Cyberwarfare / Nation-State Attacks , Finance & Banking , Fraud Management & Cybercrime

Facebook and Twitter Scuttle Hong Kong Disinformation

Pro-Democracy Protesters Targeted via Information Operations Attributed to China
Facebook and Twitter Scuttle Hong Kong Disinformation
Police fire tear gas to disperse protesters near the central government headquarters in Hong Kong on Aug. 5. (Photo: Voice of America)

Social media giants Facebook and Twitter have suspended a number of accounts that they have tied to a state-backed operation meant to discredit pro-democracy protesters in Hong Kong.

See Also: How Tri-Counties Regional Center Secures Sensitive Files and Maintains HIPAA Compliance

Both firms as well as outside experts say there is extensive evidence tying the Chinese government to these information operations, which used fake accounts to post about local political issues, including the ongoing protests in Hong Kong, which is one of the world's leading financial centers.

"Although the people behind this activity attempted to conceal their identities, our investigation found links to individuals associated with the Chinese government," Nathaniel Gleicher, head of cybersecurity policy at Facebook, says in a blog post.

Twitter has suspended 936 accounts that it says were created from within the People's Republic of China. "Overall, these accounts were deliberately and specifically attempting to sow political discord in Hong Kong, including undermining the legitimacy and political positions of the protest movement on the ground," Twitter's safety team says in a blog post.

"Based on our intensive investigations, we have reliable evidence to support that this is a coordinated, state-backed operation," Twitter says. "Specifically, we identified large clusters of accounts behaving in a coordinated manner to amplify messages related to the Hong Kong protests."

Twitter says its service is banned from inside China, noting that the accounts were created by users using VPNs, as well as from specific IP addresses from inside mainland China that were not blocked from accessing its service.

Samples of content that featured on one of the accounts suspended by Twitter.

Twitter says the suspended accounts appeared to tie to "a larger, spammy network of approximately 200,000 accounts - many created following our initial suspensions" which Twitter says it "proactively suspended before they were substantially active on the service."

Facebook, meanwhile, has suspended five accounts, seven pages and three groups for being a part of "coordinated inauthentic behavior as part of a small network that originated in China and focused on Hong Kong." It notes that some additional, fake accounts created by the same individuals behind the operation had already been flagged and disabled by its automated systems.

Some of the messages disseminated via the Facebook posts attempted to portray protesters as cockroaches who were no better than terrorists. Others suggested that any anti-Beijing sentiments were fake news.

Translation (via Facebook) of content posted onto a suspended Facebook page: "Things the Yellow Media won't tell you. When there is cooperation between thugs and black journalists. What you see are not news."

Beijing has attempted to dismiss the allegations leveled by Facebook and Twitter. In a regularly scheduled press conference on Tuesday, Geng Shuang, a spokesman for China's Foreign Ministry, disavowed any specific knowledge about the activities that led to Facebook and Twitter banning multiple accounts. But he suggested that any social media activity had been conducted not by the Chinese government, but rather the country's students, acting independently.

Geng Shuang, a spokesman for China's Foreign Ministry, speaks at a press conference on Aug. 20. (Photo: Chinese Foreign Ministry)

"I believe you know the attitude of the 1.4 billion Chinese on the situation in Hong Kong," he said. "You may also know clearly the attitude of overseas Chinese, including Chinese students, through media reports. I believe they have the rights to express their opinions and viewpoints."

But Thomas Rid, a professor of strategic studies at Johns Hopkins University in Baltimore, says attribution details that he's seen - but which have not been publicly released - strongly tie these campaigns to Beijing.

"Both Twitter and Facebook deserve huge credit for doing the right thing here, by calling out this semi-covert government operation," Rid tweets. "Both firms are potentially exposing some of their employees and assets to reprisals from Beijing."

Many security watchers have labeled the allegedly Chinese state-run efforts as amateurish, especially when compared to Russian efforts, including extensive, ongoing campaigns by Moscow to influence western democracies and the outcome of elections (see Facebook, Twitter Defend Fight Against Influence Operations).

"I want more on attribution of full data set before jumping to conclusions, but this kind of Russian-style manipulation of U.S. politics is outside bounds of what most analysts think Chinese party/state is doing in info ops space," says Laura Rosenberger, director of the Alliance for Securing Democracy, via Twitter. Her bipartisan, transatlantic organization is a project of the German Marshall Fund of the United States.

"There were already concerns about coordinated, inauthentic, PRC state-driven behavior on Facebook," tweets Matt Schrader, a China analyst at the Alliance for Securing Democracy. "A recent election in Taiwan saw a rather anomalous surge of Facebook support for a pro-PRC candidate, some of which appeared to be driven by PRC-based actors."

Extradition Concerns

The information operations appear to have been launched in direct response to ongoing demonstrations in Hong Kong, a former British colony which is now a special administrative region in China - officially known as the Hong Kong Special Administrative Region of the People's Republic of China.

Demonstrators protest the proposed extradition bill in Hong Kong on June 9. (Photo: Hf9631, via Wikimedia Commons)

The protests were sparked in June by a controversial, proposed extradition bill in Hong Kong - and longstanding fears over China's influence over the region - which would have enabled residents to be sent to China for trial. Currently, Hong Kong has no extradition treaty with either mainland China or Taiwan.

Protesters' Demands

Since then, however, the protests have morphed into a wider call for change, at times turning violent, and with protesters last week closing Hong Kong's airport.

While the protests are leaderless, protesters' demands have come to center on five demands: Withdrawing the extradition bill; the resignation of the region's leader, Carrie Lam; creating an independent inquiry into police violence; conditional freeing of all arrested protesters; and ending labeling the protests as "riots."

On Sunday, an estimated 1.7 million protesters staged a peaceful demonstration, the Guardian reports.

On Tuesday, Lam said that the extradition bill was dead, and said she hoped the recent, nonviolent protests would be a blueprint for moving forward.

"I sincerely hope that this was the beginning of society returning to peace and staying away from violence," Lam said at a Tuesday press conference.

"We will immediately start the work to establish a platform for dialogue. This dialogue, I hope, will be based on a mutual understanding and respect and find a way out for today's Hong Kong," she said.


About the Author

Mathew J. Schwartz

Mathew J. Schwartz

Executive Editor, DataBreachToday & Europe

Schwartz is an award-winning journalist with two decades of experience in magazines, newspapers and electronic media. He has covered the information security and privacy sector throughout his career. Before joining Information Security Media Group in 2014, where he now serves as the executive editor, DataBreachToday and for European news coverage, Schwartz was the information security beat reporter for InformationWeek and a frequent contributor to DarkReading, among other publications. He lives in Scotland.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing healthcareinfosecurity.com, you agree to our use of cookies.