Power and Presence · #2

The Tunisian Bot Farm That Was Not One Farm

Counting fakes from Carthage to Decree 54 — 2016 to 2026

Published: Aug 28, 2026 · 16 min read
Draft This investigation is a draft and has not been published. No reviewer recorded.
How to read this investigation Evidence badges · Entity links · Corrections

This is the second DeepTunisia investigation: how many fake accounts existed in Tunisia from 2016 to 2026, who claimed each number and by what method. Every figure carries a grade and a source. Interpretations render as panels.

Bot is public shorthand, not a finding that every counted account was automated. Sources use different labels: fake accounts, CIB, Pages, sock-puppets, hacked accounts. Where a source does not establish automation, this investigation does not upgrade the label .

Evidence badges

  • documented -- platform report or primary record
  • reported -- journalism or single researcher relaying a count that could not be verified against a platform disclosure
  • unsubstantiated -- circulating without published count, kept with attributed holder
  • disputed -- an exclamation mark on the claim chip, with both holdings in the ledger

Claim references appear as linking to the ledger in `evidence.yaml`. Entity mentions appear as UReputation. Interpretation panels are set after the prose as blockquotes.

The honest sentence

In the 10-year window two platform-confirmed, Tunisia-linked takedowns name a countable number . All else is illustration or gap.

31 claims
38 sources
10 disputed
3 unresolved

2016–2018: no number is a finding

In this window no high-trust source publishes a Tunisia-specific fake-account count . The Meta Threat Reporting index from 2017 onward lists no Tunisia-origin takedown here . The X country report for Tunisia covers only government information and removal requests . Google TAG bulletins surface no Tunisia termination . The ISIE reports list contains no bot annex .

That absence is disclosure, not ground truth . It means nobody with a counter was publishing one.

Archimedes: the first trace

On 16 May 2019 Facebook announced it had removed 265 Facebook and Instagram accounts, Pages, Groups and events originating in Israel and focused on six African countries including Tunisia . The split was 65 accounts, 161 Pages, 23 Groups, 12 events and four Instagram accounts . About 2.8 million accounts followed a Page, about 5,500 had joined a Group and about 920 followed an IG account . Spend was about $812,000 from December 2012 to April 2019 in Brazilian reals, Israeli shekel and dollars . Tunisia's share of the 265 was never published .

Inkyfada counted the Tunisia subset via the DFRLab dataset: eleven Pages created between 17 January and 12 March 2019 , together holding about 500,000 followers . Their 359 posts generated more than one million interactions and their 36 videos gathered near eight million views . That content criticised many politicians but never attacked Nabil Karoui ; five Pages shared Nessma TV or Khalil Tounes material . The count is of Pages only. Do not read it as an account count .

A different lens comes from the monitors. Between 15 May and 15 July 2019 ATIDE and Democracy Reporting International found that unofficial Pages with no declared affiliation, self-categorised as entertainment or satirical, produced 38.5 percent of political messages in their sample . They called clusters sharing similar content within a time window a page network . That figure is a share of messages, not an enumeration of bots .

The same Archimedes operation ran a Tunisian-facing fake watchdog. DFRLab / Atlantic Council documents a Page called Stop a la desinformation et aux mensonges (Stop Disinformation and Lies), created March 2019 and quickly amassing more than 11,000 followers, which posed as a media watchdog while itself being inauthentic . It illustrates the pattern DFRLab flags for Archimedes worldwide: fake locals, then fake newsrooms and leak pages, then fake watchdogs .

Foreign farms that targeted Tunisia

Tunisia was not only a place where a domestic farm was built. It was also a target. Four foreign-origin takedowns list Tunisia among their targets. Each total is global. Tunisia's share in each was never published and is marked here as ? .

