The Spread of Ukraine Biolabs Conspiracy Content in Chinese on Twitter

Tim Niven, Research Lead, Doublethink Lab

Key Findings

• On Twitter, Chinese-language Ukraine biolabs conspiracy content is shared by three distinct communities: little pinks and PRC state media; Russia-aligned conspiracy theorists; and a community opposing these narratives.
• An account that appears to be run by a Russian-state-aligned PRC-born influencer living in Moscow, @JiangShangrong, is the most influential account in our dataset as measured by retweets. He does not satisfy our definition of a little pink and belongs in the Russia-aligned community. He appears to act as a significant bridge for Russian state propaganda into Chinese-language speaking communities on Twitter. As of August 30th, 2022, his account has been suspended by Twitter for reasons unknown.
• The most retweeted tweets in the little pink community build on a conspiracy connecting U.S.-funded biolabs in Ukraine to experiments on bat coronavirus pathogens, created by the Russian state.
• The spread of this conspiracy in Chinese on Twitter is led by the PRC state media, in particular, @GuanchaNewMedia and @Tong_Shuo, who copy-pasted from the same CCTV Weibo post, and tweeted at the same time.
• We find two accounts that almost exclusively retweet PRC state media that satisfy well-established indicators that give us high confidence they are PRC government-operated influence operation assets. After sharing this finding with Twitter, these two accounts have been suspended.
• Among the top-5 little pinks whose biolabs conspiracy content was retweeted the most, two show strong signs of inauthenticity. They both copy-paste PRC state media from Weibo or Twitter, effectively skirting Twitter’s state media labeling. A third is a CCTV commentator.

Suggested Platform Action

• Twitter should label @GuanchaNewMedia and @realGuancha as PRC state media, due to their close connections to official PRC state media, and content coordination.
• Twitter should consider a policy addressing the behavior of copy-pasting PRC state media content, which effectively skirts the state media label. The goal of such a policy would be to impose a cost on inauthentic actors, and send a normative signal that this behavior is considered manipulative.
• We recommended that Twitter remove the two accounts we identified with high confidence as PRC internet army assets. These accounts have since been suspended by Twitter.

Introduction

Doublethink Lab has been monitoring the laundering of Russian state propaganda by the PRC government, and its spread within the PRC’s internal information environment. These findings are alarming due to the apparent teaming up of two large, authoritarian states, to manipulate global information environments, whitewash war crimes, and attack their victims.

The Ukraine biolabs conspiracy was started by Russia. It serves a number of obvious propaganda functions for the Russian government. It attacks the U.S. and shifts attention away from their own war crimes. For the PRC, it additionally presents an opportunity to muddy the waters about COVID origins and shift blame elsewhere, and distract PRC citizens and diaspora from serious internal problems with the spread and mismanagement of COVID.

This case study aims to investigate how Ukraine biolabs conspiracy content spread in the Chinese language on Twitter. The key question is whether it is led by the PRC state media or “little pinks.” A little pink is a PRC patriot whose views on CCP core interests and external issues are aligned with the PRC state media (e.g., Xinjiang, Taiwan, COVID origins, the invasion of Ukraine, etc), but not necessarily all PRC domestic issues — e.g., little pinks have been known to support the feminist movement. At Doublethink Lab, we have developed a machine learning classifier to detect little pink accounts on Twitter with a good degree of accuracy. In developing this classifier we added to the definition of a little pink that they must post about more than one topic of core interest to the CCP. For example, an account that aligns with PRC state media on the invasion of Ukraine may just be a Russian state-aligned account. One key reason to develop this classifier is because PRC government internet army accounts are a subset of little pinks (since they also post content aligned with the PRC state media). This guides our investigation and allows us to focus on relevant accounts to look for signs of coordinated and inauthentic behavior (CIB). If attributable to the PRC government, CIB would indicate a concerted effort on their part to spread and amplify biolabs conspiracy content on Twitter.

