Disinformation and harassment operations target Safeguard Defenders
A string of reports as well as media coverage has recently highlighted China’s growing disinformation operations, as well as what appears to be State-backed online harassment campaigns against human rights defenders. Safeguard Defenders have been the subject of a prolonged campaign related to both issues, since September 2022, and is now sharing information on this for the first time.
Since Safeguard Defenders first revealed the existence of Chinese overseas police “service stations”, (see our report 110 Overseas) last September, we have been hit with a disinformation campaign featuring thousands to tens of thousands of fake social media accounts, videos, and posts, seemingly aimed at drowning out the messaging and online visibility of Safeguard Defenders.
The full-scale attack began shortly after the report’s release and coincided with a massive increase in media attention on the issue. The volume of attack posts typically picked up again each time there was a new development, for example when we released our follow-up report Patrol and Persuade in early December.
Fake posts, predominantly in English, also targeted our earlier report Involuntary Returns, which exposed Beijing’s use of transnational repression methods to force fugitives back to China via its FoxHunt/SkyNet operation.
The scale and scope of the disinformation campaign
Mapping disinformation is no easy task, however, this campaign against Safeguard Defenders is easier to spot because of its distinctive practice of using long hashtags and extended, grammatically incorrect, phrases, always in English.
Shortly after the 110 police report was released, posts featuring the phrase, “Chinese Transnational Policing Gone Wild Safeguard Defenders 110 Overseas” started appearing on social media, videos, blogs and forums. Without exception, for posts and blogs, the content was a poorly-written defence of the CCP's position, roughly two pages, while the videos were brief, usually less than a minute long and posted on YouTube, and mostly consists of video recordings showing said statement.
While most videos merely film the written statement, which makes repeated use of Safeguard Defenders' name, there were also, though far less common, videos that used the same name, but whose content were videos of Uyghurs, intended to spread the Chinese government’s position on the situation in Xinjiang. The below screenshot is from ASPI’s report Gaming Public Opinion.
A Google search on 4 May 2023 for the exact phrase “Chinese Transnational Policing Gone Wild Safeguard Defenders 110 Overseas” returned 9,130 exact matches.
[Note: All searches referenced herein uses the exact string mentioned, within “” (exact match) search parameters.]
A search on YouTube on 7 March 2023 for the same exact phrase returned 434 hits. We checked it at 09:22 (GMT 0) on that day and nine new videos had been uploaded within the last hour and 16 in the last 24 hours. A fresh Google search this day turned up 20,400 hits.
Safeguard Defenders have run tests like this since late 2022, and have found that new posts and videos are often uploaded several times a day – sometimes many times per hour on sites including Twitter, YouTube, Reddit, LinkedIn and Facebook. Others have alerted us that Tiktok and SoundCloud are also being used in this manner (See Twitter thread by Albert Zhang with the Australian Strategic Policy Institute). For example, using the search term, one finds 57 audio tracks on SoundCloud as of May 16, all containing background music, while the text/description uses the same two-page statement text.
It is unknown whether the posters themselves remove some of the posts, only to re-upload them as new, or whether all removals are done by the platforms themselves. Regardless, a noted pattern is creation-deletion-creation on most platforms.
We searched for the exact phrase on Google on 3 December 2022 and recorded 9,050 hits. In November, we got 38,700 Google results, of which 2,460 were videos, primarily on Youtube. The videos are of varying lengths but never usually differ by more than a few seconds and are usually posted by different users. They have different cover images, likely to avoid automatic deletion.
A similar, but much smaller-scale, disinformation campaign, using the hashtag #ThisispureslanderthatChinahasestablishedasecretpolicedepartmentinEngland, started after global media focused on police “service stations” in the UK. A Google search on 4 May for this hashtag returned more than 223 results.
Taking into account this upload-delete pattern and our search results, Safeguard Defenders has probably been targeted by tens of thousands or possibly, or maybe even likely, hundreds of thousands of disinformation posts and videos by now since September 2022.
These posts do promote a pro-Beijing message, albeit amateurishly written, but it is more likely that the key reason for the campaign is to dilute Safeguard Defenders’ message. By spamming the internet, it makes it difficult to find the real reports and the real stories. And for a short while, the Twitter branch of this disinformation campaign was successful (see further below).
Imposter Twitter accounts and triggering shadow-banning
As reported in the New York Times, one way to hide a Twitter account or a hashtag is to trigger the automatic anti-spam system through a flood of fake posts.
Mass posting of “Chinese Transnational Policing Gone Wild Safeguard Defenders 110 Overseas” on Twitter led to a temporary shadow-banning of all content related to the search terms, as noted by ASPI’s Albert Zhang.
Another component, aimed at reducing Safeguard Defenders' visibility, has been the continued creation of fake Safeguard Defenders accounts. Back when this started Twitter still had content moderation, and the social media company responded to our complaints. Twitter responded with two batch-deletions of fake accounts. The first one concerned some 800 accounts, while they refused to provide information on the second batch-deletion. We also manually filed for the removal of around 200 fake accounts independently of these.
Later, Axios reported that as of 17 November 2022, there were still 127 fake Safeguard Defender Twitter accounts. The creation of new fake accounts continues unabated to this day.
Fake accounts are now also following journalists and others, creating more confusion. The below post from William Yang, a reporter with Deutsche Welle, was published in May 2023.
