Both a September report by cybersecurity firm FireEye and a threat assessment post by Google highlight the scope of China’s current global propaganda campaign.

According to FireEye’s Threat Research Blog, thousands of “inauthentic accounts” — across dozens of social media platforms and websites around the world — amplify the Chinese government’s messaging. While several non-government organizations, cybersecurity firms, and media outlets have reported on the way China’s Twitter network manipulates social medial platforms, FireEye and Alphabet say the breadth and scope of the propaganda campaign is much greater than previously thought:

Most reporting has highlighted English and Chinese-language activity occurring on the social media giants Facebook, Twitter, and YouTube. However, we have now observed this pro-PRC activity taking place on 30 social media platforms and over 40 additional websites and niche forums, and in additional languages including Russian, German, Spanish, Korean, and Japanese.

Ryan Serabian, Lee Foster, “Pro-PRC Influence Campaign Expands to Dozens of Social Media Platforms, Websites, and Forums in at Least Seven Languages, Attempted to Physically Mobilize Protesters in the U.S.” at FireEye Threat Research Blog (September 8, 2021)

The posts appeared in several languages, across multiple platforms, and in countries that are not typically targeted by China. They often used similar images and follow-up interactions would appear simultaneously across platforms, indicating a coordinated and automated network. Social media algorithms, like the one Facebook uses, tend to highlight content that has received more interactions, but does not favor “meaningful” interactions. This means an interconnected network of bots can exploit the algorithm, pushing certain content to the top of legitimate users’ newsfeeds.

For example, disconnected posts in German and Spanish on LiveJournal and on Taringa, an Argentinian social media platform claimed that the Covid-19 pandemic started in the U.S. at Fort Detrick in Maryland. This mimics the Chinese government’s official call for the WHO to investigate Fort Detrick as a potential source of the SARS-CoV-2 virus.

Shane Huntly, director of Google’s Threat Analysis Group, told the Wall Street Journal that over the past two years, their group has seen China’s coordinated social media tactics evolve, both in terms of the types of content they publish and the tactics they use to amplify it. “The most significant features of this network remain its scale and persistence, in spite of low engagement levels.”

FireEye says many of these social media accounts began in 2019 and posted content that criticized the Hong Kong democracy protests. They have since switched to Covid-19 messaging. In 2019 Twitter suspended several accounts presumed to be part of a state-backed campaign against the Hong Kong protests.

According to Google’s third quarter threat analysis bulletin, the company removed 850 Youtube channels that are linked to Chinese fake accounts used to spread propaganda.

Most of the content in a given channel is in Chinese and covers benign topics like music, entertainment, and lifestyle. However, a small amount of content in English and Chinese covered China’s Covid-19 vaccine efforts and social issues in the U.S. Previous reports have described one tactic used by these Chinese propaganda accounts: They show pictures of pandas or Chinese landscapes — and then they post negative images or messaging about the Hong Kong protests.

Given the resources required to run this kind of global campaign, both FireEye and Alphabet think that the accounts were likely sanctioned by the Chinese government. However, proving that would require cyberespionage investigation resources at the nation-state level, not usually available to private businesses.

Fake Bot Accounts Tried to Promote Protests in the U.S.

The FireEye report also showed that this network tried to incite political protests in the U.S.:

In April 2021, thousands of posts in languages including English, Japanese, and Korean, images, and videos were posted across multiple platforms by accounts we assess to be part of this broader activity set that called on Asian Americans to protest racial injustices in the U.S.

Ryan Serabian, Lee Foster, “Pro-PRC Influence Campaign Expands to Dozens of Social Media Platforms, Websites, and Forums in at Least Seven Languages, Attempted to Physically Mobilize Protesters in the U.S.” at FireEye Threat Research Blog (September 8, 2021)

The posts specifically called on Asian-Americans to go to a New York City address linked to Chinese billionaire dissident Guo Wengui so protesters could “fight back” against “rumors” started by Dr. Li-Meng Yan, Guo Wengui, and Steve Bannon.

The story is complicated. Guo has been a target of the CCP since 2014 although he himself has been accused of working with the Chinese government because of his attacks on high-profile human rights advocates and CCP critics living in the U.S. Li-Meng Yan appeared on Bannon’s show, War Room Pandemic, claiming that the SARS-CoV-2 virus is a bioterror weapon developed by the Chinese military. Bannon’s show receives funding from Guo Media and the two have engaged in shady business deals that have landed Bannon in jail and saddled Guo with a $530 million fine to the SEC. Yan’s pre-print paper on laboratory modifications to the SARS-CoV-2 genome was funded by the Rule of Law Society & Rule of Law Foundation, both founded by Guo.

Ironically, Guo himself has used this same tactic — sending protesters to demonstrate at a person’s residence to intimidate them — on other CCP critics living in the United States. One of them is Bob Fu, a Christian pastor and former leader of the 1989 Tiananmen pro-democracy movement. Fu is the founder of ChinaAid, an organization that supports and provides legal assistance to Christians who are being persecuted in China.

Fu, fearing for his life after Guo’s protesters continued coming to his home in Midland, Texas, was put under FBI protective custody. He says, he has no idea why Guo would target him. Guo also reportedly hired protesters to threaten a Chinese democracy activist who now lives in California as well as and a well-known CCP critic living in Virginia. The allegation was that they were really CCP spies.

It gets even more complicated. Guo himself has been accused of being a CCP spy by a company he hired to investigate people that he claimed were Chinese spies. The company turned around and accused Guo of trying to sniff out Chinese defectors who were working with the U.S. government. The top fifteen people on Guo’s list were designated by the U.S as “Records Protected,” which usually indicates that the U.S. government is protecting them. Additionally, the company alleges that Guo’s lavish lifestyle and financial resources are not those of a defector.

However, the FireEye report seems to indicate that Guo is not currently in the CCP’s good graces (if he ever truly was). Based on the CCP’s recent crackdown on billionaire tech giants and celebrities, Guo may very well wish to see the CCP fall for personal reasons.

According to FireEye, few apparently showed up at the protests:

“Despite these claims, we have not observed any evidence to suggest that these calls were successful in mobilizing protestors on April 24. However, it does provide early warning that the actors behind the activity may be starting to explore, in however limited a fashion, more direct means of influencing the domestic affairs of the U.S. We believe it is important to call attention to such attempts and for observers to continue to monitor for such attempts in future.

Ryan Serabian, Lee Foster, “Pro-PRC Influence Campaign Expands to Dozens of Social Media Platforms, Websites, and Forums in at Least Seven Languages, Attempted to Physically Mobilize Protesters in the U.S.” at FireEye Threat Research Blog (September 8, 2021)

However, the Chinese-backed Twitter network claimed the protests were a success and posted doctored images of four women at an unrelated protest on racism.

You may also wish to read: The age of the Wolf Warrior: China’s post-pandemic strategy The younger diplomats take their cue from a Chinese Rambo-style movie and the rewritten history they learned at school. (Heather Zeiger)