Data Collection and Account Classification

In collaboration with Dr. Puma Shen, we used the Twitter Academic API version 2.0 “search” endpoint with the following parameters:

• query: (烏 生化實驗室) or (烏 生物實驗室) or (烏 生化武器) or (烏 生物武器) or (乌 生化实验室) or (‘乌 生物实验室) or (乌 生化武器) or (乌 生物武器)
• start: 2022–02–01
• end: 2022–04–30

This yielded 8,904 tweets and 4,554 unique accounts. 1,954 are original tweets, and 6,950 are retweets. 1,076 distinct accounts posted original tweets, and a further 2,396 only retweeted. The number of tweets over time is shown in the following figure, which shows that biolabs content peaked on March 10th, which coincided with Tucker Carlson spreading a version of the Ukraine biolabs conspiracy on Fox News:

Keyword-based sampling is not able to perfectly match a topic of interest, and this case is no exception. We noticed a small amount of content relating to the use of biological weapons in the invasion of Ukraine, unrelated to biolabs. This explains some of the tweets appearing before the observed biolabs-related peak on March 10th.

Given this data sample, we used our little pink classifier to conservatively detect which accounts are little pinks. We say “conservatively” because our classifier prioritizes precision over recall. In other words, our classification methodology leans towards minimizing false positives. Therefore, we will likely underestimate the number of little pinks in this data. After classification, we identified 778 (17%) little pink accounts, 11 PRC official accounts, and 3,765 (82%) other accounts.

What communities spread Chinese-language biolabs content on Twitter?

We applied the community detection algorithm infomap on the directed retweet network formed by the data collected as described above. At the highest level, there are three distinct communities spreading Ukraine biolabs content: one clustering around PRC state-commercial media Guancha, another around Russian state-aligned influencer @JiangShangrong, and a less homogenous super-community clustering around @VOAChinese:

The proportion of tweets (including retweets) that each community is responsible for is: @VOAChinese 44%, @JiangShangrong 24%, @GuanchaNewMedia 18%.

In order to get a sense of the important nodes in these communities, we look at the retweet graph. Using Gephi for visualization, and filtering out less important nodes (i.e., with a weighted degree of less than 10), the network looks as follows, with the @GuanchaNewMedia cluster at the top, the @JiangShangrong cluster in the middle, and the @VOAChinese super-community in the bottom and left:

Little Pinks

We use our little pink account classifier to get a sense of where the little pinks sit in this network. Using the same network graph and marking detected little pink accounts with the color pink, and PRC official accounts in red, the network looks as follows:

We can see that the community connected to the PRC state media is fairly homogeneous insofar as it is mostly composed of little pinks. Manual inspection confirmed many of the green dots in that community are indeed little pinks (our classifier leans towards a conservative judgment, as mentioned above). A small number of little pinks are also in the Russia-aligned community.

Without an automatic classifier such as we have for little pinks it is harder to get a sense of the homogeneity of the other communities, and the nature of their accounts. We therefore look at the most retweeted content, and the accounts involved, in order to make a rough characterization of each.

Russia-Aligned Conspiracy Theorists

The community in the middle of our figure clusters around @JiangShangrong. His most retweeted tweet is:

We translate this tweet as follows:

The Russian Ministry of Defense has presented for the first time the complete list of the Ukrainian Ministry of Defense and Ministry of Health agencies funded by the DTRA (the U.S. Defense Threat Reduction Agency). The list includes the program’s deadlines, budget, and tasks. The investment fund Rosemont Seneca, led by Hunter Biden, has provided funding to Ukrainian laboratories. His foundation has close ties to Metabiota, and to Black and Veach. Black and Veach is the Pentagon’s main supplier of equipment to biolabs around the world.

@JiangShangrong was born in the PRC, and is a well-known singer, currently living and teaching in Moscow. It is important to note that @JiangShangrong does not satisfy our criteria for being a little pink. Although his views on the Russian invasion of Ukraine are consistent with PRC state media, he does not discuss any topics that are core interests of the CCP. This tweet connects not only Russian state conspiracy theories, but also U.S. domestic conspiracy theories. We note that the DTRA conspiracy is also echoed by the PRC state media.

