State-aligned misogynistic disinformation on Arabic Twitter: The attempted silencing of an Al Jazeera journalist


 A product of the global rise of right-wing populism has been a seeming normalisation of gendered public disinformation, which portrays female public figures as unintelligent, untrustworthy, irrational, and libidinous. Social media has also allowed gendered disinformation to be used in targeted harassment campaigns that seek to intimidate and shame women, reducing their public visibility through psychological violence. Despite this, very few studies on social media involving the Arabic language have explored in detail this phenomenon in the Persian Gulf, despite numerous examples of harassment against women public figures. Since 2017, women journalists critical of regional governments have been subjected to increased attacks online, but none as intense as the attack on Al Jazeera anchor Ghada Oueiss in June 2020. Through keyword analysis, network analysis, and open-source intelligence techniques (OSINT), this paper highlights the intensity and scale of one such attack, identifying the increasing role of malinformation and disinformation in attempting to silence journalists. Such documentation can be useful in demonstrating the volume, velocity, and discursive nature of the attacks threatening women’s visibility online. This research also accounts for a potential mechanism of such attacks, which follow a playbook of: 1) leaking information through anonymous accounts, 2) co-opted or loyalist influencers amplifying the attacks, and 3) uncritical local media jumping on the attacks (breakout). From a transformative perspective, it is increasingly important that such attacks are documented, exposed, and analysed to provide evidentiary claims of such abuse. It also highlights the issues of such abuse in authoritarian regimes, who clamp down on online debate, except appear not to do so when the messaging reflects state propaganda.


'Ghada Jacuzzi'
On a June evening in 2020, Ghada Oueiss, an experienced journalist and principal anchor of Qatar-based Al Jazeera Arabic, was celebrating her husband's birthday with a few close friends at their apartment in Doha. The evening was soon interrupted when Oueiss received a message from a distressed friend who warned her that she was under attack on Twitter (Oueiss, 2020). As a highly followed and influential presenter of one of the Middle East's most well-known news channels, Oueiss was no stranger to cyber-trolling or bullying. Abusive messages tended to roll in with alarming frequency. But this was different. Oueiss's phone began to buzz incessantly with Twitter notifications, as thousands of mostly anonymous accounts, many with display pictures of the Saudi flag or Saudi Crown Prince Mohammed bin Salman, sent her abusive messages.
Someone had shared Oueiss's private information publicly without her consent (a practice known as doxing, or dropping documents). An anonymous Twitter account had posted a series of photos of Oueiss wearing a bikini in a jacuzzi near her apartment in Qatar. It would later emerge that the photos had been stolen from Oueiss's phone extent, her Al Jazeera colleague Ola Al Fares. It addresses the need to document ongoing attacks on women journalists while exploring the mechanisms of disinformation campaigns and the harassment of women on social media in the Gulf region. This article also highlights how documenting attacks in visual ways can highlight their severity and make directed forms of harassment visible.

Technology and online misogyny
Social media has rapidly changed the manner in which people share, curate, and disseminate information (Miller, 2012). Despite some cyberfeminists being optimistic about the potential of digital technology to advance women's rights and push back against marginalisation and gendered violence, the digital sphere has, of course, inherited the patriarchal structures that shaped it. Digital technology is not 'value-neutral' (Suzor et al. 2018). The patriarchal social environment in which technology is conceived influences how that same technology is used. As Dana Boyd (2015) argues in her analysis of the ontology of digital technology, 'We didn't architect for prejudice, but we didn't design systems to combat it either. ' Cyber violence is itself a gendered phenomenon, and men and women often experience bullying in different ways (Zsila et al., 2018). Patriarchal social norms are mirrored in the digital sphere, and women are often subject to sexualised and gendered forms of abuse (Mishna et, 2018). According to Ging and Siapera (2018, p. 515), 'There are a range of different terminologies used to describe this phenomenon, including gendered cyberhate, technologyfacilitated violence, tech-related violence, online abuse, hate speech online, digital violence, networked harassment, cyberbullying, cyberharassment, online violence against women, and online misogyny'. For the sake of conceptual clarity, online misogyny is the preferred term, as it encompasses a broader range of harms, whether psychological professional, reputational or physical (Ging and Siapera, 2018). Gendered disinformation and online misogyny plays on contextual social and cultural norms. In the Middle East, for example, Erin Kilbride (2015) has documented how male activists are often smeared by being accused of being gay and women promiscuous.
Misogynistic attacks tend to follow a pattern. Sarah Sobieraj (2017, p. 2) argues that 'aggressors repeatedly draw upon three overlapping strategies-intimidating, shaming, and discrediting-to silence women or to limit their impact in digital publics'. A report by the Institute for the Future (2018) noted that 'every female target of government-backed harassment receives rape threats and is subjected to sexist and misogynistic language'. Misogynistic or gendered abuse is almost always disinformation. For example, calling someone a "whore" or a "slut" is essentially false unless they self-identify as those things-which presumably is not something abusers care to check, nor do victims tend to identify as. Here, the intent, part of disinformation, can be the intent to discredit, as many attackers might truly believe in their subjective assessment of female morality.
