024.

2024/FEB - 2024/JUL

Our full report and data can be viewed here.

Find media coverage:

• Articles/coverage about the investigation at France 24 (AFP), Private Eye, Byline Times, Yahoo! News, Japan Times, Al-Monitor, Khaleej Times, Doha News, Digital Journal, NoonPost, Diriliş Postası, The Times of Israel, Ahraminfo, and La Presse.

• A panel discussion about the investigation, featuring me, with the Middle East Council on Global Affairs (transcript here).

• Quoted about a related inauthentic account investigation at SVT verifierar.

• Interviews and panel discussions with me, regarding the Southport-spinoff riots likely stoked by the UK campaigns of the operation, with Al Jazeera English, BBC Radio Ulster, ABC News Australia (with video clip), Times Radio, Anadolu Ajansı (with companion video), and Al Jazeera Arabic.

An opinion piece by Dr Jones, exploring the far-right connections and electoral implications of the operation, can be read here. My thread on Meta's acknowledgment and detailing of the operation on their platform can be read here (more on that coming soon).