  • Iran, 31 Jan 2019: 783 assets globally including Tunisia. 262 Pages plus 356 accounts plus 3 Groups plus 162 Instagram accounts equals 783 . Tunisia share is ? .
  • Egypt linked to El Fagr, 3 Oct 2019: 251 assets globally including Tunisia. 163 accounts plus 51 Pages plus 33 Groups plus 4 Instagram accounts equals 251 . Tunisia share is ? .
  • Iran linked to IRIB, 5 May 2020: 540 assets globally including Tunisia. 118 Pages plus 389 accounts plus 27 Groups plus 6 Instagram accounts equals 540 . Tunisia share is ? .
  • Egypt, Turkey and Morocco linked to the Muslim Brotherhood, 5 Nov 2020: 58 assets globally including Tunisia. 31 accounts plus 25 Pages plus 2 Instagram accounts equals 58 . Tunisia share is ? .

These are not Tunisia counts. The 783 is 262 plus 356 plus 3 plus 162 global . The 540 is 118 plus 389 plus 27 plus 6 global . The 58 is 31 plus 25 plus 2 global . The 251 is 163 plus 51 plus 33 plus 4 global . Do not sum them with each other or with the 993 domestic Carthage total to make a cumulative bot total for 2019 to 2020 . Freedom House relays the April 2020 Iran figure in the same qualified form .

Carthage: the countable farm

The countable farm arrived a year later, and it is the only Tunisia-origin network with a discrete account count . On 5 June 2020 Facebook announced it had removed 993 assets originating in Tunisia and focused on Francophone Sub-Saharan Africa: 446 Pages, 182 Facebook accounts, 96 Groups, 60 events and 209 Instagram accounts . About 3.8 million accounts followed a Page, about 131,900 had joined a Group and about 171,500 followed an IG account . Sixty events drew up to 4,300 interested . Ad spend was about $331,000 primarily in euros and dollars . The network used fake accounts to masquerade as locals, like its own content and drive traffic off-platform .

Facebook said it found the network and linked it to the Tunisia-based PR firm UReputation . DFRLab / Atlantic Council, alerted in September 2019, published a 30-page open-source investigation the same day . It reviewed more than five hundred Pages, Groups and accounts and showed the operation targeted ten countries: Chad, Comoros, Congo-Brazzaville, Cote d'Ivoire, Gambia, Guinea, Mali, Niger, Senegal and Tunisia, and produced election content for in Tunisia in 2019 , Faure Gnassingbe in Togo in February 2020 , Henri Konan Bedie in Cote d'Ivoire in October 2020 and Azali Assoumani in the Comoros in March 2019 . Francophone sites such as Revue de l'Afrique, registered May 2014, Afrika News and Maghreb-Info had operated for more than five years .

The infrastructure trail is an address: Avenue Roseleo, Barcelona in WHOIS for kaissaied.com is a near-identical misspelling of Carrer del Rossello 218, the address of and his Digital Big Brother incubator, identified via the National Registry of Enterprises . The persona marking the enterprise is Fake News Checking, a Facebook page launched 29 August 2019 whose co-founder Moëz Bhar cites ureputation.net since June 2014 . That trail is open-source linkage, not identity proof alone .

Only 182 of the 993 is the Facebook-account count .

The price: collateral

This section is kept as a full section, not a sidebar, because enforcement has costs that calibrate trust in the next takedown .

On 29 to 30 May 2020 up to 60 accounts and Pages belonging to journalists, bloggers and artists were deactivated without warning , including Haythem El Mekki, Sarah Ben Hamadi and Bendir Man, plus the participative web radio Radyoon active since 2012 . Message: you are not eligible to use Facebook, decision is final . Both ARTICLE 19 and Access Now list the same names and quote the same denial from Radyoon: the deleted pages are not pages related to UReputation . About twenty accounts reappeared within 24 hours ; at least 28 were restored via Trusted Partner I Watch and the Access Now Helpline .

Facebook told the Guardian on 4 June it was a small number removed by technical error and now restored . On 5 June its CIB Report said it had deliberately removed 446 Pages, 182 accounts, 96 Groups, 60 events and 209 Instagram accounts linked to UReputation . Whether the 29 to 30 May window is the same as or collateral to that removal remains open . No reconciliation was published .