Of course, as Sreberny (2015) noted, the Middle East is not exceptional when it comes to online violence against women. Having said that, rejecting essentialism does not mean that violence against women is exactly like it is everywhere in the world. The Middle East is overrepresented at the wrong end of various indices that measure gender inequality, such as the Global Gender Gap (World Economic Forum, 2020) and the Women's Peace and Security Index (2019/20). Indeed, the ten countries with the lowest ranking in terms of gender gap include seven from the Arab world. Significantly, Saudi Arabia, one of the wealthiest countries in terms of GDP, also has one of the largest gender gaps. It is perhaps unsurprising that public-facing women in the region often face abuse online. Activists and journalists in the region often face significant resistance when they try to raise or campaign publicly for women's rights. Domestically, this can be difficult, not least due to the challenges of undertaking open criticism of patriarchal or government institutions in an environment where free speech is often prohibited.
Recently, there has been a distinct backlash against 'feminists' online, and women in the Gulf have complained about the difficulties of speaking out against systems like male guardianship (Grant, 2021). In countries like Saudi Arabia, high-profile women activists such as Loujain Al Hathloul have been imprisoned, tortured, and sexually assaulted for their activism and publicly defamed using trumped-up and false accusations of working as a foreign agent (Guardian, 2019). Often, activists are smeared with epithets implying their sexual promiscuity with no factual basis, or tortured into giving false confessions, which are then circulated to turn strategic disinformation into misinformation. Disseminated falsehoods then form the basis of cycles of disinformation.
Despite reforms increasing the visibility of women in public space, Hana Al-Khamri (2018) has argued that there has been a step-change in violence against women in Saudi Arabia since the ascendency of Crown Prince Mohamed bin Salman. She argues that that women daring to speak out publicly are at particular threat of state violence, to a greater extent than before. Indeed, the past few years have also revealed a shift in social norms and cultural taboos with regards to the public treatment of women in the Gulf. One obvious example of this has been the targeting of prominent women, such as Shaikha Moza bint Nasser, the wife of the former Amir of Qatar. A particular coterie of regional and international online commentators insist on referring to her disparagingly as 'banana', using the banana emoji ( ), while also suggesting she gains political advantage through sexual favours. The obvious phallic symbolism of the banana, along with Shaikha Moza's perceived modest background, has been used to portray her as a libidinous gold digger who uses sex to curry political favour. One such tweet, replying to a tweet of a photo of Moza meeting a Tunisian politician, read, 'Because Qatar has no men, Moza is happy to do the duty ' (@mime20_, 2020). Again, verified macro influencers such as UAE_3g (who has over 400,000 followers) have tweeted dozens of sexually derisive tweets against Shaikha Moza without consequence (Al Hamadi, 2018).
Even raising issues online related to digital harassment can prompt gendered disinformation. Mona El Tahawy, an Egyptian author and activist, highlighted a particular form of gendered disinformation from Saudi Arabia that plays on the tropes of terrorism. El Tahawy (2019) wrote, '#Saudi regime script is, as this regime troll accused me, "feminists are engaged in intellectual terrorism vs family & society w/goal of recruiting young women similar to how al-Qaeda and ISIS/Daesh recruited young men." This pressure is not always imposed by the government itself. Al Thani (2021) reflected on the pressure faced by women to stay silent online, but also the desire to challenge systems of oppression: 'The women I interviewed expressed a profound sense of discomfort and disapproval of the way society polices young women on Twitter and sometimes feel a sense of pressure to censor their thoughts and opinions. They believe that a shift in social norms regarding topics seen as taboo, such as women's rights, must take place, and that such taboos must be eradicated'.

'Misogyneries' and gendered populism of the post-truth moment
The post-truth moment has reminded us that dichotomies such as East versus West can be somewhat contrived concepts. Globalisation has made it hard to essentialise regions or analyse them, as they are somehow distinct entities as opposed to places in which cultural and social hybridisation occurs, and in which global trends percolate alongside specific socio-political and socio-cultural contexts. A distinct characterisation of the post-truth moment has been the rise of authoritarian leaders who wish, as Peter Beinhart (2018) argued, to subordinate women. Indeed, the rise of leaders from as far afield as the United States, the Philippines, and Brazil has been characterised by gendered populism (Sofos, 2020). Gendered populism is 'the desire to restore the clear and unambiguous gender roles circumscribed by patriarchy' (Sofos, 2020). Donald Trump has exemplified this trend, tapping into and exacerbating 'global currents of right-wing populism, complete with White victimhood, xenophobic fear-mongering, and resurging patriarchy' (McIntosh, 2020, 1).
Digital technology has expanded the scale of communicative possibilities within the context of gendered populism, enabling misogynistic and gendered thought leadership (see Waisbord, 2020). This growing relationship between populism and online misogyny requires further exploration (Relly, 2021). Crucially, the destabilisation and deterritorialization of technology mean that misogynistic elements within specific countries transcend borders. Online, someone in Saudi Arabia can send abuse to someone in Qatar or Australia, and vice versa. Cultures of misogyny are not neatly contained within borders. Even linguistic communities and barriers have been challenged by digital translation software. A peril of what McLuhan termed the 'global village', is that harassment, cyber violence, and gendered disinformation have become borderless and asynchronous.
Although regional regimes, themselves close allies of countries like the United States, play a role in this censorship and abuse, the problem can be better understood as a global assembly line that facilitates harassment and online misogyny. Indeed, violence against women is compounded by the insouciance of social media companies in regulating their platforms beyond the closer scrutiny they face in the North American and anglophone space. Indeed, social media companies have been accused of being slow to respond to gendered abuse and disinformation, especially when it occurs in languages other than English. Farnaz Fassihi, a New York Times journalist who covers Iran, stated that 'Twitter needs to seriously improve response/prevention: vile sexual attacks & harassment of women-identifying & removing bots engaged in death/rape threats-fixing its broken Persian language support response' (Fassihi, 2020). This in itself is a form of digital orientalism, whereby companies in Silicon Valley treat the Middle East as the 'Wild West', ripe for profit and consumption but undeserving of the cost of ensuring those products are not used for nefarious purposes' (Jones, 2020a).
