Twitter’s Hong Kong Archives: Chinese Commercial Bots at Work

Chinese information operation mobilized commercial bot accounts to target Hong Kong pro-democracy protests

@DFRLab
@DFRLab
Sep 4, 2019 · 8 min read
Image for post
Image for post
(Source: @KaranKanishk/DFRLab)

On August 19, Twitter released an archive of 936 accounts it attributed to a “significant state-backed information operation focused on the situation in Hong Kong.” The accounts violated the platform’s manipulation policies, which prohibit spam, coordinated activity, fake accounts, attributed activity, and ban evasion.

In its statement, Twitter said:

The accounts we are sharing today represent the most active portions of this campaign; a larger, spammy network of approximately 200,000 accounts — many created following our initial suspensions — were proactively suspended before they were substantially active on the service.

It also noted that some of the accounts had IP addresses originating in mainland China:

As Twitter is blocked in PRC, many of these accounts accessed Twitter using VPNs. However, some accounts accessed Twitter from specific unblocked IP addresses originating in mainland China.

The DFRLab’s analysis revealed that many of the accounts in Twitter’s archive also used tactics similar to that of a commercial bot network. In particular, some of the automated accounts deployed to target the Hong Kong protests had a history of use for commercial purposes, such as posting spam-like promotional links in high volume.

Analyses of Chinese online propaganda efforts to date have mostly focused on the Communist Party’s use of a human-run, nationalist troll army, often called wumao, or the “50 cents.” The DFRLab’s analysis of this archive, however, concentrates on the use of commercial bot accounts originating within mainland China, which has been less well-studied.

A tweet by one of these commercial-origin accounts, for example, invoked the Fugitive Offenders Ordinance (FOO), a controversial amendment to Hong Kong’s extradition legislation that would allow extradition of fugitives from Hong Kong to mainland China, Macau, and Taiwan. The proposed amendment was the initial catalyst for the current protests, as pro-democracy activists worried that officials could wield it to silence the Chinese government’s critics in Hong Kong. While Hong Kong officials suspended the amendment in June, when the protests first began, they have not officially withdrawn it, which remains one of the protestors’ five chief demands.

The tweet emphasized that Hong Kong natives, along with “anti-China forces” such as the United States, had unnecessarily politicized the proposed extradition amendment.

Image for post
Image for post
Tweet about FOO. (Source: Twitter)

Translated from Cantonese, the tweet reads: “The Extradition Bill was supposed to be a simple legislative adjustment but came under massive attack from the opposition. Taiwanese forces have interfered; U.S. & EU forces are paying ‘special attention’ to the situation; there were signs of support from anti-China forces from abroad [exiled]. All of this has turned the streets of Hong Kong into a space for ‘radical’ political confrontation and anti-china protests.”

Another tweet underscored the threat the Hong Kong protestors pose to law and order in the city.

Image for post
Image for post
Tweet about protestors breaking into the Legislative Council building. (Source: Twitter)

Translated from Cantonese, this tweet reads: “The (violent) protestors have continuously occupied the streets, seriously damaging Hong Kong’s civil security and hurting police officers. On July 1, they exerted significantly violent actions, breaking in and damaging the Legislative Council Complex, which opposition senators instigated by not only not preventing the violent escalation but urging police officers to use restraint and providing the protesters with human and material resources.”

The tweet also added that the Hong Kong police had no other choice but to enforce the law against the violent protestors. The Hong Kong police have faced widespread condemnation from international media and human rights groups on their use of force to quell the protests.

The Hong Kong protests were not the first time the Chinese accounts in this archive were mobilized for political ends.

Tweets in Chinese first started appearing after 2016, peaking in mid-2017 to 2018. Many of these tweets targeted Chinese billionaire Guo Wengui, who fled to the United States after falling out with the Communist Party’s leadership.

Image for post
Image for post
Time breakdown of tweets suggested that some of the accounts targeted Wengui in 2017 and 2018. (Source: @KaranKanishk/DFRLab)

In 2017, the Daily Beast reported that a Twitter bot army had been trolling Wengui.