These imposter Twitter accounts follow a similar pattern to the creation-delete formula that we noticed with the “Chinese Transnational Policing Gone Wild Safeguard Defenders 110 Overseas”. As of 15 May, we counted about 100 fake accounts. As of this morning, it has increased again, and one can now spend several minutes scrolling through fake accounts, and still not see the end of it. As Safeguard Defenders verified status/symbol is now gone, due to Twitter's policy changes, finding the authentic account has gotten harder.
Interestingly, these fake accounts exactly copy our Twitter name, Safeguard Defenders (保护卫士), often uses nearly identical handle, and our exact bio/description, and usually also use our logo and background image. Sometimes, they even copy a few of our more recent posts to make them appear even more legitimate.
There is no way to know whether this campaign has State-backing, but the scale of operation and its uniformity indicates a single body is directing it.
ASPI’s recent report Gaming Public Opinion, released in April this year, refers to these operations under the moniker spamouflage (also called Dragonbridge) and traces it back to at least 2019. Using data sets released by Twitter and Facebook/Meta, accounts used in various disinformation or harassment campaigns have been traced back to China, and Twitter and Facebook/Meta have deemed these accounts State-backed or State-affiliated.
A recent indictment by the Department of Justice in the United States (April 17, 2023), focused on online harassment in the US, traced some of the work to the Beijing bureau of the Chinese police (Ministry of Public Security), and the “912 Special Project Working Group”, which not only carries out the posting, but create the content for such posting. The indictment calls the group a troll-farm for online harassment and used specifically for harassment of foreign-based dissidents.
Other disinformation campaigns
Safeguard Defenders has been targeted by smaller-scale disinformation campaigns in previous years. These tended to use text copied from Chinese State-Party media. For example, following our successful campaign to raise the issue of China’s forced televised confessions of human rights defenders and to hold State-Party media CCTV and CGTN responsible for collaborating in their production and dissemination (see our report Scripted and Staged), the phrase, “Safeguard Defenders 对 CGTN 的正式投诉背后的原因是什么？”was widely posted. This phrase comes from a 2021 CGTN (English language) article. A search on 7 December 2022 for this phrase returned 668 such posts, 737 on 14 February this year, and 327 on 15 May.
Following the release of our report Involuntary Returns in early 2022, a report that clearly angered Beijing, a disinformation campaign was launched that is still ongoing today, a campaign that attempts to paint Safeguard Defenders as an organization dedicated to protecting criminals, is possibly corrupt itself, and aimed at preventing the Chinese government’s ability to get alleged criminals to return to China to face criminal proceedings.
Then editor-in-chief of Party-State tabloid Global Times Hu Xijin posted a video under his “Hu Says” series, called "“Safeguard Defenders” is lying through its teeth".
Starting in late 2022, this video’s title was used in a barrage of fake posts. A search on 7 December 2022 yielded 2,340 Google hits (of which 1,170 were videos). On 15 May it returned 1,080 results on Google (many being posts on YouTube and Reddit).
Mass (bot-based?) commenting
Recently hundreds of fake Twitter accounts (not those impersonating us) now comment on our posts using snippets of set text. These fake accounts are often newly created, many with no photo, and often with 0 followers and no past activity. Sometimes the comments they leave bear no relation to our original Twitter post. The comments, as shown below, are often repeated and based on machine translations.
As of today, there are some 30 longer texts, mostly published on small forums and blogs. The mass commenting then uses brief snippets from these longer texts, or when allowed, such as on Reddit, posts them in full. The 30 texts so far found can be read here.
The fact that most of the commenting comes from these texts, and most of these 'original texts' are uploaded only to minor blogs and forums, yet being used so consistently in mass commenting, could indicate that this is being done by a bot-based system. As stated in the US indictment, text strings have been produced and distributed by State-actors to be used in similar operations. The way this commenting abuse is being perpetrated adds weight to the suspicion that the campaign(s) are State-backed, and possibly State-run.
Threats, hacks, and more
Meanwhile, Safeguard Defenders is also being increasingly bombarded by attempts to access our official email and social media accounts, including phishing attempts, fake ransomware attempts, and spam. We have, like many others throughout 2023, received fake/phishing emails that have impersonated Australian Senator James Paterson, Hong Kong Watch (HKW) leader Benedict Rogers, Inter-Parliamentary Alliance on China (IPAC) coordinator Luke De Pulford, Scholar Andreas Fulda, Australian activist Drew Pavlou, and the Hong Kong Security Bureau.
The emails are often threatening, including explicit hints at ongoing surveillance activities against SD staff or threats of sexual abuse.
In addition, mass spamming by pretend human rights defenders in need of help has started being commonplace, and can be upwards of nearly a hundred emails per day, from the same accounts. They come in bursts, usually 30 minutes apart, with three, four, five, or more emails at each burst.
On 15 May and 16 May respectively, two new Opinion pieces on China’s State-controlled Global Times newspaper hit out, again, against Safeguard Defenders, and we will expect to see text snippets from those being added and used in mass posting in the future, as the disinformation campaign, continues.
Late last year, a slickly produced video, albeit with a poor-quality audio and subtitling, surfaced on Twitter. While focusing on attacking our 110 Overseas research, it also served as a general hit piece on the organization, other human rights organizations, and Chinese dissidents. Although the video does not appear to have circulated widely, we share it here due to its unintended comedic effect. The same script has also appeared as text on various sites.