There is evidence to suggest that exposure to such misogynistic content, especially in an age of gendered populism, impacts even those against whom it is not personally directed. This has been exacerbated by Covid-19, where an increase in online abuse against women has been recorded (Al Jazeera, 2020). Indeed, those like Trump and his coterie, with their disproportionate influence in the public sphere, expose many more to their views on women, and this can help create a permissive attitude towards online misogyny against women. According to Ford et al. (2001), 'Disparagement of social groups, in general, may contribute to a climate of hostility towards members of the disparaged group'. With this in mind, I conceived the term 'Misognyeries', a portmanteau of misogyny and synergies. This describes how, in the new era of authoritarian male leaders around the world, misogynistic attitudes have been mutually reinforced, creating a permissive environment for violence, and discrimination against women. Within this context, and that of the post-truth moment, disinformation has become a key aspect of the online repertoire of harms.

Attacking journalists
Another aspect of the post-truth era and its attendant populism has been the assault on the integrity of the press through claims of disinformation or fake news. The term 'fake news', made ubiquitous by Trump, is now a term used to dismiss any form of news contradictory to the ideology or propaganda of the person deploying the term. The assault on the press has seen a corollary assault on those working in the media (United Nations, 2020). Women on the frontline of raising issues, who become narrators and active interlocutors in the public sphere/space, become targets for political players. This has arguably been compounded by the 2017 Gulf Crisis, when Bahrain, Saudi Arabia, the United Arab Emirates, and Egypt launched a blockade of Qatar and accused it of promoting terrorism and regional strife through its media channels. Part of the blockade was an all-out mobilisation of social media propaganda, including bots, trolls, and influencers. Much of the content targeted Al Jazeera and Al Jazeera journalists, with manipulated hashtags, infographics, and disinformation (Jones, 2019). Indeed, the blockading countries were explicit in their demand that Al Jazeera should be closed down (Ulrichsen, 2020).
This conflict situation compounds an already hostile environment for women journalists. Indeed, there is a growing consensus that the internet provides an increasingly detrimental space for women journalists. Rego (2018, p. 472) explored the experiences of Indian journalists, arguing that Twitter and other platforms 'constitute convenient havens of harassment against assertive women'. Koirala (2020, e-journal) noted that in Nepal, expanding broadband and online platforms was threatening freedom of the press through threatening women journalists. Chen et al. (2018) concluded the same after interviewing 75 women journalists who had worked across the globe, and Appiah-Adjei (2021) reached similar conclusions after interviewing journalists in Ghana. A major study conducted for UNESCO by the ICJR involved surveying and interviewing over 100 journalists from 125 different countries. It highlighted that 'online violence against women journalists is a global phenomenon, albeit one with uneven impacts that are heightened at various intersectional points' (Posetti et al, 2021). It also emphasised the extent of impunity that underlined such attacks.
Activists and journalists are a particular target of what RSF calls 'digital predators'-companies and government agencies that use digital technology to spy on and harass journalists and thereby jeopardise our ability to get news and information. As Sobieraj (2017) noted, 'digital hostility is particularly virulent for female journalists, bloggers, and vloggers who work on technology, science, and sports. And extraordinary venom is saved for feminists and women who are otherwise non-compliant with gendered expectations, such as those who are overweight and body-positive, women in positions of power, etc.' (Sobieraj, 2018, p. 10). This can lead to a chilling effect, where journalists (or indeed anyone) is afraid to express themselves freely online due to fear of consequence, whether harassment, abuse, murder or arrest (Carlson and Witt, 2020;Everbach, 2018;Ferrier & Garud-Patkar, 2018, Khan, 2020Posetti et al, 2021a.).
The attack on journalism and journalists moves beyond rhetoric too. Indeed, a key aspect of the context of the attack on Ghada Oueiss is the fact that it occurred during one of the most egregious attacks on journalism in recent history: the assassination of Jamal Khashoggi by the Saudi state in the Saudi Consulate in Istanbul. The attack on Oueiss was part of a broader trend of the UAE and Saudi attacks on Al Jazeera, an outlet it sees as threatening its information dominance in the Arab world (Jones, 2019). The Gulf crisis was also characterised by at least three years of attacks on Al Jazeera and Qatar-based news organisations. The perceived importance of Al Jazeera as a target for the UAE and Saudi Arabia was emphasised by the fact that many of its journalists were targeted with Pegasus spyware. Citizen Lab, a Toronto-based digital investigative outfit, discovered that Saudi Arabia and the UAE hacked the devices of 36 Al Jazeera journalists in August 2020 (Marczak, 2020). At the time, this group of Al Jazeera journalists represented the single largest group of Pegasus infections (it would later emerge that up to 50,000 people were listed as potential targets). Being a journalist critical of Saudi Arabia and the UAE was to risk not only one's privacy, but one's life. While Judson et al. (2020, p. 6) argued that 'Gendered disinformation weaponises harassment against women in public life and tries to make them afraid to talk back', this can be magnified by the dangers faced by journalists in their particular socio-political context.