Image for post
Image for post
Identical responses to a tweet linking to the Daily Beast report. (Source: Twitter/archive, left; Twitter/archive, right)

Coincidentally, Wengui’s name has now surfaced again in connection with the Hong Kong protests. In the United States, Wengui has enjoyed a close relationship with former White House Chief Strategist Steve Bannon. The two have announced plans to set up a fund to investigate corruption in China. Now, in the context of protests in Hong Kong, a conspiracy theory video circulating on YouTube alleges that Wengui and Bannon have masterminded the pro-democracy demonstrations in Hong Kong. The video has amassed nearly 60,000 views.

YouTube video featuring the conspiratorial claim that Wengui is orchestrating the Hong Kong protests alongside former White House advisor Steve Bannon. (Source: TobyRecorded)

The DFRLab did not find any evidence to suggest that the accounts in this archive pushed the conspiracy theory about Wengui’s connection to the protests, however.

The DFRLab discovered several indicators that many of the accounts in this archive may have been both automated and commercial in nature.

First, the accounts featured an extreme diversity in language use. In addition to Chinese, they tweeted in Indonesian, Arabic, English, Spanish, and several other languages.

Image for post
Image for post
Language breakdown across time suggested that most of the tweets in 2017 were in Indonesian. Arabic, and English were also prominently represented. (Source: @KaranKanishk/DFRLab)

The DFRLab previously identified extreme language diversity in tweets among a particular cohort of accounts as characteristic of profit-oriented automated activity. There were two extreme peaks of language use within the set, the first of which comprised tweets in a language the platform could not identify. The second peak, in Indonesian, appeared to be largely comprised of promotional tweets for smartfren.com, a private Indonesian telecom company. It is unclear why these accounts promoted the company.

Since 2011, the top retweeted accounts tweeted in multiple languages: Arabic, English, Indonesian, and Portuguese. The first Chinese tweets appeared in late 2018.

Image for post
Image for post
The green boxes in the chart indicates that the top most retweeted accounts in the archive only started tweeting in Chinese in late 2018. Meanwhile, the same accounts had been posting tweets in multiple languages such as English, Indonesian, and Portuguese, since 2011. (Source: @KaranKanishk/DFRLab)

This finding suggested that these top accounts had already been involved in multiple, geographically diverse retweet campaigns before being mobilized to target a Chinese-speaking audience.

“Joe,” a top account identified only by its user name in the set, posted a mix of promotional spam tweets in Arabic and Indonesian, in addition to tweets in Chinese focused on the United States, and Hong Kong’s extradition bill. This account may have been a commercial spam bot that was later mobilized to target the Hong Kong protests.

Image for post
Image for post
In 2018, the account “Joe” tweeted a mix of commercial as well as political content in Indonesian, Arabic, and Chinese. (Source: @KaranKanishk/DFRLab via Twitter)

In another indicator of automated activity, many of the accounts were created on the same day. The two most popular account creation dates were August 30, 2017, with 119 accounts created, and August 16, 2017, with 97 accounts created.

Image for post
Image for post
Account creation dates for all 936 accounts. (Source: @KaranKanishk/DFRLab)

The accounts also relied heavily on third-party automation software. The most popular third-party client was IFTTT, a tool that allows users to automate their posts, including by retweeting particular hashtags.

Image for post
Image for post
Tweet client records suggested that many of the accounts used the IFTTT app, along with other automation services. (Source: @KaranKanishk/DFRLab)

Much like the top retweeted accounts, the accounts using the IFTTT client posted a significant amount of apolitical content unrelated to the Hong Kong protests. In fact, none of the top 10 hashtags for tweets using IFTTT concerned the protests. One of the most amplified hashtags accounts was “ptl,” short for “praise the lord.” Another top hashtag was in Arabic, while other hashtags seemed to be requests for retweets.

