FIREHOSES IN THE JAMAL KHASHOOGI CASE: AN ANALYIS OF AN INFORMATION OPERATION

About the Authors

Dr. Brad Patty is Senior Vice President for Research and Analysis at the Security Studies Group. He advised US Army units in Iraq on information operations as part of more than a decade’s involvements in America’s wars. His work has received formal commendations from the 30th Heavy Brigade, the 2nd Brigade, 1st Armored Division, the 3rd Infantry Division and the 1st Cavalry Division. Dr. Patty holds his PhD in philosophy from the University of Georgia.

Nick Short is the Digital Media Director at the Security Studies Group. He is a political analyst & consultant specializing in social media management and intelligence. Nick received his BS in Criminology and Criminal Justice from Northern Arizona University, and his work has been published at Tablet and the Federalist.

October 29, 2018

1

Executive summary

The Turkish government successfully used an information operation to elevate the case of Jamal Khashoggi’s disappearance into a major international incident with strategic implications. The disappearance of Khashoggi is contemporaneous with the disappearance, and possible murder, of the head of INTERPOL, Meng Hongwei. In one of these cases a highly visible individual with international position vanished without a trace and little fanfare; in the other a stunning amount of media coverage resulted in one of the largest news stories of the year. The US Secretary of State was personally dispatched to investigate, as was later the Director of Central Intelligence. The difference in these cases is caused by the existence of the Turkish information operation (IO), and the absence of any similar operation attempting to push for Chinese accountability.

The Turkish government attained success through an adaptation of a Russian technique that the RAND Corporation calls the “Firehoses of Falsehood Propaganda Model.”1 In fact the “Falsehood” aspect of this model is dispensable; the model works much better if the information can be proven true, and still quite well if the information is merely not demonstrably false. What is essential to the model used by the Turks and the Russians is the repeated injection of wild stories, not all at once but in controlled sequence. This creates a building effect similar to the increase of tension in a novel or screenplay. The audience comes to see attaining a resolution as necessary to their personal psychic well-being.

A major difference in the Russian model and the Turkish model is that the Russians tend to push their firehose narratives through propaganda outlets of their own creation. Although Turkish-language media supported and helped to drive the narratives, as did Arabic-language media controlled by Turkish ally Qatar, the main outlets that Turkish intelligence used to execute their operation were major Western English-language journalist outlets. This becomes clear upon an intensive study of the data.

While protecting the lives of dissidents and journalists are worthy goals, it is also important to a self-governing people to be able to recognize outside attempts to manipulate them or drive them to actions that may not align with their self-interest. Some Western outlets, including the Washington Post, performed reasonably well at alerting their readers to the possibility that these stories were manipulative. Others, especially the New York Times, treated the successive firehoses as if they corroborated one another. Better practices among journalists are necessary in order to ensure that similar operations in the future do not overwhelm clarity of thought in our political process.

Hypothesis One: Turkish Firehoses

The Security Studies Group (SSG) began with the theory that the Turks might be attempting a straight-line version of the Russian firehose method. On this model, Turkey would be using its own outlets – and those of allied governments assisting them in the information operation – in order to force storylines into the English-language media, where they could affect US political outcomes.

1 Christopher Paul, Miriam Matthews, The Russian ‘Firehoses of Falsehood’ Propaganda Model: Why it Might Work and Options to

Counter It (Santa Monica, CA: RAND Corporation, 2016).

2

A variation in the model is that the Turkish operation could have been using some true information, not merely ‘falsehoods’ as the RAND study characterized Russian operations. In fact this would be a refinement of the model if true. In all sorts of information operations, as the US Defense Science Board reports, credibility is the currency.2 Leaks from intelligence and security services need not be verifiably true to be credible, as the nature of such services makes it potentially credible that they might have access to otherwise secret information. However, the more often that such leaks prove to be false, the less credible they would be. The ideal case would be to use only completely true information, as that would reinforce one’s credibility and thus the power of one’s information operations both now and in the future. Introducing at least occasional truths can have a similar reinforcing effect. As of this writing, several of the story lines have proven not to be true; many others remain up in the air. SSG takes no position for the purpose of this paper on whether any of these remaining stories will prove to be true accounts, but it is not inconsistent with the model if they should do. Information operations is not equivalent to military deception, and in fact will be most successful insofar as credibility can be elevated rather than expended by the operation.