Methods
Many studies have focused on interviewing journalists to understand their experiences of online abuse (Binns, 2017;Chen et al., 2018;Koirala, 2020;Rego, 2018). These are invaluable in understanding the impact of such abuse, especially with regards to online visibility. The use of misogynistic language identified in such studies has been instructive in identifying hate speech. Some studies have used corpus-based approaches, which influence this study. Cuen and Evers, for example, looked at the frequency of derogatory misogynistic epithets directed at Fox News anchor Megyn Kelly. However, more work needs to be done on the multimodal nature of online abuse (Cockerill, 2019). Memes, cartoons and other content are highlighted here to discuss multimodality and complexity. This is especially important as platforms develop methods to algorithmically moderate keywords, and may miss context-based harassment campaigns that do not explicitly rely on derogatory language.
Few have focused in depth on the digital dissections of particular campaigns, partly because abuse is so often temporally diffuse, and relevant documentary methodologies still nascent. The methodology for this study focuses on capturing how the trifecta of different tactics identified by Sobieraj (2017), shaming, discrediting, and intimidation, were deployed against Oueiss in the context of a Twitter dogpile. A Twitter dogpile occurs when numerous Twitter accounts attack an individual or small group of individuals in a narrow time frame. The primary focus is on the smear campaign against Ghada Oueiss that took place in a five day period in June 2020. The purpose of the analysis is to examine the extent, velocity, and intensity of the campaign and the extent to which it 'broke out' beyond social media. It is an anatomical dissection of a malinformation campaign, illustrated to make visible that which is opaque, and an attempt to highlight the scale of such operations. It highlights the key drivers of the campaign.
In order to analyse the campaign, tweets were downloaded using a search criterion based on three hashtags related to the hack, leak, and defamation campaign. These were ‫مزرعه_حمد_بن_ثامر#‬ (Farm of Hamad bin Thamer), ‫غاده_جاكوزي#‬ (Ghada jacuzzi), and ‫عال_ساونا#‬ (Ola Sauna). The hashtags were selected based on the fact they were trending in Saudi Arabia and directly concerned the victims. Hashtags function as ad-hoc publics and a 'means of coordinating a distributed discussion between more or less large groups of users, who do not need to be connected through existing 'follower' networks' (Bruns & Burgess, 2011). The tweets were downloaded using NodeXL, a network analysis tool that integrates with Microsoft Excel. The network was further analysed in Gephi, an open-source network visualisation tool. Approximately 24,713 interactions were downloaded from the hashtags. Interactions are defined as a tweet, retweet, reply, or mention. These interactions were produced by approximately 10,410 unique Twitter accounts.
The cloud-based web scraper Scrapehero was also used to document separately the hashtags and their longevity. Such scrapers gather publicly available tweets based on keyword and temporally defined search queries. In this case, the scraper included the content of the tweet itself, the time of the tweet, the name of the account tweeting it, the user input location, and information about the number of retweets and likes. Unlike NodeXL, which is limited by API functionality and overall tweet volume, scrapers do not usually have temporal limits. Whereas NodeXL returned tweets from between the 6 th and 9 th June, the earliest date gathered for the hashtags in the scraper was 5 th June.
Descriptive and statistical analysis and visualisations were conducted using Gephi and Tableau. A network map was built to demonstrate which accounts were deemed the most influential using eigenvector centrality measures. Other data points were tabulated, including ranking tweets by the most retweeted, and determining the location of users. Additional investigation was used to identify the veracity of certain claims, as well as to identify relevant content that would add depth and detailed description to elements of the disinformation campaign.
Although the focus in this article is on the intense attack, the second part of the analysis involves analysing misogynistic disinformation playing on misogynistic tropes evident in the June 2020 attack. This involves a temporally broad assessment of sexualised abuse directed at Ghada Oueiss between 2014 and 2020. For this study, any tweets directed at Ghada Oueiss between April 2014 and October 2020 containing sexualised or derogatory language were included. Scrapehero was also used for this. The words selected were ‫شرموطة‬ Sharmuta (whore), ‫قحبة‬Ghahba (bitch), ‫طيزك‬ Tayzik (your ass), ‫ممحونة‬ Mamhuna (horny), and ‫ايري‬ ‫زبي‬ Zibi/Ayri (my dick). These terms are premised on those done in an English language study by Sobieraj (2017), who interviewed a number of women about the gendered abuse they received online. Scrapehero was used to extract the data. Some omissions are inevitable when undertaking such procedures, and it is important to note that many abusive tweets are deleted before they can be scraped. Studies in the English language have been conducted of this nature, though very few, if any, have been conducted in Arabic.

Results and discussion
A scraping of tweets on the three hashtags, ‫مزرعه_حمد_بن_ثامر#‬ (Farm of Hamad bin Thamer), ‫غاده_جاكوزي#‬ (Ghada jacuzzi), and ‫عال_ساونا#‬ (Ola Sauna) returned at least 11,000 tweets sent between the time frame of the 5 th of June 2020 and 7 th September 2021. This number excludes retweets and tweets that were deleted or from accounts that were later deleted. It is also important to note that this figure excluded tweets discussing the issue or tweeting at Oueiss that did not use the hashtag. In this regard, a hashtag is a proxy for a discussion on a topic, as opposed to a comprehensive snapshot of a conversation. The sequence shows that ‫مزرعه_حمد_بن_ثامر#‬ 'Farm of Hamad bin Thamer' began trending on the 5 th of June, while ‫غاده_جاكوزي#‬ (Ghada jacuzzi), and ‫عال_ساونا#‬ (Ola Sauna) picked up on the 9 th of June. It also shows that the trend truly exploded around the 9 th or 10 th of June, when influencers such as 70sul and alshaikh2 began to follow the trend. It is also evident that the hashtags created in June 2020 persist to this day, indicating that such campaigns cast a long horizon.

