Nearly 9,000 Facebook and Instagram accounts, pages and groups have been shut down during a Meta crackdown against a wide-reaching Chinese political spam network.
In a report released on Tuesday, Facebook’s parent company Meta revealed a long-running spam network originating in China targeted multiple regions around the world – including Australia, US, UK, Japan and Taiwan – in what is being deemed the “largest known cross-platform covert influence” operation in the world.
The social media giant said it removed 7,704 Facebook accounts, 954 pages, 15 groups and 15 Instagram accounts for violating its policy against coordinated inauthentic behaviour.
“We took down thousands of accounts and pages that were part of what appears to be the
largest known cross-platform covert influence operation in the world,” said Meta.
“This campaign was run by geographically dispersed operators across China who appeared to be centrally provisioned with internet access and content.”
Meta said the campaign was active on more than 50 platforms and forums, including Facebook, Instagram, X (formerly Twitter), YouTube, TikTok, Reddit, Pinterest, Blogspot, LiveJournal, and “dozens of smaller platforms and forums”.
The report further included examples of spam network operations appearing on Tumblr, Quora, Google Groups, TripAdvisor and, strangely enough, creative platforms such as music-sharing platform SoundCloud, and video platform Vimeo, where it posted videos to promote “research” claiming the US was the origin of COVID-19.
The wide-reaching operation promoted swathes of content positing criticisms of Western foreign policies and the US, as well as flattering commentary about China and questionable critiques of journalists, researchers and activists who criticised Chinese government.
To illustrate the magnitude of themes pursued by this spam network, Meta shared a massive collection of sample headlines uncovered by its research, including:
● The reasons of Australia’s sudden suspension of Chinese TV shows;
● Overseas pro-democracy activists like Zhao Xin, Qiu Jiajun, and Wang Jianhong are just a handful of…;
● US bombing of Nord Stream is the first step in the "European destruction plan”;
● US-led Western Anti-China Forces Must Stop Ruining Uygur People’s Happy Life; and
● The real version of "The Matrix", the United States is monitoring the world
Meta began investigating and removing clusters of this spam activity in 2019, although it only recently managed to link it to a wider operation known as “Spamouflage”.
Spamouflage was first coined by researchers at Canberra-based think tank the Australian Strategic Policy Institute (ASPI), and then further covered by social media analytics firm Graphika, Google’s Threat Analysis Group, and cyber security firm Mandiant.
When reporting on the spam network’s targeting of Hong Kong protests in 2019, Graphika said the operation “boosted attacks” on Hong Kong protesters by using “hijacked or fake accounts on YouTube, Twitter, and Facebook”, and it that appeared designed to “to support the Chinese government and discredit its critics”.
Meta’s investigation into Spamouflage has aligned with those of several long-running research groups, and the company now reports it has found links to individuals associated with Chinese law enforcement.
“Although the people behind this activity tried to conceal their identities and coordination, our investigation found links to individuals associated with Chinese law enforcement,” said Meta.
When analysing posting activity linked to Spamouflage, Meta found the operation was geographically dispersed throughout China, but running on seemingly centralised content directions and at schedules similar to those of typical office shifts.
“We identified multiple distinct clusters of fake accounts that were run from many different parts of China,” said Meta.
“Their behaviour suggested that they were operated by groups who may have worked from a
shared location, such as an office.
“Each cluster worked to a clear shift pattern, with bursts of activity in the mid-morning and early afternoon, Beijing time, with breaks for lunch and supper, and then a final burst of activity in the evening.”
The spam operation saw a whopping 560,000 accounts follow one or more of its pages, with Meta assessing the pages were likely acquired from spam operators with “built-in inauthentic followers”.
Meta said “despite the very large number of accounts and platforms it used”, Spamouflage “consistently struggled to reach beyond its own (fake) echo chamber”.
Many comments on the spam posts came from other Spamouflage accounts trying to drive popularity, with only a few instances reported where content on Twitter and YouTube was amplified by real-world influencers.
The campaign was detailed in Meta’s Quarterly Adversarial Threat Report Q2 2023, which further covered four other campaigns coming from Russia, Iran and Turkey.