How Saudi uses a troll army and a Twitter insider to shut down its critics

Each morning, Jamal Khashoggi would check his phone to discover what fresh hell had been unleashed while he was sleeping.

He would see the work of an army of Twitter trolls, ordered to attack him and other influential Saudis who had criticized the kingdom’s leaders. He sometimes took the attacks personally, so friends made a point of calling frequently to check on his mental state.

“The mornings were the worst for him because he would wake up to the equivalent of sustained gunfire online,” said Maggie Mitchell Salem, a friend of Mr. Khashoggi’s for more than 15 years.

Mr. Khashoggi’s online attackers were part of a broad effort dictated by Crown Prince Mohammed bin Salman and his close advisers to silence critics both inside Saudi Arabia and abroad. Hundreds of people work at a so-called troll farm in Riyadh to smother the voices of dissidents like Mr. Khashoggi. The vigorous push also appears to include the grooming — not previously reported — of a Saudi employee at Twitter whom Western intelligence officials suspected of spying on user accounts to help the Saudi leadership.

The killing by Saudi agents of Mr. Khashoggi, a columnist for The Washington Post, has focused the world’s attention on the kingdom’s intimidation campaign against influential voices raising questions about the darker side of the crown prince. The young royal has tightened his grip on the kingdom while presenting himself in Western capitals as the man to reform the hidebound Saudi state.

This portrait of the kingdom’s image management crusade is based on interviews with seven people involved in those efforts or briefed on them; activists and experts who have studied them; and American and Saudi officials, along with messages seen by The New York Times that described the inner workings of the troll farm.

Saudi operatives have mobilized to harass critics on Twitter, a wildly popular platform for news in the kingdom since the Arab Spring uprisings began in 2010. Saud al-Qahtani, a top adviser to Crown Prince Mohammed who was fired on Saturday in the fallout from Mr. Khashoggi’s killing, was the strategist behind the operation, according to United States and Saudi officials, as well as activist organizations.

Many Saudis had hoped that Twitter would democratize discourse by giving everyday citizens a voice, but Saudi Arabia has instead become an illustration of how authoritarian governments can manipulate social media to silence or drown out critical voices while spreading their own version of reality.

“In the Gulf, the stakes are so high for those who engage in dissent that the benefits of using social media are outweighed by the negatives, and in Saudi Arabia in particular,” said Marc Owen Jones, a lecturer in the history of the Persian Gulf and Arabian Peninsula at Exeter University in Britain.

Neither Saudi officials nor Mr. Qahtani responded to requests for comment about the kingdom’s efforts to control online conversations.

Before his death, Mr. Khashoggi was launching projects to combat online abuse and to try to reveal that Crown Prince Mohammed was mismanaging the country. In September, Mr. Khashoggi wired $5,000 to Omar Abdulaziz, a Saudi dissident living in Canada, who was creating a volunteer army to combat the government trolls on Twitter. The volunteers called themselves the “Electronic Bees.”

Eleven days before Mr. Khashoggi died in the Saudi consulate in Istanbul, he wrote on Twitter that the Bees were coming.

Swarming and Stifling Critics on Twitter

One arm of the crackdown on dissidents originates from offices and homes in and around Riyadh, where hundreds of young men hunt on Twitter for voices and conversations to silence. This is the troll farm, described by three people briefed on the project and the messages among group members.

Its directors routinely discuss ways to combat dissent, settling on sensitive themes like the war in Yemen or women’s rights. They then turn to their well-organized army of “social media specialists” via group chats in apps like WhatsApp and Telegram, sending them lists of people to threaten, insult and intimidate; daily tweet quotas to fill; and pro-government messages to augment.

The bosses also send memes that their employees can use to mock dissenters, like an image of Crown Prince Mohammed dancing with a sword, akin to the cartoons of Pepe the Frog that supporters of President Trump used to undermine opponents.

The specialists scour Twitter for conversations on the assigned topics and post messages from the several accounts they each run. Sometimes, when contentious discussions take off, they publish pornographic images to goose engagement with their own posts and distract users from more relevant conversations.

Other times, if one account is blocked by too many other users, they simply close it and open a new one.

In one conversation viewed by The Times, dozens of leaders decided to mute critics of Saudi Arabia’s military attacks on Yemen by reporting the messages to Twitter as “sensitive.” Such reported posts are one of the things Twitter considers as signals when it decides to hide content from other users, blunting its impact.

Twitter has had difficulty combating the trolls. The company can detect and disable the machine-like behaviors of bot accounts, but it has a harder time picking up on the humans tweeting on behalf of the Saudi government.

The specialists found the jobs through Twitter itself, responding to ads that said only that an employer sought young men willing to tweet for about 10,000 Saudi riyals a month, equivalent to about $3,000.

The political nature of the work was revealed only after they were interviewed and expressed interest in the job. According to the people The Times interviewed, some of the specialists felt they would have been targeted as possible dissenters themselves if they had turned down the job.

