China-Linked Influence Operation May Have Manufactured Protests in US: Report

Pro-China supporters protest the arrival of Taiwan President Tsai Ing-wen at the Ronald Reagan Presidential Library in Simi Valley, Calif., on April 5, 2023. John Fredricks/The Epoch Times

A China-linked influence operation may have contributed to real-world protests in Washington, according to the findings of a new report.

The ongoing influence campaign has largely focused on disseminating pro-China stories on Western social media but may also have organized and funded two in-person protests in 2022, according to a new report (pdf) published this week by cybersecurity firm Mandiant.

Both protests, which weren’t covered by other media outlets, were made the subject of multiple stories created and distributed as part of an influence operation known in the national security community as “HaiEnergy.”

“Both protests, which occurred around June and September [of] 2022, were documented via video and subsequently used as source material to support campaign-promoted narratives published by assets and infrastructure leveraged by HaiEnergy,” the report states.

The fact that the apparent protests weren’t covered by any other media suggests that they may have been a part of the HaiEnergy operation, which has links to China’s communist regime.

“Notably, we were unable to identify any outside sources referencing these protests other than those we either attribute directly to HaiEnergy or have identified as being tangential to the campaign by virtue of paid promotion services,” the report states.

Campaign Linked to Chinese PR Firm

HaiEnergy was first identified as a pro-China influence operation in another report (pdf) published by Mandiant in 2022.

That report found that the campaign “leveraged a network of at least 72 inauthentic news sites,” all of which presented themselves as independent news outlets based across various parts of the world, including in the United States.

These “news” sites and associated wire services were then used to launder the pro-China stories into mainstream U.S. media outlets and give them an air of legitimacy.

Following this, a number of suspected inauthentic social media accounts would be used to amplify the content, along with other assets strategically aligned to promote the political interests of the Chinese Communist Party (CCP), which rules China as a single-party state.

At first, according to the new report, Mandiant was unsure if the news sites and other infrastructure were directly related to China or just sought to promote CCP interests.

That has changed.

According to the report, Mandiant has confirmed that Chinese public relations firm Shanghai Haixun Technology (Haixun) was directly engaged in the campaign, after finding that the company directly solicited freelancers and social media influencers to promote the content that was being created and distributed by HaiEnergy.

“In recent months, however, we have identified additional evidence suggesting Haixun is not only aware of the campaign but is actively supporting it through the solicitation of for-hire freelancers via Fiverr to promote campaign content,” the report states.

Using these newswire services and paid-for influencers, HaiEnergy was able to distribute its content to the subdomains of legitimate U.S.-based news outlets as “press releases,” effectively using the U.S. media landscape to promote pro-China propaganda.

Those newswires included websites TimesNewswire.com and WdWire.com, as well as at least “32 subdomains of legitimate U.S.-based news outlets resolving to third-party infrastructure associated with a U.S.-based company named ‘FinancialContent Inc.’,” the report states.

Such content was often published to the subdomains without approval or review, suggesting that the U.S. companies weren’t themselves compromised but rather engaged in sloppy security practices, according to the report.

On other occasions, according to the report, the HaiEnergy newswires would lift anti-U.S. stories wholesale from overseas news sites, remove all of the links from them, and replace them with links to inauthentic pro-China accounts.

“In numerous instances, we have observed identical pro-[China] articles published to both World Newswire and Times Newswire, which were also published to suspected inauthentic news sites we have previously attributed to HaiEnergy,” the report states.

Likewise, the campaign engaged in further “information laundering” by cross-referencing its own websites, effectively having two websites publish the same story while citing the other website as the primary source of information when, in fact, there was no legitimate source.

China-Based Firm Linked to US Protests

The report outlines how the HaiEnergy campaign may have directly financed, or even manufactured wholesale, two pro-China protests in 2022 in Washington.

The first alleged protest was made in response to the 2022 International Religious Freedom Summit, an annual event held in Washington that aims to raise awareness of restrictions on religious freedom of the type so present in communist China.

The second alleged protest was made in response to a June 2022 decision by the U.S. government to ban goods produced in China’s Xinjiang region, where the regime is engaged in genocide and slave labor targeting the predominantly Muslim Uyghur population.

In videos of both events shared by HaiEnergy-affiliated media, two small groups of protesters can be observed demonstrating in Washington, holding placards and chanting slogans intended to highlight, and possibly exacerbate, U.S. domestic issues such as racial discrimination and abortion, as well as to criticize U.S. policy impacting China’s export of solar energy-related goods.

“In both instances, we observed articles referencing these protests published by the aforementioned press release service, Times Newswire,” the report states.

“Additionally, verbatim articles referencing the protests were subsequently distributed to the subdomains of legitimate U.S.-based news outlets leveraged by HaiEnergy.”

It was then that freelancers were commissioned by China-based Haixun to amplify the content.

The Mandiant report states that there isn’t currently evidence that Haixun directly paid the protesters themselves, though “... it was at least plausible the protests were orchestrated on behalf of a third party.”

To date, pro-CCP influence campaigns such as the one tracked by Mandiant have failed to generate substantial engagement from American social media users, the report states. Most of the engagement earned by the campaign appears to be “operating within the confines of their own echo chambers despite campaign operators’ use of multiple platforms and dissemination vectors to reach target audiences.”

To that end, according to the report, the influence operation appears to be evolving, seeking new, more effective means of promoting division in the United States and cultivating support for the CCP.

“Based on our most recent observations associated with HaiEnergy, it is plausible that operators behind this campaign have recognized the ineffectiveness of past tactics and now look to expand the campaign’s overall reach by outsourcing certain aspects of its operation,” the report states.

“The possible financing of at least two staged in-person protests for use as source material in HaiEnergy-linked information operations is, in particular, a significant escalation in [tactics] employed by this campaign, and further evidence suggesting the campaign is expanding its tactics to maximize potential impact.”