Image for post
Image for post
The top 10 hashtags boosted from each Twitter client. (Source: @KaranKanishk/DFRLab)

Sometimes, the accounts used inauthentic tactics to amplify promotional links. Many of the accounts for example, used URL shorteners, which primarily serve to mask a specific URL. The most amplified URL was “https://generatorclashofclans.herokuapp.com,” which directs users to an unofficial website for the popular strategy video game, Clash of Clans. The URL was amplified by a single account with about 9,160 tweets and retweets.

Image for post
Image for post
One of the most amplified URLs related to Clash of Clans, a popular mobile-based strategy game. The URLs are expanded from their shortened versions. (Source: @KaranKanishk/DFRLab)

The Clash of Clans tweets originated out of a single account that appeared to tag the accounts posting about the Hong Kong protests. Of the account’s more than 70,000 tweets across multiple languages, the DFRLab could not identify any in English or Chinese that directly referenced the protests.

When considered together, these indicators — tweet language diversity, a mix of commercial spam tweets alongside political tweets, identical creation dates, and the use of the same third-party automation client — suggested that these accounts may have belonged to a “retweet farm,” a commercial service that retweets particular posts at high volume. These services often post apolitical promotional tweets but may also be mobilized to post political content.

In the analysis, some of the accounts relied on usage of applications and Google Chrome extensions that enabled users to post across platforms in the West and China.

Accounts Tweet Client records show some Chinese applications, one of which was an extension called FaWave. Other accounts used Yibo Android, a Chinese-built app for Android phones that enables cross-platform publishing. The app is not on the Google Play store but is available as an Android Application Package (apk), a file format compatible with Android phones. Similar versions are available on GitHub and related websites.

Image for post
Image for post
Yibo Android, an app that allows cross-platform posts across various platforms, including Sina Weibo, Tencent, Sohu, NetEase, Fanwei, and Twitter. (Source: Yibo Android/archive)

The accounts employed these cross-platform posting tools to push content in different geographical regions: some, such as Sina Weibo, have a primarily Chinese audience.

While many of the accounts in Twitter’s archive tweeted about the Hong Kong protests, the DFRLab found that a significant portion had also amplified promotional spam content. The network appeared to be inauthentic, given the multiple languages in which it posted, often on the same account and in the same time period. Some of the accounts also started as a means of promoting commercial interests.

One such account was @Licuwangxiaoyua, which was created in July 2009 and which posted promotions in English into 2010, before falling dormant. Nearly 10 years later, however, it was revived, pivoting from posting commercial content to posting content relating to the protests in Hong Kong.

Image for post
Image for post
@Licuwangxiaoyua’s tweeting activity show the account had not tweeted for a long time and suddenly started tweeting about Hong Kong. (Source: @KaranKanishk/DFRLab)
Image for post
Image for post
@Licuwangxiaoyua’s Twitter feed, showing the account’s switch from promotional and clickbait tweets in 2009–2010 to political tweets in 2019. The account went unused between 2010 and 2019. (Source: @Licuwangxiaoyua/Twitter)

Ultimately, it appears that the network may have employed a division of labor: some of the accounts were mobilized for political purposes, targeting the pro-democracy protests in Hong Kong, while others focused on promoting commercial spam-like URLS and content. In some cases, however, the DFRLab found evidence that commercial bots initially focused on tweeting promotional spam in multiple languages had been mobilized and redirected to tweet about Hong Kong.

Kanishk Karan is a Research Assistant with the Digital Forensic Research Lab.

Pepe Zhang, Associate Director with the Atlantic Council’s Adrienne Arsht Latin America Center, contributed to this report in the form of translation assistance.

Follow along for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Medium is an open platform where 170 million readers come to find insightful and dynamic thinking. Here, expert and undiscovered voices alike dive into the heart of any topic and bring new ideas to the surface. Learn more

Follow the writers, publications, and topics that matter to you, and you’ll see them on your homepage and in your inbox. Explore

If you have a story to tell, knowledge to share, or a perspective to offer — welcome home. It’s easy and free to post your thinking on any topic. Write on Medium

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store