The specialists heard directors speak often of Mr. Qahtani. Labeled by activists and writers as the “troll master,” “Saudi Arabia’s Steve Bannon” and “lord of the flies” — for the bots and online attackers sometimes called “flies” by their victims — Mr. Qahtani had gained influence since the young crown prince consolidated power.

He ran media operations inside the royal court, which involved directing the country’s local media, arranging interviews for foreign journalists with the crown prince, and using his Twitter following of 1.35 million to marshal the kingdom’s online defenders against enemies including Qatar, Iran and Canada, as well as dissident Saudi voices like Mr. Khashoggi’s.

For a while, he tweeted using the hashtag #The_Black_List, calling on his followers to suggest perceived enemies of the kingdom.

“Saudi Arabia and its brothers do what they say. That’s a promise,” he tweeted last year. “Add every name you think should be added to #The_Black_List using the hashtag. We will filter them and track them starting now.”

A Suspected Mole Inside Twitter

Twitter executives first became aware of a possible plot to infiltrate user accounts at the end of 2015, when Western intelligence officials told them that the Saudis were grooming an employee, Ali Alzabarah, to spy on the accounts of dissidents and others, according to five people briefed on the matter. They requested anonymity because they were not authorized to speak publicly.

Mr. Alzabarah had joined Twitter in 2013 and had risen through the ranks to an engineering position that gave him access to the personal information and account activity of Twitter’s users, including phone numbers and I.P. addresses, unique identifiers for devices connected to the internet.

The intelligence officials told the Twitter executives that Mr. Alzabarah had grown closer to Saudi intelligence operatives, who eventually persuaded him to peer into several user accounts, according to three of the people briefed on the matter.

Caught off guard by the government outreach, the Twitter executives placed Mr. Alzabarah on administrative leave, questioned him and conducted a forensic analysis to determine what information he may have accessed. They could not find evidence that he had handed over Twitter data to the Saudi government, but they nonetheless fired him in December 2015.

Mr. Alzabarah returned to Saudi Arabia shortly after, taking few possessions with him. He now works with the Saudi government, a person briefed on the matter said.

A spokesman for Twitter declined to comment. Mr. Alzabarah did not respond to requests for comment, nor did Saudi officials.

On Dec. 11, 2015, Twitter sent out safety notices to the owners of a few dozen accounts Mr. Alzabarah had accessed. Among them were security and privacy researchers, surveillance specialists, policy academics and journalists. A number of them worked for the Tor project, an organization that trains activists and reporters on how to protect their privacy. Citizens in countries with repressive governments have long used Tor to circumvent firewalls and evade government surveillance.

“As a precaution, we are alerting you that your Twitter account is one of a small group of accounts that may have been targeted by state-sponsored actors,” the emails from Twitter said.

Pursuing a Revamped Image

The Saudis’ sometimes ruthless image-making campaign is also a byproduct of the kingdom’s increasingly fragile position internationally. For decades, their coffers bursting from the world’s thirst for oil, Saudi leaders cared little about what other countries thought of the kingdom, its governance or its anachronistic restrictions on women.

But Saudi Arabia is confronting a more uncertain economic future as oil prices have fallen and competition among energy suppliers has grown, and Crown Prince Mohammed has tried relentlessly to attract foreign investment into the country — in part by portraying it as a vibrant, more socially progressive country than it once was.

Yet the government’s social media manipulation tracks with crackdowns in recent years in other authoritarian states, said Alexei Abrahams, a research fellow at Citizen Lab at the University of Toronto.

Even for conversations involving millions of tweets, a few hundred or a few thousand influential accounts drive the discussion, he said, citing new research. The Saudi government appears to have realized this and tried to take control of the conversation, he added.

“From the regime’s point of view,” he said, “if there are only a few thousand accounts driving the discourse, you can just buy or threaten the activists, and that significantly shapes the conversation.”

As the Saudi government tried to remake its image, it carefully tracked how some of its more controversial decisions were received, and how the country’s most influential citizens online shaped those perceptions.

After the country announced economic austerity measures in 2015 to offset low oil prices and control a widening budget gap, McKinsey & Company, the consulting firm, measured the public reception of those policies.

In a nine-page report, a copy of which was obtained by The Times, McKinsey found that the measures received twice as much coverage on Twitter than in the country’s traditional news media or blogs, and that negative sentiment far outweighed positive reactions on social media.

Three people were driving the conversation on Twitter, the firm found: the writer Khalid al-Alkami; Mr. Abdulaziz, the young dissident living in Canada; and an anonymous user who went by Ahmad.

After the report was issued, Mr. Alkami was arrested, the human rights group ALQST said. Mr. Abdulaziz said that Saudi government officials imprisoned two of his brothers and hacked his cellphone, an account supported by a researcher at Citizen Lab. Ahmad, the anonymous account, was shut down.

McKinsey said the austerity report was an internal document based on publicly available information and not prepared for any government entity.

“We are horrified by the possibility, however remote, that it could have been misused,” a McKinsey spokesman said in a statement. “We have seen no evidence to suggest that it was misused, but we are urgently investigating how and with whom the document was shared.”