Hong Kong Protests and the Rise of Online Influence Operations

August 27, 2019 • Zane Pokorny

Recent protests in Hong Kong have highlighted a growing trend in online influence operations, in this case from mainland China. Officials there have been using Western social media platforms to influence public perception of the Hong Kong protests. Those social media platforms have, in turn, shut down accounts they’ve determined are posting what they call “inauthentic content.”

Researchers in Recorded Future’s Insikt Group have been analyzing these attempts at online influence operations and have published a report titled “Chinese State Media Seeks to Influence International Perceptions of Hong Kong Protests.”

Priscilla Moriuchi is head of nation-state research at Recorded Future, and she joins us to share their findings.

This podcast was produced in partnership with the CyberWire.

For those of you who’d prefer to read, here’s the transcript:

This is Recorded Future, inside threat intelligence for cybersecurity.

Dave Bittner:

Hello everyone, and welcome to episode 122 of the Recorded Future podcast. I’m Dave Bittner from the CyberWire.

Recent protests in Hong Kong have highlighted a growing trend in online influence operations, in this case from mainland China. Officials there have been using Western social media platforms to influence public perception of the Hong Kong protests. Those social media platforms have in turn shut down accounts they’ve determined are posting what they call “inauthentic content.”

Researchers in Recorded Future’s Insikt Group have been analyzing these attempts at online influence operations and have published a report titled “Chinese State-Run Media Seeks to Influence Perception of Hong Kong Protests.”

Priscilla Moriuchi is head of nation-state research at Recorded Future, and she joins us to share their findings. Stay with us.

Priscilla Moriuchi:

Over the course of the past year plus, we’ve been monitoring Chinese state-run influence operations on social media. We’ve been conducting research to get a sense of how their operations use or exploit social media and how that’s different from what other countries do, what other criminal actors do. To try to come up with a fingerprint and hopefully, eventually, to be able to deter their effects. So over the course of the past year, we’ve defined what is an influence operation and what makes it important and distinguished from public relations, for example, to knowledge level, I guess. When we talk about influence operation or even disinformation campaign or something like that, we have three criteria that we at Recorded Future talk about anyway.

One, that it’s a coordinated campaign. So it’s intentional. Two, that the goal is to spread false information or information that’s consciously distorted by, in this case, the Chinese state. Third, that the outcome or the intention is to cause political harm. So to advantage, for example, China, the Chinese state, the People’s Republic of China, over say the United States or any other country or group. That would be the target of these influence operations. So that’s how we categorize influence operations. What we’ve been looking at over the course of the past year, we defined how Chinese state-run operations work.

In general, China tries to focus on positive messages that will enforce or reinforce the positive role that China, the Chinese government, believes that its nation is playing in the larger role, in the larger international system. At the base of this is this Chinese dream, which is of people pulling themselves up in sort of English, American-speak, “by their bootstraps,” enabled by these government policies. This is happening all over the world. General economic globalization, China as this responsible actor in contrast to maybe the United States and our current political leadership. So all of these, these messages are messages that Chinese state media, using influence operations on social media, have propagated for years and that we’ve been looking at for the past year or so.

Dave Bittner:

Now, how is that different from say, here in the West, the national pride of, “I’m proud to be an American,” or the President of the United States standing up and saying, “This is the greatest country in the world. God bless America.”

Priscilla Moriuchi:

Right, so the distinction there is, that that would be public diplomacy or positive messaging. There’s not an intent to cause harm to the audience that’s receiving that message. There’s no intent to, for example, for the United States to disadvantage the U.K., when we say we’re the best country on earth. We’re not trying to harm anyone else when the President says that. It’s just the opinion of a person, right?

In the case of China, the messages that they’re putting out, for example, on the Hong Kong protests, as we’ll talk about. On other issues like Xinjiang, issues in Xinjiang province, for example, how they’re countering “Islamic extremism.” When the reality is that they’re operating huge detention camps. So these messages, it’s not just the exclusion of the negative, but the distortion of the actual facts on the ground to advantage China over other countries and populations.

Dave Bittner:

So sort of an Orwellian element to it. Would that be a fair way to describe it?

Priscilla Moriuchi:

Yes, it is. Even more Orwellian is that the goals of these campaigns, they’re coordinated by a propaganda ministry. That’s what it’s called in China, the Ministry of Propaganda. So there’s no hiding, or there’s an acknowledgement by the Chinese government from the very start that they are trying to put out disinformation and propaganda to leverage this message, and cause harm and degrade others.

Dave Bittner:

Is it a side effect of the structure of their society that you don’t end up with opposing voices?

Priscilla Moriuchi:

Yeah, I would say this is the structure of the current government. And how the state and the party run the nation, the People’s Republic of China, is a repressive, to be completely honest, it’s a repressive regime that suppresses alternate viewpoints. So the way that they operate their influence operations and their suppression is they, at the senior level, a message is decided upon, and that propagates its way down through the ministries, who then all use their various tools of enforcement, whether it’s propaganda, influence operations, suppression, censorship, they all use different tools to hammer home the same agreed-upon message.