The next top two tweets are also from @JiangShangrong, and follow the same narrative. The latter is the second tweet in a multi-tweet post, the first of which did not contain our keywords but received 811 retweets. It posts a Russian Ministry of Defense video about the biolabs conspiracy to which @JiangShangrong claims to have added Chinese subtitles, further suggesting his importance and influence for spreading Russian state propaganda in Chinese-language speaking communities on Twitter:

Translation:

Today’s Russian Ministry of Defense update on the conditions of the war is absolutely serious! I have directly added Chinese subtitles.

The next top tweet is from @seagrace6. Their profile photo is a jack-o-lantern carved with the words “Trump Won.” This provides a strong indication that this account is also connected to U.S. domestic conspiracy theories, in addition to spreading Russian state-aligned biolabs conspiracy content.

The final account we consider in the middle cluster is @CaoChangqing, and their most retweeted tweet is aligned with Russian-state propaganda, as well as directly referencing the Tucker Carlson show, also connecting to U.S. domestic conspiracy theories.

Given that we have only sampled three accounts in this community, our conclusions must remain tentative. However, it appears that this community consists of accounts that are aligned with Russian state narratives, as well as U.S. domestic conspiracy theories. The retweet network shows significant interactions between this community and the little pinks. Given the antagonistic attitude of Trump towards the PRC government, it is surprising to see so many interactions between this community and the little pinks. The nature of these interactions therefore warrants further study.

Opposing Voices

Infomap suggests that the @VOAChinese cluster should be considered as composed of three distinct sub-communities:

The most retweeted tweet in each sub-community comes from @lude_media, @VOAChinese, and @HAGnews01. Each one is clearly in opposition to Russian and PRC state messaging. The account profiles also strongly suggest that this community is, in general, ideologically opposed to the CCP.

Once again, from such a small sample, it is difficult to draw strong conclusions about the composition of this third super-community. However, our observations are consistent with this community being opposed to PRC state propaganda, and Russian state propaganda in at least this instance. Infomap shows a decent connection between this community and the Russian-aligned community clustered around @JiangShangrong. We suspect this overlap pertains to U.S. domestic conspiracy content, which is known to be well received among a portion of the Chinese diaspora who are opposed to the CCP.

It is also notable that this community accounts for 44% of the content captured by our keyword queries, which may be counterproductive if the goal of this community is to oppose these narratives, because increased attention will likely increase the probability that all communities will see the conspiracy in their feed.

How is Chinese-language biolabs conspiracy content spread and amplified in the Little Pink network?

The biolabs conspiracy theories have a number of versions that evolved over time, and different versions appear to be more or less important to different communities. The most retweeted tweet in the Russia-aligned community makes no mention of coronavirus, focusing on connections between Ukraine biolabs and the pentagon, presumably in order to infer that Ukraine has U.S.-funded biological weapons. As we will see below, the little pink and PRC state media community focus on conspiracies linking Ukraine biolabs to COVID-19.

What are the most retweeted biolabs conspiracy tweets?

Considering all account types in the little pink community (PRC official and little pink), the most retweeted tweet comes from @GuanchaNewMedia on the 10th of March:

We translate this tweet as follows:

Russian Ministry of Defense: a U.S. biological laboratory in Ukraine conducted experiments with bat coronavirus pathogens. According to a CCTV report, on the 10th of March local time, the Russian Ministry of Defense announced that, according to documents obtained, a biological laboratory in Ukraine established with U.S. funding support has conducted experiments with bat coronavirus pathogens.

This tweet cites the Russian Ministry of Defense as a source, and includes the key claim that U.S.-funded biolabs in Ukraine conducted experiments on bat coronavirus pathogens. Note that this claim is worded so as to imply but not directly state a link to COVID-19. More explicit links are subsequently made later. For example, on the 23rd of March, the Global Times reported that Moderna created COVID-19, which is juxtaposed with the biolabs conspiracy claim (2). The supposed link between Moderna’s creation of COVID-19 and the Ukraine biolabs is not made explicit, and left for little pinks to infer — a common feature of conspiracy theory discourse.

