Image via Pixabay. Free use via Pixabay license. On February 28, 2022, internet users in Sudan noticed that some posts from the resistance committees in various neighborhoods had disappeared from their Facebook timelines. The resistance committees are integral to the ongoing protests against military rule in the country, and social media platforms like Facebook are critical to their organizing work. Some users speculated that the posts were disappearing as part of a cyber-attack from Russia or the Canadian lobbying firm Dickens and Madison that had previously been retained by the Sudanese government. However, careful analysis reveals that the attack likely originated in Egypt, Sudan’s northern neighbor with a deep interest in the latter’s domestic politics. A photo shows Mecca mosque quoting: “Like the pearls of the earth.” Resistance committees are neighborhood-based organizations that have played a crucial role in mobilizing protests since the 2019 revolution. These committees are considered the site of the grassroots resistance in Sudan. Born during the dictatorship period of the ousted regime of Omar Al Bashir, the committees have grown in an undemocratic environment and yet managed to remain internally democratic and without a hierarchical structure through their commitment to electing officials democratically. The resistance committees are not affiliated with any political party, which makes them difficult to beat as they are not practicing politics in the way the military expects, even though they have clear goals and they are radical about accomplishing them. A photo shows a boy with black spots on his face. The post plays on religious emotions by saying: “Glory be to the one who creates and innovates.” Pro-democracy groups in Sudan face Coordinated Inauthentic Behaviour (CIB) attacks on Facebook and Twitter from both domestic groups like the Muslim Brotherhood and the ousted regime and foreign networks from Russia and the United Arab Emirates. CIB is when a group of pages or people work together to mislead others about who they are and or what they are doing. These attacks primarily aim to affect public opinion by spreading disinformation, but the last attack aimed at changing the feed’s algorithm to hide information on the user’s Facebook timeline. The nature of the interference is hard to pin down from outside Facebook, but certain patterns are easily noted. First, new pages with anywhere between one and fifteen million followers unrelated to influencers or already famous people started appearing on the news feeds of Sudanese users in February 2022. Typically, these pages focus on riling up religious or emotional sentiments, which increases their engagement metrics. A post calling for people to react with (love) for this photo because they are short. A post shows a photo of a tree inside a mosque claiming that it’s in Cairo, Egypt. The users behind these pages then take advantage of Facebook’s new feature that allows pages to merge. When two or more pages merge, followers and fans are migrated to a new page, and users find themselves following a page they had not subscribed to. A screenshot shows multiple merging processes. After merging pages in this way, those behind the pages then selected a handful of followers to follow back, reacting to their posts either positively or negatively and thereby affecting their visibility to others. As Frances Haugen revealed recently, the various responses on the Facebook reaction bar are weighted differently, and by regularly downvoting or reacting negatively to a person’s posts, large accounts essentially ensure that no one sees them. In effect, the actions create a shadowban — muting the resistance committee posts without telling them. Preliminary evidence suggests that the Sudanese resistance committees’ Facebook accounts have been targeted this way. Several disappeared from news feeds for many days until Sudanese users confronted the situation by searching for and sharing content from the resistance committees despite the shadowbans. The table below presents examples of some pages implicated in this behavior: The page featured a call for its followers to join the group as shown in the photo below. A screenshot shows the call to join the group The owner of the group is called (Mohamed Ramadan, profile ID 100005090072733) and his account is original and active since January 2013. Mohamed’s profile says that he is from Assiut, a city in Egypt. Some of his posts are about Mohamed Abutraika and Mo Salah, the most famous Egyptian football players, and most of them are in Egyptian Arabic. Page number (5) on the above table has three admins and they are based in Egypt as shown in the photo below.