Network analysis
A network analysis of 24,713 interactions on the hashtags ‫مزرعه_حمد_بن_ثامر#‬ (Farm of Hamad bin Thamer), ‫غاده_جاكوزي#‬ (Ghada jacuzzi), and ‫عال_ساونا#‬ (Ola Sauna) over a five-day period in June 2020 reflects the intense scale and velocity of the dogpile. NodeXL returned tweets between the period of 6 th and 9 th of June. Within this sample, at least 3,000 tweets included direct mentions to the Twitter accounts of Oueiss and Al Fares. This includes replies and mentions in retweets. Nine out of ten of the most influential accounts on the hashtag by eigenvector centrality reported their location in Saudi Arabia. This reflects data within the overall sample, whereby approximately 89% of accounts with usable location data were identified as being Saudi-affiliated. The next highest was the United Arab Emirates, with 6%. Locational information was garnered from the user-input location. This means it is self-proclaimed and there is no way to verify the information (Even Twitter cannot determine true location if the IP is being hidden). Inferred location means that user-reported location was not explicitly mentioned but inferred from either profile photographs (for example, a picture of a Saudi Arabian flag or Mohammed bin Salman would suggest Saudi Arabia). This is unsurprising, given the political context in which the UAE and Saudi Arabia led a blockade of Qatar, focusing much of their attacks on Qatar-based media. The number of sockpuppet or bot accounts involved in the attack is not clear. However, approximately 2800 of The top five most retweeted tweets on the hashtags analysed came from four different accounts, pro-Saudi regime accounts (demonstrated with images of the Saudi flag and the Crown Prince). Retweets are important, as are likes, as they determine the prominence of tweets in the search function. Highly retweeted and liked tweets will be more visible and salient to the public. A number of the accounts had been active on other disinformation campaigns related to the Gulf crisis, indicating that they were habitual disinformation accounts. 70sul and alshaikh2, for example, spread patently clear disinformation in 2020 about there being a coup in Qatar (Jones, 2020). Further research on disinformation campaigns may shed further light on 'repeat offenders', indicating habitual promoters of false information. All used the hashtag 'Farm of Hamad bin Thamer', which roots any meaning within a disinformation context, since the farm element was entirely concocted for the purpose of the sexualised smear campaign.
Some of the most retweeted comments were framed as 'jokes', and included cry-laughing emojis ( ) (See Table 3). The account fdeet_alnssr joked about the farm having a 'special offer', stating that it was unique in that it allowed those attending to increase their salaries and surpassed even some of the biggest 'cow farms in Denmark and chicken farms in France'. Others, such as Saudi commentator Abdullatif Al Shaikh, joked that people had been treated to a 'public' event and that everyone was welcome, but swimsuits were necessary. Ghassan_z posted a video along with a tweet that read 'How Al Jazeera's women presenters were invited to Hamad bin Thamer's farm to learn how to swim'. The video within the tweet showed a clip from a Gulf comedian, along with an image of Ola Al Fares and Ghada Oueiss. The premise of the joke was that Ola and Ghada had won a game show, and that was what allowed them to be on the farm. Of course, the video does not contextualise that the photos were leaked, but seeks to position Ghada as the perpetrator for simply wearing a bikini in her private residence. While some might argue that jokes have a disarming effect, it has been found that perceptions of jokes as sexist relate to the perceived threat (Lawless et al., 2020). The more the perceived offence, the more likely it is to be perceived as a threat.
Other accounts sought to rile public sentiment in Qatar against Oueiss, and posted a video of someone purporting to be a Qatari expressing his disdain of Ghada Oueiss. The tweet also sought to provoke ethnic tension and us/them categories by suggesting that the 'original tribes' of Qatar should be outraged with this 'foreign' 'mercenary' (Ghada is Lebanese). (There is a tendency in Gulf countries to rile up public derision against a particular person in order to have them deported and lose their jobs). Some of the other content sought to stimulate further derision by branding Oueiss and Al Fares as "Zionist mercenaries". Other accounts mocked her because she was Christian, or that she exploited the Palestinian cause to gain popularity.  Many of the most shared tweets were also accompanied by derogatory cartoons that mostly sought to portray Oueiss and Al Fares as sexually promiscuous and mercenary. One cartoon included Oueiss wearing a Qatar-flag bikini in a hot tub with the Qatari ruler Tamim bin Hamad and Hamad bin Khalifa Al Thani, the former Emir (Figure 7). Tamim is wearing an armband with the Al Jazeera logo, and all are consuming alcohol, a cultural taboo. Oueiss's body is portrayed unflatteringly while the two men fire money guns at her. Another cartoon ( Figure 6) shows Oueiss lying on the desk of Hamad bin Thamer's desk asking, 'Can I have a pay rise, the Saudis are giving me a really hard time?' To this, Hamad Bin Thamer replies, 'Let's reach an understanding on the farm'. The connotations are obviously sexual. Another cartoon ( Figure 5) shows Oueiss wearing a dress, standing outside a nightclub with a sign saying 'cheap brothel/ prostitutes' in pink fluorescent lights. The brothel has a Qatari and a Pride flag hanging outside, along with a menu of various services on offer, including 'swimming pool + photo, jacuzzi + photo'. Although the subtext of the Qatar flag is obvious, the LGBTQ flag once again sought to play off conservative attitudes towards the LGBTQ community in order to portray Qatar and those who work there as sexually 'deviant'. A number of tweets implied violence. One anonymous account posted a stock photo of a woman unconscious or dead after taking a drug overdose. One of the tropes involved trying to smear Oueiss as a Zionist and other context-specific insults.2 2 See for example: https://twitter.com/alawadi77077/status/1269840513336827906

