DFRLab
Published in

DFRLab

Twitter’s Hong Kong Archives: Chinese Commercial Bots at Work

Chinese information operation mobilized commercial bot accounts to target Hong Kong pro-democracy protests

(Source: @KaranKanishk/DFRLab)

Targeting the Hong Kong Protests

Tweet about FOO. (Source: Twitter)
Tweet about protestors breaking into the Legislative Council building. (Source: Twitter)

Targeting Guo Wengui

Time breakdown of tweets suggested that some of the accounts targeted Wengui in 2017 and 2018. (Source: @KaranKanishk/DFRLab)
Identical responses to a tweet linking to the Daily Beast report. (Source: Twitter/archive, left; Twitter/archive, right)
YouTube video featuring the conspiratorial claim that Wengui is orchestrating the Hong Kong protests alongside former White House advisor Steve Bannon. (Source: TobyRecorded)

A Commercial, Automated Network

Language breakdown across time suggested that most of the tweets in 2017 were in Indonesian. Arabic, and English were also prominently represented. (Source: @KaranKanishk/DFRLab)
The green boxes in the chart indicates that the top most retweeted accounts in the archive only started tweeting in Chinese in late 2018. Meanwhile, the same accounts had been posting tweets in multiple languages such as English, Indonesian, and Portuguese, since 2011. (Source: @KaranKanishk/DFRLab)
In 2018, the account “Joe” tweeted a mix of commercial as well as political content in Indonesian, Arabic, and Chinese. (Source: @KaranKanishk/DFRLab via Twitter)
Account creation dates for all 936 accounts. (Source: @KaranKanishk/DFRLab)
Tweet client records suggested that many of the accounts used the IFTTT app, along with other automation services. (Source: @KaranKanishk/DFRLab)
The top 10 hashtags boosted from each Twitter client. (Source: @KaranKanishk/DFRLab)
One of the most amplified URLs related to Clash of Clans, a popular mobile-based strategy game. The URLs are expanded from their shortened versions. (Source: @KaranKanishk/DFRLab)

Applications for Cross-platform Posts

Yibo Android, an app that allows cross-platform posts across various platforms, including Sina Weibo, Tencent, Sohu, NetEase, Fanwei, and Twitter. (Source: Yibo Android/archive)

A Network Account in Action

@Licuwangxiaoyua’s tweeting activity show the account had not tweeted for a long time and suddenly started tweeting about Hong Kong. (Source: @KaranKanishk/DFRLab)
@Licuwangxiaoyua’s Twitter feed, showing the account’s switch from promotional and clickbait tweets in 2009–2010 to political tweets in 2019. The account went unused between 2010 and 2019. (Source: @Licuwangxiaoyua/Twitter)

--

--

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.