In order to test our initial hypothesis of a straight-line Turkish firehose model, we developed a methodology for investigation built around social media keywords. To track these, we used analytics software licensed from TrendsMap.3 In order to isolate each firehose as it was turned on, we selected unusual keywords specific to that narrative firehose, e.g., “bone saw.” We obtained a background result by searching before the narratives began, in order to show what the ordinary incidence of a word like “bone saw” might be on social media. Then we observed spikes in the usage of the term as the story spread. Figure 1 is one of the data tables, from that example.

As you can see, the baseline for the term “bone saw” – which occurs in discussions of horror films and surgery – is quite low. Over the days preceding October 9th on that chart, the average is 54.94 usages. The October 9th data shows the front edge of what, by October 10th, becomes a huge spike in that traffic. This is the result of the entry of this particular firehose – the narrative alleging that Khashoggi’s killers had brought a bone saw with which to dismember the body. (As of this writing, it is still not clear if that narrative is true or false, and no suggestion either way is meant to be implied.)

If SSG’s initial hypothesis had been true, we would have expected to see a map similar to the one below, which is an actual screenshot from the analytics software.

2 Brad Patty, “Credibility is the Currency: How to Defeat Propaganda,” American Greatness, 2 September 2018.

3 This software is available from TrendsMap.com. Screenshots and similar materials should be replicable using their data, assuming that the same time/date sets and keywords are used in the search.

Figure 1: Daily Tweet Volume Estimates (“Bone Saw”)

3

Notice that “Bone Saw,” in green, is being heavily injected by social media in Qatar. At this moment it is still not widely in distribution elsewhere, although there are some outlets here and there mentioning it. Data like this could have been suggestive of a Qatari-Turkish attempt to use their own social media to inject the story.

However, note the timestamp on the screenshot. It comes from October 10th, not October 9th. What we are seeing in this snapshot is not an attempt to use Qatari-owned media to inject a story, but merely a repetition of the story meant to reinforce and further a narrative that had already been injected on the previous day.

SSG also tested the Arabic and Turkish words for “bone saw,” in order to see if a Russian-style push in their native language media had crossed over into English-language media. This did not occur; there was no incidence of the Turkish equivalent, and Arabic-language social media follows rather than leads English-language media usage.

Another illustration comes from the keyword “Khashoggi.” Here are a series of screenshots of how that keyword spread on the 6th of October, when the first major reports of his disappearance began to be noticed worldwide.

Figure 2: Trendsmap Oct 10, 2018, 4:15AM—"Bone Saw”

4

In this shot, from 10:45 on that date, you can clearly see that the initial reports are in English-language media between Washington and New York City. Some English-speaking media in Asia is responding.

Figure 3: Trendsmap, Oct 6, 2018, 10:45AM

Figure 4: Trendsmap, Oct 6, 2018, 13:15

5

By 13:15, the story has spread across the United States and is beginning to appear in Europe, but not in Turkey or Qatar. By 15:00, there is a significant locus of the keyword coming out of Turkey. However, at this point it is clearly a trailing indicator – perhaps a push, or perhaps simply an understandable interest in a dramatic local story. By 17:45, the story has erupted worldwide.

Figure 5: Trendsmap, Oct 6, 2018, 15:00

Figure 6: Trendsmap, Oct 6, 2018, 17:45

6

These basic patterns hold in the data for other keywords from other particular firehoses. Variations in the pattern were tracked, for example, two early uses of “Apple Watch” in Arabic areas proved to be actual Saudi citizens talking about their Apple Watches. There were occasional exceptions, as when the detail that the interrogation had lasted for 7 minutes appeared first in Al Jazeera,4 but the general pattern is of Arabic language sources being trailing rather than leading indicators. TrendsMap data can be found in the appendices for interested researchers, in case anyone wishes to replicate our study.

It is important to emphasize that there is no reason in this data to find that Turkey or Qatar was even attempting to drive or influence the narrative through their social media accounts. This pattern is consistent with that, but it is also consistent with simple interest in the story. Such interest is not in need of an explanation, and if there were nothing but the social media data, we would have no reason to conclude that there was any sort of information operation at work.

