On Monday, Twitter and Facebook announced that they had taken down a network of accounts that were undertaking covert influence campaigns designed to undermine the protest movement in Hong Kong. In their statements, both companies were sufficiently confident to suggest that these activities were a ‘coordinated state-backed operation’ (Twitter) with ‘links to individuals associated with the Chinese government’ (Facebook). China is the authoritarian state that’s most technologically adept at controlling its domestic information environment. It appears that Beijing is now willing to disruptively contest the information domain elsewhere.

This is significant.

It’s well known that the Chinese Communist Party engages in extensive efforts to control and manipulate the political discourse within China through the Great Firewall, censorship on platforms such as WeChat and Weibo, and control of traditional domestic media. International concern about the CCP’s efforts to manipulate the information environment has focused on direct threats to mobilise diaspora populations, the party’s control over Chinese-language media, the development of international propaganda networks, and the possibility that Chinese social media apps may be used to covertly spread disinformation among diaspora populations. But it hasn’t been about direct and deceptive attempts to manipulate social media audiences on mainstream international platforms.

A preliminary analysis of the 936 accounts that Twitter removed suggests that this was not a long-running, well-incubated influence operation. Across our sampling of these accounts, Chinese-language political commentary on Hong Kong appears to have started 11 June, the day protesters blocked roads as the extradition bill was debated. Posts in English started on 1 July, the anniversary of the handover of Hong Kong from the British and the day protestors stormed the legislative chamber.

Many of the accounts in the Twitter dataset were set up some time ago, as far back as 2007 (giving them greater credibility under scrutiny from the platform), but were dormant for long periods. Some were completely inactive until a sudden spike of posting from mid-June. While many of these accounts originally posted in different languages, the two main languages used from 2017 onwards were English and Chinese. That suggests that the targeted audience may have been Hong Kong-based (with potential ripple effects through to mainland audiences) and international.

Let’s take the account @Resilceale as an example. It was created in 2011 and tweeted in English about football until 2012 when it went dormant. It re-emerged in May 2019 tweeting vacuous comments in Chinese. From 1 July, the day the protestors broke into the legislative chamber, @Resilceale began rapidly posting overtly political content about Hong Kong.

The accounts themselves are not well-established personas. There’s a cross-section of spammy, click-bait-type accounts. We’ve also identified at least a couple of innocent bystanders that are likely to have been caught up in the suspensions because of their content (China, 5G, security) and because they purchased bot follower accounts. This suggests that some of the accounts used in this influence operation had been available for purchase.

There are other elements of the Twitter and Facebook announcements that suggest this operation was hastily initiated in response to the growing intensity of the protests in Hong Kong. Twitter’s statement notes that VPNs (virtual private networks, which enable users in China to get around the ban on using non-Chinese social media platforms) were used to run some of these accounts, but that others were accessed from specific unblocked IP addresses originating in mainland China. The use of dedicated infrastructure unhindered by the Great Firewall to manage this activity provides further support to the theory that this influence operation was state sponsored.

According to Facebook, which was tipped off by Twitter, the small network it identified (five accounts, seven pages, three groups) used a familiar disinformation playbook. The fake accounts posed as news outlets and posted content to groups to build their audience. They distributed targeted, emotive, bespoke content to shape sentiment and steer users out of Facebook into other online influence environments.

These are standard disinformation tactics but they’re not ones we associate with China. This is direct intervention in a way that we haven’t seen from China before. Chinese state media do use mainstream Western platforms for influence, but they don’t deny they’re doing it. Elements of the CCP’s propaganda apparatus even purchased promoted tweets attacking the protestors. Indeed, more commentary has focused on the efforts the Chinese authorities have put into kicking people off Twitter.

The association of the Chinese government with networks of coordinated inauthentic accounts on Western social media platforms adds a new layer in our understanding of Beijing’s approach to information warfare. It’s worth noting that regimes that are willing to target foreign adversaries with information warfare first hone their techniques on their domestic populations.

There were signals that efforts were being made to disrupt the Hong Kong protests. Telegram, one of the encrypted messaging apps that the protesters were using to organise was hit by denial-of-service attacks in mid-June. Telegram founder Pavel Durov tweeted that the attacks came primarily from Chinese IP addresses. And around the same time Hong Kong police arrested a student who acted as the administrator of a Telegram group with 27,000 members that shared information about the protests.

Chinese state media became increasingly vociferous in its criticism of the protesters after they broke into Hong Kong’s legislative council building. State media outlets asserted that the CIA was behind the protests, compared the protestors to terrorists, and circulated videos of PLA troops training for urban warfare and building up their numbers in Shenzhen, close to the Hong Kong border.

The announcements from Twitter and Facebook suggest that the Chinese government is willing to go beyond using its state media apparatus to shape the narrative. They suggest that Beijing has the capability and intent to use Western mainstream social media platforms to manipulate social media audiences at scale. Any state that wishes to defend the sovereignty of its information domain should take note.