Cyber sleuths blame China-based digital propaganda for fanning Asian American protests

Cybersecurity researchers discovered a large-scale, pro-China digital influence campaign that stoked Asian American anger over alleged racial injustice in the U.S. and shifted the blame to the U.S. for the origins of COVID-19.

Cybersecurity firm FireEye’s Mandiant division uncovered the operation that used at least 30 social media platforms and dozens more websites in several languages, including Chinese, English, Russian, German, Spanish, Korean and Japanese.

The researchers said the use of different languages and platforms indicated that the pro-China offensive had ramped up to reach a wider audience around the world.

“This suggests that the actors behind the campaign have significantly expanded their online footprint and appear to be attempting to establish a presence on as many platforms as possible to reach a variety of global audiences,” FireEye Mandiant threat analysts Ryan Serabian and Lee Foster wrote when disclosing the scheme. “Second, the attempt to physically mobilize protesters in the U.S. provides early warning that the actors responsible may be starting to explore more direct means of influence and may be indicative of an emerging intent to motivate real-world activity outside of China’s territories.”

The researchers did not identify the Chinese Communist Party as the culprits but linked the digital propaganda campaign to China-based accounts that Twitter took down in 2019.  

FireEye observed thousands of posts in April that called for Asian Americans to protest perceived racial injustices. Some posts urged Asian Americans to participate in an April 24 protest in New York City to push back against former Trump White House strategist Stephen K. Bannon, exiled Chinese billionaire Guo Wengui and Li-Meng Yan, a Chinese virologist who says COVID-19 was made in a Chinese government lab.

Ms. Yan gained attention last year by telling Fox News’ Tucker Carlson that the virus was created by China and intentionally spread to do damage. 

The pro-China influence campaign also sought to shift blame for COVID-19’s origin from China to the U.S., specifically to the national bio-defense lab in Fort Detrick in Maryland. The disinformation campaign used Russian-language posts to claim that Fort Detrick was the source of the virus. Other posts in Spanish also identified Fort Detrick and linked to articles claiming that the virus appeared in the U.S. and Europe before China, according to FireEye. 

Fort Detrick has long been a target of foreign adversaries’ propaganda. During the 1980s, the Soviet Union spread rumors that HIV/AIDS was genetically engineered or created during alleged biological weapons research at the U.S. Army’s Medical Research Institute for Infectious Diseases at Fort Detrick, according to the Wilson Center. 

The Soviets’ Fort Detrick-HIV/AIDS propaganda campaign ran from 1983 until 1989, according to the Journal of Cold War Studies. The Soviet Union viewed its initial efforts to blame America as a success thanks to “numerous bourgeois newspapers,” particularly among people in African countries who viewed other theories linking the outbreak of HIV/AIDS to African monkeys as racist, according to the journal.

China’s efforts to deflect blame for the coronavirus pandemic also were initially successful.

In 2020, discussions of COVID-19 as originating in China were met with condemnation by fact-checkers working for news publishers and social media companies. Facebook, for example, removed content asserting COVID-19 was man-made or manufactured until May 2021, when it reversed its decision. 

PolitiFact, a fact-checking website, similarly scrapped a September 2020 article about Ms. Yan voicing an allegedly “debunked” theory that COVID-19 was created in a lab. PolitiFact removed the fact-check in May 2021.  

While the digital disinformation targeting Asian Americans had limited impact, the FireEye Mandiant researchers viewed the new tactics and calls for real-world action as an escalation of digital influence warfare.

Google Threat Analysis Group’s Shane Huntley said on Twitter that Google has previously identified and taken down content from the same network that FireEye Mandiant observed, including removing content from nearly 50,000 YouTube channels.

“Despite the lack of engagement, the volume and persistence shown by this network is noteworthy,” Mr. Huntley said on Twitter. “We anticipate they will continue to experiment to drive higher engagement and encourage others in the community to continue tracking this actor and taking action against them.”

Twitter head of site integrity Yoel Roth said that while disinformation campaigns on social media are a unique problem, they have precedent in other challenges faced by those working in cybersecurity. 

“These are well-established enterprises,” Mr. Roth tweeted, referring to the people behind the digital influence campaign. “It’s why fighting disinformation often looks a lot like fighting spam; the content is different but the tactics remain fundamentally the same.” 

Sign up for Daily Newsletters

Share this post