Hijack: a different playbook

Three weeks after President Kais Saied dismissed the government on 25 July 2021, a different amplification surfaced. Not a domestic farm but evidence that Tunisia can be the target . An analysis of the hashtag Tunisians revolt against the brotherhood looked at 12,000 tweets from 6,800 unique accounts . The majority reported location as Saudi Arabia or the United Arab Emirates . The ten most influential accounts were all Gulf-based influencers including monther72, faljubairi, s_hm2030 and emarati_shield .

The signal was not geography alone. One persona, Fairuz, was retweeted more than 200 times within five minutes after posting an unrelated comic video . More than 200 accounts retweeted that single tweet . A graph showed them as a disconnected constellation far from the main Saudi-Emirati cluster, a shape the researcher reads as inorganic . Many were reused hacked handles .

Do not read 6,800 as 6,800 bots . The source distinguishes a real influencer core from a sock-puppet burst . 6,800 is not 6,800 bots. 6,800 is unique accounts in the hashtag sample. More than 200 is the sock-puppet burst retweeting one persona within five minutes . Do not read a foreign hijack as proof that the domestic 2020 farm was still running.

Decree 54 and the gap

This section is also kept full because it is how the state now defines a fake . Decree Law 54 of 13 September 2022 creates three things the earlier years lacked: a crime for producing or spreading false news or rumours via information systems , Article 24: five years and 50,000 dinars, doubled if the victim is a public official , a retention floor of at least two years for data , and corporate liability . The text contains no bot count .

The capability had arrived a year earlier: on 24 March 2021 UNODC delivered $200,000 worth of forensic equipment and software to the Ministry of Interior . That value is not a scale .

The claim that circulates is qualitative. Arab Center Washington and the POMED Q&A with Amine Snoussi both put it in the same words: heavy digital presence on Facebook, about seventy percent penetration, attacking and doxing individuals once the president has named them, with addresses and judicial leaks preceding arrests . No number is published in either piece .

For 2021 to 2026 no Tier 1 or Tier 2 source enumerates a domestic farm of stated size . Meta and X reports through 2025 add no Tunisia domestic count . Digital Action ahead of the 6 October 2024 election describes pages and groups with tens of thousands of followers managed mostly from abroad, without counting bots . Arab Facts Hub's scrape of more than 150,000 posts finds hundreds of pro-Saied entities, without enumerating fakes . The popular digital army narrative is kept with its holders named. Its scale is kept as ? .

How to count

Four methods produce four different numbers, and they must not be summed . Platform CIB detection counts assets the platform removed . OSINT Page review counts Pages and sites the analyst could corroborate . Sample monitoring counts a share of messages inside a sample . Hashtag science counts tweets and handles inside one hashtag plus graph shape and velocity .

That is why the only two countable takedowns differ from the illustrative figures beside them: 265 includes Tunisia, 993 originates in Tunisia ; 11 is Pages only ; 38.5 percent is a prevalence ; 12,000 is tweets inside one hijack . The same do-not-sum rule governs the foreign-targeting totals: 783, 540, 58 and 251 are each global and include Tunisia, but none is a Tunisia count and none sums with 993 .

What remains open

Four disputes stay open :

Were the sixty artist accounts of late May 2020 fakes or false positives? Hold both . How many of the 265 Archimedes assets were Tunisia-focused? Hold ? . Were 6,800 Tunisian bots on the 2021 hashtag? Hold the typology, not one label . Did a domestic Saied farm of stated size exist 2021 to 2026? Hold D: pattern documented, scale ? until counted .

Falsifiers are in the ledger: an ISIE or HAICA audit with a count and method, Meta publishing a Tunisia slice of 2019, an archive of the Jones tweet IDs, or a post-2024 platform disclosure that enumerates a Tunisia domestic network .

