Twitter released four datasets of networks containing a total of 28,991 accounts that it has attributed to a state-backed information operation originating within the People’s Republic of China. Those datasets represented the most active accounts across multiple campaigns. They included at least an additional 350,000 spammy amplifier accounts that were deleted but not publicly released. Twitter is blocked in mainland China, but some of those accounts were able to access the platform using VPNs. In some cases, accounts used specific unblocked IP addresses originating in mainland China.
The networks disclosed in these datasets generally sought to influence attitudes of Chinese diaspora communities and citizens overseas on domestic and foreign policy issues that were of concern to the Chinese Communist Party (CCP). Tweets contained both simplified Chinese text, which is used by Chinese citizens originating from the Chinese mainland, and traditional Chinese text, which is used in Hong Kong and Taiwan.
While each dataset corresponded to distinct groups of accounts, the activity and targeting were consistent across all networks. Tweeting activity began as early as April 2017 and attacked the characters of Chinese dissidents, including US-based exiled Chinese billionaire, Guo Wengui. In February 2019, Hong Kong authorities proposed legislation allowing extradition to mainland China, which prompted mass peaceful protests in June that led to clashes between police and demonstrators. In response, the network was mobilised to condemn the Hong Kong protests before shifting its targeting to the 2020 Taiwan elections and criticisms of US management of the Covid-19 pandemic in early 2020. In the June 2020 Twitter takedown release, the network associated with this dataset amplified legitimate English-language content associated with US protests to draw a moral equivalence between the US and China.
Hashtags such as #香港 (Hong Kong), #HK, #郭文贵 (Guo Wengui), #班农 (Bannon) and #MilesGuo were commonly used across all networks, but the majority of the messaging was disseminated via images and videos. Provocative images were used, such as illustrations of Hong Kong protesters as cockroaches and an artwork depicting the Statue of Liberty kneeling on George Floyd.
Another key tactic deployed by the network in the June 2020 dataset was to share images with dense simplified and traditional Chinese characters. This format of the images was replicated for multiple topics, including posts that smeared Guo Wengui or promoted the CCP’s handling of Covid-19. Some of the images were hastily created and were clearly screenshots, with editing tools visible in the images. Videos typically had automated text-to-voice and poorly translated English subtitles. Some of the tweets linked to YouTube channels that hosted similar videos with very few followers and views. Google’s Threat Analysis Group has since removed more than a thousand YouTube channels that were behaving in a coordinated manner and sharing content that aligned with Graphika’s findings on a related but distinct pro-CCP network.
In general, these networks were clumsily constructed and lacked nuanced content that would effectively persuade audiences. In some cases, accounts attempted to impersonate Western users by using common Western names as profile names and self-reporting their locations in the US, despite accounts being the most active during business hours aligning with Beijing’s time zone (this was particularly obvious in the June 2020 dataset). The vast majority of accounts were created at the end of 2019, which correlated with the increase in tweeting activity by accounts in these networks. Profile images were usually plagiarised from public sources and included anime, women, Korean celebrities and landscapes.
There was evidence that some accounts were purchased from commercial operators that had built pre-existing follower bases, while other accounts were probably repurposed or hacked, based on changes in the tweeting content found in the dataset. Many of the tweets were of commercial material and pornography. Accounts that had news-related profile names such as ‘Worldnewsnow’, or ‘Viral news’ were probably chosen to draw attention and increase the network’s reach. Some of those accounts had more than 5,000 followers, but it was unclear from the data whether those followers were legitimate Twitter users. Many accounts that were created in 2019 were proactively suspended before they were substantially active, following Twitter’s initial suspensions in June 2019.
Overall, very few of the accounts in this network achieved any sort of significant organic reach, and there was a continued lack of focus on developing plausible personas. In February 2021, Graphika reported that the tweets of accounts with similar features to the CCP-linked Twitter takedown datasets had been embedded in Greek and Indian media outlets, were creating faux brands and news outlets and were boosted by Chinese diplomats. This indicates that some aspects of CCP information operations on social media may be improving. Ultimately, the networks disclosed by Twitter show that CCP-linked operators are likely to be experimenting with methodologies and will remain persistent on Western platforms.