Dave Bittner:

Let’s dig in some to the specifics of the situation happening in Hong Kong. Again, for some of the background, what led up to this?

Priscilla Moriuchi:

Sure. In about … I guess some of the protests really started in April, but earlier this year there was a bill introduced into Hong Kong’s Legislative Council, which would have provided for the government of Hong Kong to extradite, ostensibly, criminals to mainland China, to face justice in the mainland China judicial system.

From the perspective of Hong Kongers, the problem with this law is that the mainland China judicial system is not, how’s the polite way of saying this, is not transparent. It’s not actually governed by the rule of law and there are offenses in mainland China, for example freedom of expression, that are not offenses in Hong Kong. So the worry among Hong Kongers was that Hong Kong citizens could get extradited to China and face charges for actions that are not actually crimes in Hong Kong, like political expression. And be confronted with a judicial system that is inherently unfair.

The introduction of this bill brought people out into the streets to protest, and as the months have gone by, the protests have gotten bigger and the scope has expanded a little bit. This is where we come in and we start looking at … So given this research that we have and what we know about how Chinese state-run media and influence operations use social media, especially how they want to message the West, we just wanted to see how they were tackling the Hong Kong protests.

Dave Bittner:

When we’re talking about protests here, I think it’s important to note the scale that we’re talking about. This is hundreds of thousands and there’s reports of millions of people marching.

Priscilla Moriuchi:

That’s correct. Yeah. The scale of the protests has peaked and valleyed over the course of the past few months. But I think the general pattern is on weekends, the number of protesters swell. I think another important element of the protests is the fact that there are people from across society. A lot of the time, the protestors are characterized as students or activists. We think the reality in Hong Kong is that there’s a wide swath of people. Everyone from students and workers to business executives and entertainers and government workers, airline attendants, who are all involved in these protests.

Dave Bittner:

Yeah. It struck me, too, that there’ve been a handful of suicides related to this.

Priscilla Moriuchi:

Yeah. I’ve actually seen some reporting that in the early days of the protests, that that was one of the reasons for them to … Or one of the, I guess I would say galvanizing points, for a lot of the protestors, was that many people had lost hope for change. They just became so depressed that it became important for the protesters to expand their movement and bring in more people, from the accounts that I’ve heard.

Dave Bittner:

Let’s talk about how China has responded to this, both publicly and the things that you’re tracking, some of the influence operations.

Priscilla Moriuchi:

Sure. Yeah. From our perspective, we look at the state-run influence accounts on social media across a variety of English language-specific Western social media platforms. I want to make that distinction because the information environment on Chinese social media platforms is controlled by the government of China and it’s a very different methodology. It’s a very different audience than what we see in the English-language sphere.

First is that even though the protests really started in April, mainland state-run media largely ignored the protests in Hong Kong and any discussion of the extradition bill or anything around those, until specifically June 9th. So June 9th and 10th was a period of a couple of days when, as you were talking about before, the numbers of people involved in the protests began to swell significantly. And when really some of the first, as we call it, violent tactics were employed by the police and also on, you could say on the protestors’ side as well. We have that.

So first, all the protests were going on for months. Before then, state media ignored them, it wasn’t part of anything they were talking about, whether positively or negatively. Up until that point. After that point though, we used one of these tools called sentiment analysis. What that does is essentially assign a number value to the sentiment expressed in a social media post. It’s done based on the use of specific words, in association with other words and terms in a post. It’s just one kind of scientific tool that you can employ. It’s not the be all, end all.

We used that to analyze the sentiment that these Chinese state-run influence accounts were trying to portray to Western audiences. What we’ve found is that while there’s been a focus on the negative content coming from these accounts, like calling the protesters or the acts of protest “near terrorism,” for example, or other sort of inflammatory remarks about protest actions, by and large the Chinese state-run influence accounts are walking this fine line between maintaining this positive image of the Chinese government as a positive actor and influence that supports the Hong Kong government, and obviously conveying the way that they feel about the protests, which is negative, of course.

So we have this balance in which we can see that many of what we would consider negative posts or negative comments about the protests were counterbalanced by supportive messages for the Hong Kong government, or positive images in those messages themselves. So it’s not just this coordinated state-run campaign designed to impugn the Hong Kong protests and these movements at any cost using this wide range of violent or condemning rhetoric. That’s not the case.

What we see really, is state media walking this really fine line, and sometimes they fail and sometimes they succeed, in trying to present themselves as overly supportive or broadly supportive of the Hong Kong government. “We support Hong Kong government and their efforts to bring back law and order to the streets and rebuild the Hong Kong economy after the damage from these protests.” While at the same time messaging that the protests are bad for Hong Kong’s economy, their protesters are not following the laws, that sort of thing.

Dave Bittner:

Yeah, I’ve even seen that, the difference between the protestors themselves, who of course refer to what’s going on as “protests,” and the government referring to them as “riots.”