Evidence ledger

ClaimGradeTextSources
C001documented16 May 2019 — Meta (Archimedes Group) removes 265 assets globally including Tunisia: 65 FB accounts + 161 Pages + 23 Groups + 12 events + 4 IG = 265; ~2.8M Page followers, ~5,500 Group joins, ~920 IG followers; ~$812k ad spend Dec 2012–Apr 2019 (BRL/ILS/USD); focus: Nigeria, Senegal, Togo, Angola, Niger and Tunisia + LatAm/SEAfb-cib-israel-2019-05-16
C002reported17 Jan–12 Mar 2019 — Inkyfada (via DFRLab dataset) counts 11 Tunisia-related Pages of the Archimedes takedown, 494,865 followers (~500k); 359 posts >1M interactions, 36 videos ~8M views; never attacked Nabil Karoui; 5 shared Nessma TV / Khalil Tounesinkyfada-facebook-israel-2019-06-03
C003documented15 May–15 Jul 2019 — ATIDE/DRI study sample: unaffiliated entertainment/satirical Pages produced 38.5% of political messages; flag clusters sharing similar content within time windows as 'page network'dri-atide-tunisia-social-media-2019-09-11
C004documentedTunisia slice of Archimedes remains undisclosed by Meta — only Tunisia-sliced enumeration for 2019 is Inkyfada's 11 Pages; contemporary Nawaat (27 May 2019) noted 'published information about Tunisia are quite scarce'fb-cib-israel-2019-05-16, inkyfada-facebook-israel-2019-06-03, nawaat-archimedes-tunisia-2019-05-27
C005documented5 Jun 2020 — Facebook removes 993 Tunisia-origin assets: 446 Pages + 182 FB accounts + 96 Groups + 60 events + 209 IG = 993; ~3.8M Page followers, ~131,900 Group joins, ~171,500 IG followers, up to 4,300 event interest; ~$331k ad spend (EUR/USD); linked to UReputationfb-cib-may2020-announcement, fb-cib-may2020-detailed-pdf, dfrlab-operation-carthage-2020-06-05
C006documentedOperation Carthage targeted 10 African countries and produced election content for Nabil Karoui (Tunisia 2019), Faure Gnassingbé (Togo Feb 2020), Henri Konan Bédié (CIV Oct 2020), Azali Assoumani (Comoros Mar 2019)dfrlab-operation-carthage-2020-06-05, fb-cib-may2020-detailed-pdf
C007documentedFrancophone news-site infrastructure operated >5 years: Revue de l'Afrique (May 2014), Afrika News, AfrikanPost, Maghreb-Info etc. — >2 dozen Pages removed, some launched 8 Jul 2016dfrlab-operation-carthage-2020-06-05
C008documentedAttributable infrastructure: Fake News Checking 29 Aug 2019 (co-founder Moëz Bhar, ureputation.net since Jun 2014) / @360_tn Feb 2015 rename; kaissaied.com WHOIS Avenue Roseleo ≈ Digital Big Brother Carrer del Rosselló 218 (Lotfi Bel Hadj)dfrlab-operation-carthage-2020-06-05, nawaat-operation-carthage-2020-06-16
C009documentedMethod: CIB graph detection (fake-as-local + coordinated posting + concealment + deceptive audience building) after DFRLab referral Sep 2019, plus DFRLab OSINT Sep 2019–Jun 2020 (WHOIS, SecurityTrails subdomains, Twitter history, site graph)fb-cib-may2020-detailed-pdf, dfrlab-operation-carthage-2020-06-05
C010reported29–30 May 2020 — up to 60 accounts/pages belonging to journalists, bloggers, artists and musicians deactivated without warning (incl. Haythem El Mekki, Sarah Ben Hamadi, Bendir Man; participative web radio Radyoon active since 2012)article19-tunisia-accounts-2020-06-15
C011reportedAt least 28 accounts restored via Facebook Trusted Partner I Watch and Access Now Helpline; Facebook sequence — 4 Jun via Guardian: 'technical error, small number restored' then 5 Jun CIB Report: deliberate 993 removal — no reconciliation publishedarticle19-tunisia-accounts-2020-06-15, accessnow-carthage-transparency-2020-06-12
