Pro-Beijing Operatives Try to Mobilize Asian Americans to Protest: Report

A man holds a sign that reads "Racism is a Virus" during the "We Are Not Silent" rally against anti-Asian hate in response to recent anti-Asian crime in the Chinatown-International District of Seattle, Washington on March 13, 2021. Jason Redmond/AFP via Getty Images

An expansive pro-Beijing influence operation has sought to sow division around the CCP (Chinese Communist Party) virus pandemic and incite street protests in the United States, cyber intelligence researchers found.

The network initially began in 2019 focusing on discrediting Hong Kong’s pro-democracy protests. The operation has since expanded in size and scope, spanning 30 social media platforms and 40 other websites and online forums in seven languages, according to a Sept. 8 report from U.S. security firm Mandiant Threat Intelligence.

In addition to echoing claims from Chinese state media, the group also made an active effort to get Americans to attend protests against anti-Asian sentiment, in what appears to show the Chinese operatives’ growing appetite to more directly influence real-world activities before a global audience.

In April, thousands of posts emerged calling on Asian Americans to demonstrate against “racial injustice.” Some posts—written in languages including Korean, Japanese, and English—specifically targeted fugitive businessman Guo Wengui, directing people to an address said to be Guo’s New York home to demonstrate against virus origin theories promoted by Guo, particularly that the virus was a biological weapon made by the Chinese regime.

The timing of these calls paralleled a rash of reports about anti-Asian hate crimes, which Chinese state media also turned into a propaganda prop to shun U.S. criticism.

While no evidence suggested such attempts were successful, it was an “early warning that the actors behind the activity may be starting to explore, in however limited a fashion, more direct means of influencing the domestic affairs of the U.S.,” the researchers wrote.

Mandiant didn’t have proof of involvement from Beijing-controlled bodies, and the pro-Beijing accounts have so far gained little traction on either major social media or niche platforms.

The network instead portrayed the April 24 protest as a success, posting doctored photos from a different rally that took place elsewhere a day earlier.

Rain beads on a sign as community members gather at the Ottawa Women's Monument in Minto Park for a vigil in memory of the victims of the Atlanta spa shootings and to rally against anti-Asian racism, in Ottawa, on Sunday, March 28, 2021. Justin Tang/The Canadian Press

“It’s almost like they are being paid by volume,” instead of engagement, said Shane Huntley, director of the threat analysis group at Google.

On LiveJournal, a Russian networking service, and Argentine social media site Taringa, the pro-Beijing actors had attempted to cast doubt about the origins of the CCP virus, which causes COVID-19, such as by claiming that the virus came from Fort Detrick, or that the virus had first appeared in the United States and Europe, rather than a lab in the Chinese city Wuhan.

Twitter in June 2020 removed more than 170,000 Beijing-backed accounts that amplified misleading narratives favorable to the Chinese regime, including praising Beijing’s pandemic response and antagonizing the United States.

Fake accounts have also served to help disseminate rhetoric from Chinese diplomatic accounts, whose number has grown exponentially since 2019. Researchers said that “nearly half of all PRC [People’s Republic of China] account retweets originate from the top 1% of the superspreaders,” according to reports released in May.

The posts sometimes have “fairly laughable” slip-ups, such as calling the “novel coronavirus” the “new crown virus,” Huntley noted on Twitter, although he observed the group has been improving its production quality, experimenting with higher resolution videos and better subtitles.

Researchers have also identified similar patterns in posts in other languages, possibly due to them being written by non-native speakers or automatic translation.

Despite the accounts’ failure in attracting meaningful engagement, the persistence and dedication as they expand their online footprint have been concerning, the researchers said.

“They’ve clearly got a wide mandate that’s global. Someone is giving them pretty broad orders,” said John Hultquist, vice president of intelligence analysis at FireEye, the cybersecurity firm that owns Mandiant.

Reuters contributed to this report.