The second most retweeted tweet in our little pink network comes from @XiaozhPhD04, two days after the Global Times article, who liberally connects the dots between Moderna and Ukraine:

We translate this tweet as follows:

English media report that English scientific research discovered that COVID-19 is a purely artificial disease manufactured by American company Moderna. Russian state media have also made public evidence that a U.S. military biological laboratory in Ukraine was performing experiments with COVID-19. But these important findings have not created any waves, because what people are concerned about is not the pandemic, but the Ukraine-Russia war.

The U.S.’ biggest wish is that the Ukraine-Russia war will not stop; they are continually pouring oil on the fire. This is exactly what public intellectuals mean by “the art of shifting attention.”

The implication is that secrets pertaining to Moderna’s creation and the spread of COVID-19 by the U.S. are hidden in the Ukraine biolabs, which is why the U.S. wants to stoke the fire of the war, in order to distract the world from these revelations.

The third most retweeted tweet comes from PRC state media @Tong_Shuo:

We translate this tweet as follows:

Russian Ministry of Defense: a U.S. biological laboratory in Ukraine conducted experiments with bat coronavirus pathogens.

Note that this headline is exactly the same as the most retweeted tweet from Guancha, above. Both tweets were posted within 22 seconds of each other. It turns out the headline, and the subsequent sentence in the @GuanchaNewMedia tweet, are all found in the same CCTV Weibo post 40 minutes prior.

Who led the spread of the conspiracy linking the Ukraine biolabs to experiments with bat coronavirus pathogens?

We focus on the conspiracy claims in the most retweeted tweet — i.e., only up to the claim that “U.S. funded biolabs in Ukraine conducted experiments on bat coronavirus pathogens.” Searching through all tweets in our sample for tweets containing all three: “Ukraine” (烏 or 乌), “experiment” (實驗 or 实验), and “bat” (蝙蝠), it is evident that the PRC state media led this conspiracy theory on Twitter:

This timeline shows that the PRC state media are the first to post these conspiracy claims in Chinese on Twitter across all communities in the sample. It also shows that five of the six (apparently) non-official accounts in the first ten to share this content are copy-pasting or quoting PRC state media. We will explore this copy-paste behavior further in the next section.

Who are the most retweeted little pinks?

Answering this question attempts to roughly gauge which accounts spreading biolabs content are the most influential within the little pink network. We restrict ourselves to looking at the top-5 little pink accounts by retweets of biolabs conspiracy content. We examine each account for classic signs of inauthenticity which may indicate influence operations. The data we used to conduct this analysis comes from collecting up to one year’s worth of historical tweets for each account working back from April 2022. From these tweets, we determine an “operating profile” of the account that describes when and how frequently they tweet and retweet, who they retweet and how much, and the time distribution of their account activity.

The most retweeted little pink is @XiaozhPhD04, discussed in the section above. They appear to be an economist, with an entry in Baidu. We do not find any indicators of inauthenticity. We note that they retweeted @JiangShangrong 56 times in this period, providing a significant connection between these two communities. There are no particular red flags in their operating profile, which shows they are likely located in the PRC, and mostly retweet themselves:

The second most retweeted little pink is @effle_lee:

This account matches a number of inauthentic indicators. First, the profile photo appears unnatural. A reverse image search reveals at least two (1, 2) other versions of this photo with different faces:

Second, this account has a near equal number of followers and following — an indicator found in prior research that indicates inorganic social network development. Third, they display an unusually high volume of tweets (247 per day), only 26% of which are retweets, which is in the top 1% of the distribution of original tweets per day for all 4,554 accounts in this sample. This means they spend a very large amount of time tweeting each day, potentially as a job, but also consistent with a highly motivated little pink. Their account operating profile suggests they are in the GMT+8 (Beijing’s) timezone and tweet at all hours of the day, sleeping around midnight:

Fourth, we observe suspicious tweeting behavior that effectively skirts Twitter’s labeling of PRC state media. Their most retweeted tweet is:

This is almost exactly the same as Tong_Shuo’s tweet, discussed above: they have kept the same photo, the same headline, and added one more paragraph itself directly copied from Guancha’s tweet (discussed above, which is in turn copied from CCTV), however in traditional Chinese (the Guancha tweet is in simplified Chinese). This tweet is published ~57 minutes after the Tong_Shuo and Guancha tweets, which is not close enough to strongly suggest coordination.