'Breakout'
The smear campaign against Oueiss and Al Fares went viral, and did so with such intensity that it eventually 'broke out' onto other social media platforms and into traditional media. 'Breakout' is a term used to describe how influence operations spread across platforms, persons and outlets in the information ecosystem. Nimmo (2020, p. 1) divides the "breakout scale" "into six categories, based on whether they remain on one platform or travel across multiple platforms (including traditional media and policy debates)". The attack against Oueiss and Al Fares can be defined as a combination of category 4 and 5, where operations "break out from social media" and are amplified by mainstream media as well as high profile individuals such as celebrities or political figures (2020). This is not dissimilar from 'intermedia agenda setting' (Atwater et al. 1987), which is concerned with how news contents transfers between different media outlets. Oueiss herself noted the significance of real people (as opposed to anonymous accounts) picking up the tropes spread as a result of the hack. Writing in the Washington Post, Oueiss recounted some of the standout tweets she received: 'Tell us about your night. How was the prostitution? Were you drunk while you were naked?' wrote a Twitter user with the name Saoud Bin Abdulaziz Algharibi. 'No wonder she's naked. She's a cheap Christian. She's old and ugly', he continued' (Oueiss, 2020). The labour required to stay safe online is telling, with Oueiss blocking over 9,000 accounts (Oueiss, 2021).
Notable figures in the Gulf amplified the gendered disinformation, including Dhahi Khalfan, 'former head of Dubai Police; Naif Al-Asaker, a mufti at the Saudi Ministry of Islamic Affairs and a close ally to MBS; and Hamad Al-Mazroui, a close associate of the UAE crown prince' (Oueiss, 2020). The endorsements of notable influencers and public figures helped legitimise and encourage the dogpile on Ghada Oueiss. Oueiss (2020) herself noted that many of those who attacked her had images connected to Saudi Arabia and the UAE, such as the countries' flags or images of their ruling families. According to Oueiss (2020), the message was clear-'don't insult the Crown Princes'. Others outside the region were also involved, although the focus in this paper has been on the most retweeted and liked accounts.
An aspect of disinformation is intent, and while deliberately misrepresenting a hacked photo is in itself intent to deceive, the campaign also included doctored tweets attributed to Oueiss. In one instance, the Saudi influencer Abdel Latif Al-Shaykh, responsible for some of the most influential posts on the Hamad bin Thamer hashtag, posted a doctored tweet attributed to Ghada Oueiss (it is not clear who made the tweet). In it, she [Oueiss] accused Ola Al Fares of leaking her private photos. CNN Arabic (2020), which is based in the UAE, wrote up a piece on the trend and included the doctored tweet. However, instead of focusing on the leaked photo as an aspect of disinformation, they framed the story as a disagreement between Al-Shaykh on the one hand and Ola and Oueiss on the other.
This framing was based primarily on the doctored tweet that Abdullatif Al Shaikh shared (and later deleted). However, CNN Arabic did not challenge the veracity of the false tweet, using it to support the argument of the article, which sought to infantilise Oueiss and Al Fares by minimising the harassment campaign and instead portraying it as a petty squabble between two women colleagues. This ties in with the notion of gendered disinformation being used to portray women as too emotional and unintelligent. Despite the fact that counter-discourses were extant on social media, CNN did nothing to correct any mistakes or seek comments from those targeted.

Abuse over time
Between October 2020 and April 2014, Ghada Oueiss received at least 401 tweets containing sexually degrading, aggressive, and misogynistic terms (it is important to say that because a retroactive scraping technique was used, this does not include tweets that may have included those terms but were later deleted). The offensive keywords directed at Ghada Oueiss (to:ghadaoueiss) were input into Scrapehero. The results were inserted into Tableau, and a time series graph was generated to determine episodes of increased usage. The most commonly used term was ‫شرموطة‬ Sharmuta (whore, n = 150), followed by ‫قحبة‬Ghahba (Bitch, n = 98), ‫طيزك‬ Tayzik (your ass, n = ‫ممحونة,)46‬ Mamhuna (horny, n = 42), and ‫ايري‬ ‫زبي‬ Zibi/Ayri (my dick, n = 29). 'Your ass' ‫‪)was‬طيزك(‬ often used in the context of something being put into it, e.g., a penis or some other object. The same was true of 'my dick'(‫.)زبي‬ It is interesting that a spike of such abuse occurred during October and November 2018, during the time the media, including Al Jazeera, were heavily covering the disappearance and murder of Jamal Khashoggi. At a time when the media was highly critical of Saudi Arabia and Mohammed bin Salman for his role in the murder, those defending the Saudi regime increased their attacks on media outlets, and there was a corollary spike in misogynistic abuse at Oueiss. An outcome of this was increased sexually aggressive language aimed at Oueiss and likely other journalists. Thus, by simply discussing the Khashoggi case online, Oueiss was targeted with misogynistic abuse. Oueiss (2021) described that part of the reason for this was simply that she was a woman. Oueiss (2021) noted that when she had male guests on the show, if she criticised MBS, for example, they would be more offended simply because she was a woman. This is corroborated by other research in the region that highlights the role women in the media are expected to play. For example, Noha Mellor (2019) argued, 'Arab women journalists are generally expected to support rather than challenge the patriarchal order in times of political turbulence'.
