Based only on Twitter hashtags, it looked like Egypt was embroiled in another popular uprising in September, with thousands of people demanding the downfall of the regime. Yet the streets of Cairo remained quiet.

Last month, pro- and anti-government hashtags battled for social media dominance. Thousands of tweets called for the downfall of President Abdel Fattah al-Sisi’s regime while others countered with pro-Sisi support. By scraping and analyzing this data, we found that both pro- and anti-regime hashtags bear well-known signs of coordinated inauthentic behavior, demonstrating that authoritarians and anti-authoritarians alike are manipulating the digital public sphere.

Coordinated inauthentic behavior refers to a network of groups or people who work together to mislead others, often using fictitious and automated accounts to deceive people about who they are and what they are doing. In this case, two networks – pro- and anti-government groups – have used Twitter to deploy a deceptive social media campaign that falsely gives the appearance of both widespread anti-regime protests and fervent pro-regime support.

While the largest and most sophisticated sponsor of information manipulation continues to be the Egyptian government, our research shows that both anti-government and pro-government actors have used Twitter to spread warring disinformation campaigns. Despite the coordinated anti-government propaganda, however, small-scale protests did indeed emerge, indicating deep popular disaffection with the regime.

The hashtag battle began last year when Mohamed Ali, an enigmatic former military contractor and TV actor, encouraged people to take to the streets after posting numerous allegations of corruption in the Egyptian military to social media. Rare and small-scale protests surprised the country on September 20th, 2019.

The Egyptian regime responded furiously with the largest crackdown in recent memory, arresting more than 4,000 citizens in days. Downtown Cairo was completely locked down, while plainclothes security relentlessly searched the cellphones of pedestrians looking for evidence of Mohamed Ali’s videos. During this period, pro- and anti-regime hashtags competed for influence on Twitter. For example, the hashtags “Al-Sisi is my president” and “Sisi is not my president” both trended on September 24, 2019,

Mohamed Ali – and these diametrically opposed hashtags – resurfaced again this September. More than forty highly-politicized pro- and anti-regime hashtags trended on Egyptian Twitter since the start of the month. Anti-regime slogans trended as Mohamed Ali called for renewed protests on the anniversary of September 20th, while pro-regime hashtags immediately followed, diametrically opposing any anti-regime trend. For example, the hashtag “the people want the downfall of the regime” was countered with “the people want Sisi.” These hashtag battles continued daily.

Small-scale demonstrations occurred at the end of September in small villages and poor neighborhoods. Nearly 600 people have been arrested – 68 of them minors – but lawyers suggest the number of arrests may be higher. These young protestors will likely spend months, if not years, in pretrial detention.

Egyptian state media have portrayed the anti-regime trends as a “hashtag war against the Egyptian people” orchestrated by malevolent actors outside the country.

In an effort to understand the dynamics of these competing narratives, we downloaded and analyzed more than thirty recent pro- and anti-regime hashtags. Ultimately, we found evidence of coordinated inauthentic behavior on every hashtag we analyzed, pro- and anti-regime phrases alike.

Let’s take just one pair of competing hashtags: “Sisi defeats the international organization” and “the Friday of anger 25 September” trended on September 25th in large numbers. Considering first the pro-regime trend, we found an outlying spike of 173 tweets in a single minute at 5:18 am. There were also suspicious spikes in the number of accounts created in a single day: on September 7th, 20th and 24th, between forty and fifty accounts were created each day. Both the concentrated spike in tweets in a single minute and the concentrated spike in Twitter accounts on the same day are important indicators of coordinated inauthentic behavior.

The anti-regime hashtag tells a similar story. There was a suspicious spike of 503 tweets in a single minute at 7:38 pm on September 24th. There were also anomalous spikes in the number of accounts created in a single day: September 16th, 2019, September 20th and 24th, 2020, each had between 335 and 435 accounts created each day.

We also found that the lion’s share of engagement on this anti-regime trend was captured by accounts associated with Al-Jazeera Arabic, Al-Mekameleen, and Al-Sharq satellite channels and their television presenters, as well as affiliates of the Muslim Brotherhood. The majority of these entities and individuals are based outside of Egypt. Determining attribution for coordinated inauthentic behavior based on the data we are able to collect from Twitter is difficult, but this loose network was overwhelmingly responsible for publicizing the existence of the anti-regime trends, as well as sharing videos of the protests when they occurred.

While this loose network of accounts did indeed share authentic and verified videos from the small-scale protests, there were some instances where anti-regime accounts reposted old footage of previous protests. Al Jazeera was also accused by a pro-government television channel of spreading a fake video. The pro-government channel bragged about deliberately staging and filming the fake protest video and sending it to Al Jazeera to prove their coverage of the protests was unreliable.

Given Twitter and Facebook’s previous disclosures about Egyptian state-backed information operations, evidence of coordinated inauthentic behavior on pro-regime trends won’t come as a surprise. In September 2019, Twitter removed 267 accounts originating in Egypt and the UAE; in April 2020, the platform removed another 2,541 accounts that were taking direction from the Egyptian government. Facebook also removed hundreds of pages and accounts linked to the Egyptian government throughout 2019 and 2020.

What is more unexpected, however, is that the digital public sphere is also being manipulated by self-proclaimed anti-authoritarians.

That Facebook and Twitter are no longer neutral platforms for genuine political engagement has long become a truism for researchers. Post-2011, authoritarian states went hard to work in developing strategies to censor, control and manipulate the online spaces that had been key to mobilizing against them.

But the historic connection between Twitter and pro-democracy movements has clouded our judgement when we are confronted with present-day anti-authoritarian narratives flourishing on the platform. Groups pushing anti-regime slogans can use the same tactics as these regimes to manipulate discourse in the online public sphere.

Even so, anti-regime hashtags are tapping into real grievances in Egypt. The small protests last week reflect growing disaffection with the regime; increasing poverty, exacerbated by COVID-19, and a recent government campaign against building violations have contributed to this hostility.

Despite inflated hashtags, people took to the streets. While the numbers of protesters remain small, given the well-known violence and brutality of the regime, any anti-government actions are noteworthy.

There are important ethical questions to be raised about those responsible for the coordinated anti-government campaign, particularly if they are based outside the country. Youth who may not be well versed in digital security or online information manipulation may have been falsely led to believe they would meet hundreds of other demonstrators in the streets.

Moreover, these fervently anti-regime hashtags increase tensions for security agencies, contributing to a massive security presence in urban areas which results in wide-spread device searches and arrests.

To be clear, the largest sponsors of information manipulation continue to be authoritarian states. The Egyptian regime has conducted many more operations with greater sophistication than operations we have heretofore connected with anti-government networks. Also, we must not inflate the importance of our own findings: there is always genuine and authentic engagement, even if trends have evidence of some coordinated activity.

Social media is contested and muddy. Ultimately, actors of all sorts seek to furtively manipulate these platforms to their ends.

Image: Photo by Peter Macdiarmid/Getty Images.