Hypothesis Two: Western Acceptance of Risk

Ironically it is when you move from data back to anecdote that you can see the reason to believe that this is a Turkish information operation. It is not in the amalgamation of how the firehose narratives spread, or where, or by whom. It is in the particular stories that injected each narrative that you can find very strong evidence that this is a Turkish and allied government operation. The stories in the Western press admit that their sources are almost uniformly Turkish intelligence, which are said to be corroborated by sometimes-unnamed “Arab government” sources.

For example, consider the New York Times’ story on the subject from 6 October, a critical date in the early phase of interest in Khashoggi’s disappearance.5 The story lists five sources either involved in Turkish security’s investigation, or who had been briefed on it. None of the Turkish officials gave their names or commented on the record. However, three people “involved in the investigation” did speak directly with the Times. “Two were Turkish,” the article says, “and one was a senior official from an Arab government.” The other two sources mentioned had no direct knowledge of the incident but were simply confirming that they had received the same briefing from Turkish security services as had the Times.

The Washington Post’s account from that day, which introduces the assertion that there was a “team” sent “specifically for the murder,” also cites Turkish security sources. These sources “offered no specific evidence to back up the account.”6

The entry point of the “bone saw” firehose was also the New York Times, which on 9 October published what appears to be the first mention of that implement in relation to the disappearance. The original Times story did not contain that detail, but an evening revision made to strengthen the language in the story added

4 Available from: https://twitter.com/SaudAldos/status/1052638978292273152

5 Carlotta Gall, Ben Hubbard and David D. Kirkpatrick, “Turkey Believes Prominent Saudi Critic was Killed in Saudi Consulate in Istanbul,” The New York Times, 6 October 2018.

6 Kareem Fahim, “Turkey concludes Saudi journalist Jamal Khashoggi killed by ‘murder’ team,” The Washington Post, 6 October 2018.

7

the tool. It also added the claim that the “assassination” was ordered “at the highest levels” of the Saudi government. The source for both of these claims was “a senior official” of the Turkish government.7

Two minutes after the archived revision, an editor at Buzzfeed8 appears to have given the first prominent push to the story. The story was pushed that evening by American social media thought leaders from the New York Times.9 The next day the bone saw element was pushed again by the New York Times’ international editor,10 which seems to have generated the most impressions for that specific firehose detail.

The Western press became aware that it was being used in this manner gradually but definitely. The Associated Press reported on the 18th of October that there appeared to be a Turkish strategy to avoid a diplomatic solution to the crisis created by the disappearance. “Several times this week, Saudi Arabia and the United States seemed close to a diplomatic solution that would allow the two governments to move beyond Jamal Khashoggi’s disappearance… Each time, Turkish officials leaked more shocking material to the media[.]”11

The Washington Post in particular produced a careful analysis of the degree to which Turkish President Tayyip Erdogan had directly been involved in shaping the Western media landscape. This followed a speech Erdogan gave promising the “naked truth” in the matter. “The idea that Erdogan is the noble truth-teller of the Khashoggi case is confusing and deeply uncomfortable for many people,” the Post characterized, adding that “[s]ince he first took power in 2003, Erdogan has broadly turned Turkish media into a government mouthpiece, often by way of violence and arrests. The Committee to Protect Journalists now says that more journalists are imprisoned in Turkey than in any other country.”12

Though it was by then rather late to be asking these questions, the Post’s piece questioning Erdogan’s role is a strong example of best practices in American journalism. It explores Turkish and Qatari strategic interests in driving this narrative and refuses to grant Turkey the unmerited role of civilized defender of the free press or of political dissidents. They gave a voice too to Turkish journalist IlhanTanir, who asserted that the entire process was doubtless an operation led by Erdogan personally. “Such inflammatory information, originating in the security services and implicating a major rival regional power, would not be published without approval from the top,” he wrote.13

7 David D. Kirkpatrick and Carlotta Gall, “Turkish Officials Say Khashoggi Was Killed on Order of Saudi Leadership,” The New York

Times, 9 October 2018. The language was not present in a version of the story archived at 10:06 AM, but was by 7:34 PM.