The increase in attacks at the same time as reporting on a murdered journalist increases the severity and resonance of the abuse. As Oueiss noted, 'Being attacked online could translate into a physical attack.
[Khashoggi] didn't tell the world he was being attacked by bots and trolls. One month before his murder, [he] sent me a message saying, "Ignore them, block them." I said, "No, I want to show the world this is going on." This was my way of showing that these dictatorships were using social media platforms to silence journalists' (Shilad, 2021). Another spike in the use of the terms 'bitch' and 'your ass' correlated with June 2020 when the dogpile occurred. Thus context, method, and content are important.

Discussion: A strategic dog pile
The 2020 attack on Oueiss was likely one of the most intense hack, leak, and smear campaigns directed against an Arab woman journalist since 2011. It was characterised by a number of key processes, that may or may not have been orchestrated 1) The potential hacking of her phone using Pegasus spyware, 2) the mass dissemination of that hacked content on social media via a specific coterie of pro-regime influencers and anonymous accounts, 3) the deliberately misleading framing of the hacked photos as sordid and sexual, and 4) the break-out of that story onto traditional media. The attack was also multimodal, involving textual and visual forms of abuse, as well as elements of irony and fabricated claims. This is similar to a study conducted by Edson et al (2021 p.1), in the Philippines, which found that 'online harassment against journalists follows a systematic process that starts from the top, [which] is [then] followed through by a network of social media personalities and an army of trolls, and then completed by ordinary social media users'. The mechanism between the leaker of the information, and its rapid uptake is not clear in this case. Nonetheless, by putting doxed malinformation on social media, the perpetrator deflects accusations that it might be a potentially stateorchestrated operation. Only governments can theoretically get hold of hacked content from tools such as Pegasus. Thus, the idea that the story broke via unknown anonymous accounts gives the story the veneer of grassroots legitimacy when, in fact, it could have been planted. This is compounded by the fact that the smear campaign was chiefly dominated by verified accounts based out of Saudi Arabia and the UAE, who at the time had severed diplomatic relations with Qatar, and had targeted Al Jazeera and its journalists through information wars and also spyware (Marczak et al, 2020).
The falsehood about the event taking place on Hamad bin Thamer's farm was deliberately calculated to provoke the most egregious reactions and to have the most profound psychological impact on the victim. However, the origins of the campaign, despite being taken up by known accounts, are unclear. It is also important to pay attention to the method of delivery, as well as the content. The sheer velocity of tweets, the virality, and the 'breakout' is in itself a distinct aspect of a modality of violence. The velocity accentuates the severity of the attack, just as a savage beating is different from a single punch. Oueiss (2021) noted, 'It's vicious and humiliating. They say that when you read something bad about [yourself], it's like someone burned you with hot coffee; the same part of your brain reacts. Online humiliation became a kind of torture'. It also made Oueiss question leaving the profession, as has happened with many other female journalists who have faced the same abuse. Thus the chilling effect is very real.
In terms of context, the crude narratives smearing Oueiss as a prostitute or mercenary were designed to have increased negative resonance in a region with generally conservative attitudes about sex outside marriage (see for example, Khamis, 2013). It is also important to note that the impact of the attack was amplified by the hostile environment to journalists critical of Saudi Arabia's crown prince, exemplified by the murder of Jamal Khashoggi. In an atmosphere where violence against the profession is seen as permissive, the distinction between physical and psychological violence becomes increasingly nebulous. The campaign, in its ferocity, appeared organised, adding to its perceived danger.
An increasingly insidious aspect of such attacks is that they may serve to limit women's visibility not just publicly, but privately. Given the number of people targeted with Pegasus, including at least 36 other journalists, the potentialities for such invasive violations of privacy, accompanied by attempts to publicly humiliate journalists, represent a grave threat to humanity. The more people are aware that their personal data can be compromised and used to publicly humiliate them, the less likely they are to self-disclose in private communications.

Tackling online misogyny and state-aligned information operations
The attack against Oueiss highlights the importance of 'first responding' to disinformation operations . Here, first responding involves undertaking rapid data analysis of potential adversarial influence operations, especially when those operations seek to promote harm against an individual or group of people; 'first responding to manipulation is imperative for achieving timely disruption of propaganda and disinformation. The longer such content lingers, the more potential it has for circulation and adversely impacting the information ecosystem [and causing harm]' . In particular, timely intervention can help those being attacked make sense of what is happening, feel less isolated, and thus reduce psychological stress. Even Oueiss described the process of data collection for her lawsuit as something that helped alleviate her anxiety (Shilad, 2021). Again, this kind of first response is essential in an environment where social media companies appear to abdicate their responsibility for tackling sexism. Evidentiary claims add weight to remedial efforts to mitigate online violence. Furthermore, as the Oueiss court case has shown, such figures may constitute part of legal cases. This research has also highlighted important ways of documenting disinformation and harassment campaigns, all of which can be applied globally. Network analysis and time series analysis allows researchers to document the magnitude of a campaign, its velocity or intensity, and the influential super spreaders of misogynistic content. This can be useful in exploring cases of breakout. During the Qatar crisis international news brands such as Sky News Arabia (based in Dubai) were found to reflect the foreign policies of the government in which they were based (Al Shabnan, 2018). This raises a number of important questions, including; is breakout an orchestrated phenomenon, or simply opportunistic, facilitated by extant political dynamics that favour negative news stories about enemy states? With a number of franchised international outlets, questions of editorial independence need to be address (Salem, 2012).
