China flag


China country

Date Released

19 September 2019

Twitter Takedowns


Twitter Attribution: China

  • Accounts originating within the People’s Republic of China

Key Messages & Targets

  • Depicting Guo Wengui as corrupt and not to be trusted
  • Depicting the Hong Kong protests as unjustified and violent
  • Depicting the US as having mismanaged Covid-19 response
  • Disrupting the 2020 Taiwan elections
  • Promoting China’s handling of the Covid-19 pandemic
  • Attempting to assert moral equivalence between the US and China by amplifying coverage of the Black Lives Matter protests and equating US Government responses to domestic protest about the death of George Floyd with the suppression of protest in Hong Kong

Notable Tactics

  • Sharing of images with dense simplified Chinese characters
  • Sharing of videos with automated text-to-voice
  • Impersonating US citizens, Hong Kong citizens, media outlets, brands and the Chinese diaspora
  • Repurposing commercial and spam accounts
  • Retweeting Chinese Communist Party and state media

Twitter Activity




Accounts in dataset



Active accounts in dataset



Were retweets



Had media



Had links



Used hashtags

Takedown Timeline

Twitter Description

We are disclosing a significant state-backed information operation focused on the situation in Hong Kong, specifically the protest movement and their calls for political change.

This disclosure consists of 936 accounts originating from within the People’s Republic of China (PRC). Overall, these accounts were deliberately and specifically attempting to sow political discord in Hong Kong, including undermining the legitimacy and political positions of the protest movement on the ground. Based on our intensive investigations, we have reliable evidence to support that this is a coordinated state-backed operation. Specifically, we identified large clusters of accounts behaving in a coordinated manner to amplify messages related to the Hong Kong protests.

As Twitter is blocked in PRC, many of these accounts accessed Twitter using VPNs. However, some accounts accessed Twitter from specific unblocked IP addresses originating in mainland China. The accounts we are sharing today represent the most active portions of this campaign; a larger, spammy network of approximately 200,000 accounts—many created following our initial suspensions—were proactively suspended before they were substantially active on the service.

Twitter released four datasets of networks containing a total of 28,991 accounts that it has attributed to a state-backed information operation originating within the People’s Republic of China. Those datasets represented the most active accounts across multiple campaigns. They included at least an additional 350,000 spammy amplifier accounts that were deleted but not publicly released. Twitter is blocked in mainland China, but some of those accounts were able to access the platform using VPNs. In some cases, accounts used specific unblocked IP addresses originating in mainland China.

The networks disclosed in these datasets generally sought to influence attitudes of Chinese diaspora communities and citizens overseas on domestic and foreign policy issues that were of concern to the Chinese Communist Party (CCP). Tweets contained both simplified Chinese text, which is used by Chinese citizens originating from the Chinese mainland, and traditional Chinese text, which is used in Hong Kong and Taiwan.

While each dataset corresponded to distinct groups of accounts, the activity and targeting were consistent across all networks. Tweeting activity began as early as April 2017 and attacked the characters of Chinese dissidents, including US-based exiled Chinese billionaire, Guo Wengui. In February 2019, Hong Kong authorities proposed legislation allowing extradition to mainland China, which prompted mass peaceful protests in June that led to clashes between police and demonstrators. In response, the network was mobilised to condemn the Hong Kong protests before shifting its targeting to the 2020 Taiwan elections and criticisms of US management of the Covid-19 pandemic in early 2020. In the June 2020 Twitter takedown release, the network associated with this dataset amplified legitimate English-language content associated with US protests to draw a moral equivalence between the US and China.

Hashtags such as #香港 (Hong Kong), #HK, #郭文贵 (Guo Wengui), #班农 (Bannon) and #MilesGuo were commonly used across all networks, but the majority of the messaging was disseminated via images and videos. Provocative images were used, such as illustrations of Hong Kong protesters as cockroaches and an artwork depicting the Statue of Liberty kneeling on George Floyd.

Another key tactic deployed by the network in the June 2020 dataset was to share images with dense simplified and traditional Chinese characters. This format of the images was replicated for multiple topics, including posts that smeared Guo Wengui or promoted the CCP’s handling of Covid-19. Some of the images were hastily created and were clearly screenshots, with editing tools visible in the images. Videos typically had automated text-to-voice and poorly translated English subtitles. Some of the tweets linked to YouTube channels that hosted similar videos with very few followers and views. Google’s Threat Analysis Group has since removed more than a thousand YouTube channels that were behaving in a coordinated manner and sharing content that aligned with Graphika’s findings on a related but distinct pro-CCP network.

In general, these networks were clumsily constructed and lacked nuanced content that would effectively persuade audiences. In some cases, accounts attempted to impersonate Western users by using common Western names as profile names and self-reporting their locations in the US, despite accounts being the most active during business hours aligning with Beijing’s time zone (this was particularly obvious in the June 2020 dataset). The vast majority of accounts were created at the end of 2019, which correlated with the increase in tweeting activity by accounts in these networks. Profile images were usually plagiarised from public sources and included anime, women, Korean celebrities and landscapes.

There was evidence that some accounts were purchased from commercial operators that had built pre-existing follower bases, while other accounts were probably repurposed or hacked, based on changes in the tweeting content found in the dataset. Many of the tweets were of commercial material and pornography. Accounts that had news-related profile names such as ‘Worldnewsnow’, or ‘Viral news’ were probably chosen to draw attention and increase the network’s reach. Some of those accounts had more than 5,000 followers, but it was unclear from the data whether those followers were legitimate Twitter users. Many accounts that were created in 2019 were proactively suspended before they were substantially active, following Twitter’s initial suspensions in June 2019.

Overall, very few of the accounts in this network achieved any sort of significant organic reach, and there was a continued lack of focus on developing plausible personas. In February 2021, Graphika reported that the tweets of accounts with similar features to the CCP-linked Twitter takedown datasets had been embedded in Greek and Indian media outlets, were creating faux brands and news outlets and were boosted by Chinese diplomats. This indicates that some aspects of CCP information operations on social media may be improving. Ultimately, the networks disclosed by Twitter show that CCP-linked operators are likely to be experimenting with methodologies and will remain persistent on Western platforms.

Here is the databroken down.

Tweets Over Time

Account Creation Over Time

Twitter Activity

Top 10 Most Retweeted Accounts

Top 10 Most Used Hashtags

Top 10 Most Mentioned Countries

Top 10 Most Shared Domains


Top 10 Most Used Twitter Clients

Twitter ClientTimes Used

Posting Activity

Recorded posting patterns, captured tweets, and media data.

Understanding behaviour by looking at daily patterns, captured tweets, and the type of media and commentary made by accounts.

China Posting Patterns

Download CSV

To reference this pageuse the button below