8 Available from: https://twitter.com/tomgara/status/1049805745812836353

9 Available from: https://twitter.com/EricLiptonNYT/status/1049842340041502720

10 Available from: https://twitter.com/meslackman/status/1049874018973741057

11 Mark MacKinnon, “With grisly leaks, Turkey keeps focus on Khashoggi case and pressure on Saudi-U.S. relations,” Associated Press, 18 October 2018.

12 Adam Taylor, “How Erdogan took control of the Khashoggi case,” The Washington Post, 24 October 2018.

13 Ibid.

8

Other outlets were less responsible, as chronicled by Dr. Seth J. Frantzman (who, lest he be suspected of Saudi sympathies, was once characterized by the Embassy of Saudi Arabia as having written things “malicious and offensive to the people of Saudi Arabia”).14 Dr. Frantzman points out that there was a systematic set of leaks with new and emotional details organized such that there would be a new part of the story revealed every day.15 Many of these leaks sourced to Turkish security services did not prove to be true, but all of them drove reader engagement in the dramatic storyline being developed on a day to day basis.

Dr. Frantzman has compiled a lengthy set of examples of particular leaks from Turkish security services that used Western major media outlets as the vector for this infusion of dramatic story lines. As the Associated Press noted, this disrupted diplomatic efforts to de-escalate the crisis and allow the allies to seek a way forward. It may also have helped to ensure justice for a murder victim; as of this writing that is uncertain. However, it is clear that the Turkish government is not motivated by the plight of journalists; it is certainly motivated by its strategic interests.

Conclusion

Private journalism plays a key role in a free and self-governing society, but in order to play that role well it needs to protect itself from outside manipulation. Western media outlets appear to have accepted the risk that they were being manipulated by a foreign government with a bad track record on the rights of journalists. They should give an account of why they elected to do so, and what they might do in the future to ensure that their readers are aware of the risk being accepted. The Washington Post and Associated Press pieces cited above offer helpful models, although both occurred relatively late in the process when the operation had already largely succeeded in its basic aims. The United States had been prevented from attaining a diplomatic solution to an international crisis and had been forced to engage in this matter at the very highest levels.

Western media need to engage in some introspection on another issue as well. Russian, Iranian, and now Turkish elements have wielded emotional appeals through the press in order to divide Americans and drive extra-national foreign policy agendas with success. The Western press need to reflect upon their role in being the vector for hostile information operations. Of course, it is right and proper to pursue justice in a suspected case of murder, in Khashoggi’s case as in China’s assault on INTERPOL leader Meng; but even this must be done within the context of respecting the danger posed by foreign powers driving emotional narratives. A self-governing people need to be keenly aware of that, and the press’ role includes warning its audience when such a role is suspected.

Our chief concern with this case lies with that diplomacy. The Kingdom of Saudi Arabia plays a key role in security the interests of the United States and its allies globally.16 While we of course do not object to the pursuit of justice in a case of alleged murder, we also want to ensure that America makes its decisions about

14 Nail Al-Jubeir, “Embassy: Saudi Arabians Offended by Commentary,” Tucson Weekly, 20 July 2006.

15 Seth J. Frantzman, “The Khashoggi Affair: The Art of the Leak,” Terra Incognita, 23 October 2018.

16 Brad Patty, “The Strategic Role of Saudi Arabia,” Security Studies Group, 16 October 2018.

9

how to proceed in statecraft independently of emotional investment in a dramatic story. That does not indicate that we should not press for reforms, as a modern and just Kingdom of Saudi Arabia would be a more natural and a more complete ally for the United States. It does mean that we need to preserve our capacity to think strategically against attempts to manipulate us emotionally.

10

APPENDIX A: BONE SAW

11

12

Most Quoted Tweets (“Bone Saw”)

13

APPENDIX B: 15 SAUDIS

14

15

Most Quoted Tweets (“15 Saudis”)

16

APPENDIX C: HE WAS DISMEMBERED

17

18

Most Quoted Tweets (“He was dismembered”)

19

APPENDIX D: SAUDI APPLE WATCH

20

21

Most Quoted Tweets (“Saudi Apple Watch”)

22

APPENDIX E: JAMAL’S FINGERS

23

Most Quoted Tweets (“Jamal’s Fingers”)