This article has also highlighted the necessity of ongoing monitoring and first-responding, especially in regions where states offer little protection to women journalists, and where editorial independence of state-controlled media is ambiguous. Long term monitoring can also help identify habitual harassers, and patterns in the outbreak and nature of such attacks. Furthermore, finding effective strategies to assist in monitoring and documenting such attacks is increasingly important in a context where tech companies and governments are not doing enough to safeguard citizens, and the burden of analysing attacks falls uncomfortably to journalists, academics, and analysts. This is particularly true, as Miller (2012) noted, with social media creating 'such large quantities of information, [people] need to learn effective strategies for navigating an increasingly social web'. The same is true of disinformation. Theoretically it also exposes the idea that anonymity is not always necessary in encouraging online flaming and abuse. It also indicates that more research needs to focus on non-linguistic forms of harassment, whether through memes, videos, or textual screenshots.
Another aspect that warrants further investigation is the ambiguous role of the state, and the interplay between mal and dis-information. Such operations have become so common place that Twitter even releases archives of accounts it has suspended on suspicion of being state-linked. Among these archives, the Saudi, UAE and Egypt are among the most common abusers of Twitter (Jones, 2022). Indeed, if private information gathered through spyware that is only officially sold to the state, is then circulated online, with seemingly no consequence for those who distribute it, then it raises issues of state complicity at worst, or negligence at best. In authoritarian regimes, where governments clamp down frequently on online speech, it can be telling that such campaigns occur without apparent sanction, especially when prominent pro-regime influencers (Leber, and Abrahams, 2019) participate.
However this raises issues of attribution. When does ostensible negligence reach the threshold of tacit support, or even complicity? How can we factor this in when discussing attribution in information operations? Without whistleblowers, states are potentially free to engage in this type of behaviour with minimal accountability if standards of determining attribution remain unreasonably high. However, as such operations naturally operate with secrecy, determining attribution is unclear and ambiguous. Having said that the term 'state-aligned' (Judson et al, 2020) remains a useful middle-ground.
Despite this online abuse and the risk of silencing women, resistance or agency should not be discounted. There is much resistance against this abuse. In a phenomenon dubbed digilantism by Emma Jane (2016), targets or victims of cyber-abuse can find means of confronting or attempting to hold attackers accountable. Oueiss publicly criticised her attackers online and wrote an article in the Washington Post titled 'I won't be silenced by online attacks'. She also launched a lawsuit against a number of those behind the attacks. Despite this, such efforts run the risk of 'reflecting and bolstering a dominant cyber norm which shifts the burden of responsibility for gendered hostility from male perpetrators to female targets, and from the public to the private sphere' (Jane, 2016, p. 284). This is especially true in authoritarian states, where what happens in public and online is almost always closely monitored by the state. In most cases, such attacks appear to go unpunished and be tacitly condoned, given that they often violate laws on defamation, hacking, and similar offences (Al Tamimi & Company, 2017). As Martin (2018, p. 73) argued, 'gendered online violence needs to be tackled as a multilevel online governance issue rather than just a personal safety issue, with better support from peers, employers, and legal and political institutions'.

Conclusion
This research has documented how thousands of accounts, including well known pro-Saudi regime influencers, used private photos to dox, humiliate, discredit, shame and intimidate Al Jazeera journalist Ghada Oueiss for highlighting human rights abuses in those countries. The attack on Oueiss is a potent example of the discursive and tactical phenomenon of misogynistic dogpiling on Twitter. While online violence against women is nothing new, the flagrant networked vulgarity directed against Oueiss reflects a space in which the denigration of women is encouraged with little prohibition. The permissive atmosphere surrounding the attack on Oueiss is partly a characteristic of the Gulf Crisis. The ascendency, or at least the resurgence of gendered populism, has spared few corners of the globe, and is going strong in the Middle East. Women seen as critical of the new breed of populists and their attendant promotion of normative gender roles and misogynistic language are denigrated accordingly, and Twitter and other social media platforms are an important avenue for such attacks.
Crucially, this research has argued that the method, intensity, and scale of harassment campaigns are undoubtedly part of their violent power. It has also raised questions about the extent of state complicity in such campaigns. In authoritarian states, where dissent is not tolerated, such attacks sit between state-aligned and state-enabled. Focus on social media companies policing their content also deflects the role of state responsibility. In such cases, it is important to consider whether states are encouraging misogyny through managed neglect, or instrumentalising it as a means of attack. Future research needs to explore how such narratives may be orchestrated with the purpose of provoking organic sentiment.
This research, along with other articles in this special issue, contributes to an emergent body of literature attempting to fill the gap on disinformation studies in the Middle East. Regardless of the role of states, the existence of such virulent campaigns highlights the lack of political and corporate will in combatting online misogyny in certain contexts. More research is needed to determine the extent to which social media companies see the Global South as a place in which markets can be exploited with minimal responsibility. With many of the accounts mentioned here having likely violated Twitter's harassment policy, what censure have they received? Are accounts outside the Global North given more latitude to violate policy than their counterparts elsewhere? If there is no parity of enforcement it raises questions of digital orientalism or techno-colonialism (Simmons, 2019) -the exploitation of markets for financial gain but minimal ethical responsibility. There is need for greater transparency around social media companies' enforcement of rules and regulations. As it stands, gendered disinformation is set to be an ongoing scourge, one that is articulated along geographical and socio/geo political boundaries.