C012reportedJul 2021 hashtag 'Tunisians revolt against the brotherhood' — 12,000 tweets from 6,800 unique accounts; majority self-reported location Saudi Arabia / UAE; top 10 most influential all Gulf-based (monther72, faljubairi, s_hm2030, emarati_shield) — foreign amplification of Saied's 25 Jul movealjazeera-tunisia-manipulation-2021-07-28
C013reportedSock-puppet cluster >200 accounts retweeting persona Fairuz @7__e7 >200 times within 5 minutes (velocity as automation signal); hacked-account reuse (14yo Filipino girl, Emma Roberts / Smurf avatar); persona tweet carried unrelated comic video; disconnected blue constellation vs main cluster = inorganicaljazeera-tunisia-manipulation-2021-07-28
C014documented2016–2018 — no Tier 1–2 Tunisia-specific fake-account or takedown count published; Meta Threat index + X country report list no Tunisia bot disclosure in this window (documented negative)meta-threat-reporting-2026-08-28, x-transparency-tunisia-2026-08-28
C015documented13 Sep 2022 — Decree Law 54 criminalises 'false news/rumours' via information systems (Art.24: 5 years + 50,000 TND, doubled if victim is public official) — text contains no bot countdecree54-dcaf-2022-09-13
C016documented24 Mar 2021 — UNODC delivers $200k forensic equipment/software to Tunisian Ministry of Interior (General Directions of Technical Service and National Guard) — capability, not scaleunodc-forensic-equipment-2021-03-24
C017unsubstantiatedSaied 'digital army' qualitative claim — supporters exhibit 'heavy digital presence' on Facebook, doxing after televised targeting; POMED/Snoussi: disciplined, likely coordinated, collusion suggested by judicial-document leaks preceding arrests; majority anonymous low-follower accounts, some 'likely bots' — but no number publishedarabcenter-tunisia-disinformation-2023-07-21, pomed-saied-digital-army-2023-06-15
C018unsubstantiated2021–2026 — no Tier 1–2 source publishes an enumerated domestic farm size for Saied era; Meta Adversarial Threat + X Transparency checks through 2025 add no Tunisia domestic count; Digital Action Oct 2024 and Arab Facts Hub 150k-post scrape describe networks qualitatively without bot enumeration (documented negative)meta-threat-reporting-2026-08-28, x-transparency-tunisia-2026-08-28, digitalaction-tunisia-briefing-2024-10-22
C019unsubstantiated6 Oct 2024 presidential window — pages/groups with tens of thousands of followers published misinformation mostly managed from abroad; no bot count published (Digital Action); >150k posts scraped, hundreds of pro-Saied entities trafficking conspiracies, no fake-account enumeration (Arab Facts Hub)digitalaction-tunisia-briefing-2024-10-22, arabfactshub-2024-election-facebook-2024
C020documentedMeta Threat Reporting index 2018–2026 lists no additional Tunisia-origin CIB takedown beyond May 2019 Archimedes (origin Israel, Tunisia as target) and May 2020 UReputation (origin Tunisia)meta-threat-reporting-2026-08-28
C021documentedX Transparency reports for Tunisia (country + global/DSA 2025) publish no bot/IO enumeration for Tunisia; IO endpoint 404; no Tunisia campaign in public IO mirrors (MassMove, Zenodo 26)x-transparency-tunisia-2026-08-28, x-io-archive-negative-2026-08-28
C022documentedGoogle TAG bulletins 2018–2026 surface no Tunisia-specific coordinated IO termination for Tunisia_origin or Tunisia_targetgoogle-tag-negative-2026-08-28
C023documentedISIE published reports list (2011–2024, HTML captured 2026-08-28) contains no bot/fake-account annex for 2019 or 2024; only quantified Art.143 application is Aich Tounsi France-2 (207 votes, Facebook ad breach) — spending/silence sanction, not bot censusisie-reports-list-2026-08-28, eu-eom-tunisia-2019-final-fr