Priscilla Moriuchi:

Right, exactly. That’s one of the things that is not always picked up in sentiment analysis. The difference between calling something a “protest” or a “riot” can be one of perception, as opposed to something you can quantify easily with numbers. But again, we rarely, in the social media posts that we analyze, we don’t really see them, state media, referring to the protesters as “democracy protesters,” but mainly touching upon the acts of violence, the heroic acts of the police forces, the damage that these protests are causing to the Hong Kong economy, the victims who are the population of Hong Kong, and the innocent police officer just trying to enforce order. Those types of things.

Dave Bittner:

I see. Now, in terms of what’s going on on social media, we’ve seen reports that some of the platforms have been shutting down what they call “inauthentic accounts.” What are you tracking there?

Priscilla Moriuchi:

Yeah, that would be what we would call the covert side of influence operations. There’s a lot of reporting and study again on the covert side of influence operations in Chinese state-run, in Chinese language social media, but largely in English language social media, we have a much less definite idea of what a covert Chinese influence operation would look like on social media.

I think to a certain extent, YouTube and Twitter and Facebook, they’re all trying to address this issue of inauthentic content, in which there’s a person behind the keyboard or maybe it’s a program, propagating content that is not truly who that person is. In this case there have been scattered accounts, reports, that some of the accounts that Twitter has suspended were not actually Chinese, aren’t actually run by Chinese influence bots or Chinese people tied to the Chinese government.

I think there’s not a clear line, and they didn’t really provide any evidence as to why the content providers determined that these were all Chinese state-run accounts. You can’t really see it by looking at the content or the messages that the providers published. So we’re looking at those accounts to try to build out what does the Chinese state-run covert influence operation look like? And how do you tie them back to the Chinese government? The latter two are just not clear, how the content providers really made these determinations.

Dave Bittner:

Where do you see this heading? Is there a clear direction? Is this the shape of things to come? Do we expect that the platforms are going to continue to clamp down on this? Do we expect that the governments are going to continue to use this as an effective way to amplify their influence operations?

Priscilla Moriuchi:

Certainly. For the latter, yes. We see the use of social media influence operations expanding hugely across nations, even into the criminal sector as well. Using social media as a way to disseminate disinformation or messages or false information. We see that as certainly continuing because it has an effect. What the actual effect is, it’s still hard to quantify from a research perspective, but it certainly does have an effect in amplifying messages. So that’s first. Yes, we definitely see that happening.

Second, in terms of the content providers and the platforms, again, a number of those platforms have also taken an interesting tack, which is to prevent some of these state-run media sources, state-run influence accounts, from purchasing advertisements on their platforms. I think that’s a really interesting step because we have shown that, for example, Chinese state-run accounts actively purchase ads on these social media platforms and promote these, again, dishonest and one-sided perspectives. And it’s very difficult to properly identify for users and readers of that content, one, who the message is, who exactly is paying for the message that they’re seeing, how it’s manipulative. It’s an interesting tack that the platforms are taking by just prohibiting these state-run accounts from purchasing ads, as opposed to trying to tackle these larger issues, about how do they properly caveat when an ad is purchased so that the reader and the user understands the full scope of the message they’re receiving.

Dave Bittner:

Can you give us some perspective? The work that you’re doing at Recorded Future and tracking these sorts of things. Who are the types of people that you’re serving with this sort of information? Who’s making use of it? How is this work benefiting folks out there running their businesses?

Priscilla Moriuchi:

Sure. One of the main ways that this work benefits our clients and others is that we’re identifying what we would call indicators of inauthentic behavior. So little indicators of behavior, whether it be about the content that’s inside of a message, how the message is posted, the accounts, the way that they look, the way they portray themselves, the timing of these messages. All of these are indicators of behavior that you can pull together and that add up to being able to possibly identify these inauthentic behaviors or these influence campaigns at an earlier stage. So that, for example, a company may be able to prevent false information from coming out about a product, for example, before that gets too far.

Or from an election, certainly we have election providers and government departments at every level who are really, really concerned about preserving the ability for people to not actually really vote, but to have an information environment in which they can determine what is truth, and the integrity of our elections.

So for the type of research, we’re not just pointing it at governments trying to deter influence campaigns, but we’re really focused on trying to build up these indicators of activity, of this inauthentic or malign social media activity, so that we can help identify that malign activity more broadly for a whole number of clients and uses.

Dave Bittner:

Our thanks to Recorded Future’s Priscilla Moriuchi for joining us. There’s a report on the Recorded Future website titled, “Chinese State Media Seeks to Influence International Perceptions of Hong Kong Protests.”

Don’t forget to sign up for the Recorded Future Cyber Daily email, where every day you’ll receive the top results for trending technical indicators that are crossing the web, cyber news, targeted industries, threat actors, exploited vulnerabilities, malware, suspicious IP addresses, and much more. You can find that at recordedfuture.com/intel.

We hope you’ve enjoyed the show and that you’ll subscribe and help spread the word among your colleagues and online. The Recorded Future podcast team includes Coordinating Producer Zane Pokorny, Executive Producer Greg Barrette. The show is produced by the CyberWire, with Editor John Petrik, Executive Producer Peter Kilpe, and I’m Dave Bittner.

Thanks for listening.