Projects:
The Qatar Plot

Use of OSINT to investigate and expose a massive covert influence operation exploiting and propagating xenophobia in the course of attacking the emirate of Qatar and pushing other geopolitical objectives.

The operation used proxies from the Vietnamese platform hacking/astroturfing service economy to push messaging — including through at least USD 100K of advertising and other forms of inorganic boosting — across Facebook, Twitter/X, Telegram, Wikimedia, YouTube, and TikTok; reaching at least tens of millions in the EU, the UK, the US, KSA, and Lebanon; during a globally significant hot conflict and multiple election seasons in those places.

The operation also deployed AI-generated propagand images, profile pictures, and video narration, and at least one "cheapfake". It created websites for certain campaigns, and name-dropped NGO-styled organizations that didn't exist in the real world, to lend its online and offline activities a veneer of legitimacy. Engagement also involved propagating xenophobic content from existing ecosystems in the course of linking them to and vilifying Qatar. Sampled user engagement with the artificially boosted xenophobic content included comments expressing anti-immigrant/-Muslim sentiment, as well as occasional antisemitic sentiment.

The cyber-mercenaries used several patterns and tactics to repeatedly outmaneuver platform coordinated inauthentic behaviour countermeasures and ad moderation policy, paying for ads in Vietnamese currency, sponsoring ads using dedicated collections of "burner" assets, using starter ads and inauthentic engagement networks to give operation content momentum/validation, and cycling them through collections. It even made its way into billboards in Times Square NYC and and a video ad at the Conservative Political Action Conference 2024 — all while concealing links among differently-branded campaigns executed in coordination.

Together with Northwestern University Qatar's Marc Owen Jones, I tracked this campaign for months using open-source intelligence techniques, finally exposing it — and the gaps in platform transparency/defences — in early July 2024.

2024/FEB - 2024/JUL

Our full report and data can be viewed here.

Find media coverage of the investigation at France 24, Yahoo! News, Japan Times, Al-Monitor, Khaleej Times, Doha News, Ahraminfo, NoonPost, Digital Journal, The Times of Israel, Diriliş Postası, and La Presse.

Covert connections among operation assets on Facebook

Collage of content from across operation campaigns

Choropleths of estimated reach in countries geo-targeted by operation Facebook ads