The third most retweeted account, @Rbx5lY, shows no signs of inauthenticity. Their most retweeted biolabs tweet is a long thread that explicitly claims that U.S. biolabs in Ukraine were responsible for spreading COVID-19. Their operating profile indicates that they mostly post 10 original tweets per day, and don’t appear to be in the GMT+8 timezone:

The fourth most retweeted account, @Dorsey_Queens, has an unusual operating profile. Their time distribution is unusually stacked during Beijing business hours, greatly reduced on weekends, and the level of activity is very low. which may indicate that is one among a batch of multiple accounts that are operated together:

We leave this observation as indicative at this time, requiring further investigation. Their most retweeted tweet also copy-pastes PRC state media:

We translate this tweet as follows:

Russian Ministry of Defense today revealed that the U.S. spent more than $200m USD opening more than 30 biolabs in Ukraine, some of which conducted research into biological weapons. Following the Russian army’s entry into Ukraine on the 24th of February, the Ukrainian Department of Health gave emergency instructions to destroy documents pertaining to “particularly dangerous pathogens,” and that several of these documents were obtained by Russia and subsequently made known to the public.

This text is copy-pasted from China Radio International (CRI). The tweet also re-posts both images from the CRI post. The CRI post is marked as being published on March 12th at 8:25pm GMT+8. This tweet was posted on March 12th at 8:34pm GMT+8, only 9 minutes later. This is close enough to make us suspect potential coordination — however, we leave the further investigation of this particular account to future work.

The fifth most retweeted account, @xiaolabaguangb1, also appears to be an authentic influencer, and appears on PRC state media (CCTV) as a political commentator. His most retweeted tweet quotes Putin as urging the U.S. to open their alleged Ukraine biolabs to international inspection. His operating profile is consistent with his stated location of Beijing:

We conclude with the following observations. Two of the top 5 most retweeted little pinks spreading biolabs conspiracy content copy-paste PRC state media, effectively skirting Twitter’s labeling of PRC state media accounts, and showing strong signs of inauthenticity. One more account is a PRC state media TV commentator. Although the other two appear to be authentic, their narrative content follows previously published PRC state media conspiracy theories, found either on Twitter or inside the PRC’s internal information environment at prior times. They appear to be following, not leading, the PRC state media.

Is there any obvious inauthenticity in the amplification of PRC state media?

We stick to our analysis of the operating profiles of accounts with unusually high levels of state media retweeting in our expanded dataset (containing historical tweets of up to one year) and previously identified indicators of inauthenticity.

We focus on this portion of the filtered retweet graph:

We focus on the top-left corner, where two accounts appear to retweet CNS1952 and XinhuaChinese an unusually high amount. Both accounts display classic signs of internet army behavior. The first is @fN6na1iTwNCPWv2:

Their operating profile indicates an unusually large number of tweets per day, 168, 94% of which are retweets. Of these retweets, the top 8 retweeted accounts are all PRC state-media, and account for ~90% of all retweets. Their posting time profile is a match to working hours in Beijing. You will notice there appears to be a less regular night shift — this is consistent with previous observations of suspected PRC internet army accounts operating on YouTube. Their account also shows reduced activity on weekends.

The other account, @monster78256928, is also operating in Beijing during business hours (plus a night shift), and also shows reduced activity on weekends:

We have high confidence that these two accounts are inauthentically amplifying PRC state media on Twitter. Given their operating profiles during Beijing business hours, and the obvious beneficiary of their actions, they are most likely attributable to the PRC government.

Conclusion

It was surprising to find that @JiangShangrong appears to be so influential on this topic. A PRC-born influencer in Moscow, and staunch supporter of the Russian government, is providing a significant bridge between Russian state propaganda and Chinese-language speaking communities online. The community clustering around JiangShangrong has significant links to the little pink community, creating bridges that facilitate the flow of Russian state propaganda into these communities. These links warrant closer study. We note that, at the time of writing (August 20th, 2022), @JiangShangrong’s account has been suspended by Twitter for reasons unknown.