C024reportedThe quantified estimates rely on four non-additive methods: (a) platform CIB graph detection (assets = Pages/accounts/Groups/events/IG), (b) OSINT Page/content review (Inkyfada 11 Pages, DFRLab WHOIS/SecurityTrails), (c) sample-based prevalence (ATIDE/DRI 38.5% share of messages), (d) hashtag network science (Jones 12k tweets, graph shape + velocity) — totals must not be summedfb-cib-may2020-detailed-pdf, inkyfada-facebook-israel-2019-06-03, dri-atide-tunisia-social-media-2019-09-11, aljazeera-tunisia-manipulation-2021-07-28
C025documented31 Jan 2019 — Meta (Iran) removes 783 assets globally including Tunisia: 262 Pages + 356 accounts + 3 Groups + 162 IG = 783; followers ~2M Pages / ~1,600 Groups / >254k IG; ad spend <$30k; 8 events May 2014–May 2018; repurposed Iranian state media; Tunisia among ~26 countries (Afghanistan Albania Algeria Bahrain Egypt France Germany India Indonesia Iran Iraq Israel Libya Mexico Morocco Pakistan Qatar Saudi Arabia Serbia South Africa Spain Sudan Syria Tunisia US Yemen); Tunisia slice = ?fb-cib-iran-2019-01-31
C026documented5 May 2020 — Meta (Iran, IRIB) removes 540 assets globally including Tunisia: 118 Pages + 389 accounts + 27 Groups + 6 IG = 540; focus ~21 countries including Algeria Bangladesh Bosnia Egypt Ghana Libya Mauritania Morocco Nigeria Senegal Sierra Leone Somalia Sudan Tanzania Tunisia US UK Zimbabwe; Tunisia slice = ?fb-cib-iran-2020-04-05, fb-cib-april2020-detailed-pdf
C027documented5 Nov 2020 — Meta (Muslim Brotherhood) removes 58 assets globally including Tunisia: 31 accounts + 25 Pages + 2 IG = 58; operated from Egypt Turkey Morocco associated with Muslim Brotherhood; targeted Egypt Libya Tunisia Yemen Somalia Saudi Arabia (6 countries); Tunisia slice = ?fb-cib-oct2020-muslim-brotherhood-2020-11-05
C028documented3 Oct 2019 — Meta (Egypt/El Fagr) removes 251 assets globally including Tunisia: 163 accounts + 51 Pages + 33 Groups + 4 IG = 251; origin Egypt, focused on Somalia Yemen Saudi Arabia Sudan Tunisia Iran Turkey Lebanon Qatar (10 foci); used fake accounts to pose as independent local news orgs, purchased/renamed Pages; links to El Fagr newspaper; Tunisia slice = ?fb-cib-egypt-2019-10-03
C029reportedFreedom House Freedom on the Net 2020 — Tunisia relays April 2020 Iran takedown: 118 Pages, 389 accounts, 27 Groups, 6 IG = 540 tied to Iran, targeting multiple countries including Tunisia (coverage window 1 Jun 2019–31 May 2020; cites Meta April 2020 CIB Report)freedomhouse-fotn-tunisia-2020, fb-cib-iran-2020-04-05
C030reported17 May 2019 — DFRLab documents Archimedes Tunisian-facing watchdog 'Stop à la désinformation et aux mensonges' (Stop Disinformation and Lies) — created March 2019, quickly amassed >11,000 followers — posing as anti-disinformation watchdog while itself inauthentic; corroborates Inkyfada 17 Jan–12 Mar 2019 window; fake-local tells include 'Tunisie Mon amour' using Morocco/Turkey images as Tunisiadfrlab-archimedes-2019-05-17-detail, fb-cib-israel-2019-05-16
C031reportedForeign-origin operations targeting Tunisia (Jan 2019 Iran 783, Oct 2019 Egypt/El Fagr 251, Apr 2020 Iran 540, Oct 2020 MB 58) are categorically distinct from Tunisia-origin Operation Carthage (993) and from global Archimedes (265 origin Israel); none of the foreign globals has a Tunisia slice published — all Tunisia shares = ? — and none should be summed with each other nor with 993 to produce a cumulative 'Tunisia bot total'fb-cib-iran-2019-01-31, fb-cib-iran-2020-04-05, fb-cib-oct2020-muslim-brotherhood-2020-11-05, fb-cib-egypt-2019-10-03, freedomhouse-fotn-tunisia-2020