We suspect that PRC state media leading the conspiracy connecting U.S.-funded biolabs in Ukraine to COVID-19 represents an internal stability control agenda. Even though Twitter is outside the PRC, Chinese-language PRC propaganda is often interpreted as “internally” focused, as the CCP sees the Chinese diaspora as a part of the PRC regardless of where they emigrate. Looking at English in the same sampling period (February 1st to April 30th), Zhao Lijian and Hua Chunying only made one tweet with a hit on the sub-string “bio” (Zhao, Hua), neither making any connection to COVID-19. PRC state media accounts only show one English-language tweet (from Global Times) making this connection — on March 12th, two days after the peak of the Chinese-language campaign. In contrast, the spread of Chinese-language conspiracy content making this claim was led by PRC state media, including the high-level China News Service. It is relevant that the PRC continued to experience significant COVID problems in 2022: February 2022 saw the start of the Omicron outbreak in Shanghai, which led to severe lockdowns at the end of March, and significant internal protest.

An observation that stands out from our timeline analysis is that the most retweeted content is copied from posts found earlier in the PRC’s internal information environment. This suggests that little pink and state media content on Twitter is cross-posted with a time lag. Although on Twitter, we were able to show that the spread of the Chinese-language biolabs-COVID conspiracy was led by the PRC state media, due to limitations in collecting Weibo data, we are unable to say whether this is also true on Weibo. Our previous investigations suggest it could be the case. Interesting questions for future research include whether PRC state media ever post original Chinese-language content on Twitter, or whether it is always cross-posted. Another question is what variables explain which content gets cross-posted, and which content never makes it to Twitter.

One of our goals in this investigation was to put our little pink account classifier through its paces. It has proven useful to us in this case study, particularly at the network analysis step. Although it is reasonable that accounts clustering around the PRC state media are likely to be little pinks, the communities identified by Infomap still break down into multiple sub-communities. Without taking the time to manually inspect many accounts it is hard to know with any confidence whether any particular community is composed of or contains little pinks. This difficulty prevents us from really knowing how to characterize the other two communities, beyond the cursory analysis above. This also allows us to answer questions such as who are the most retweeted little pinks. Furthermore, given that PRC internet army accounts are a subset of little pinks, we are able to quickly focus analyses of CIB on specific nodes in this network, which will be the subject of a future publication.

Suggested Platform Action

Our findings from looking closely at the little pink raise a number of concerns for the platform that we hope Twitter can address.

The first is a missing state media label for the Guancha accounts, @GuanchaNewMedia and @realGuancha. As a previous Doublethink Lab investigation has shown, although Guancha is considered to be patriotic commercial media, it is intimately tied to the state. Our investigation has revealed very close content coordination with central state media, and another “commercial” media that does have the state media label, @Tong_Shuo. As we showed above, the most retweeted tweet in the little pink community comes from @GuanchaNewMedia, but was copied from a CCTV post on Weibo, and posted within the same minute as a Tong_Shuo post that also copies the same headline. We argue that it is inconsistent to label @Tong_Shuo but not @GuanchaNewMedia and @realGuancha, and that both do indeed deserve the label.

Second, we have identified a number of accounts with signs of inauthenticity that copy-paste PRC state media, effectively skirting Twitter’s labeling of state media. In the case of @Dorsey_Queens, the post was made within nine minutes of the original post appearing on Weibo, additionally suggesting coordination. Previous research suggests that labeling of state media has reduced its reach and number of engagements. While a blunt and imperfect solution, it is nevertheless well-motivated and effective. We suggest Twitter develop a policy to address this practice of skirting state media labels by plagiarizing state media. Such a policy might make such behavior grounds for account suspension. This may force internet armies into paraphrasing. However, this will at least impose a cost on them, which will reduce their efficiency, while also sending a normative signal that such behavior is considered manipulative.

Third, for the reasons above, we judge with high confidence that the accounts @fN6na1iTwNCPWv2 and @monster78256928 are PRC internet army accounts. After sharing this finding with Twitter, these two accounts have been suspended.