We are disclosing a significant state-backed information operation focused on the situation in Hong Kong, specifically the protest movement and their calls for political change.
What we are disclosing
This disclosure consists of 936 accounts originating from within the People’s Republic of China (PRC). Overall, these accounts were deliberately and specifically attempting to sow political discord in Hong Kong, including undermining the legitimacy and political positions of the protest movement on the ground. Based on our intensive investigations, we have reliable evidence to support that this is a coordinated state-backed operation. Specifically, we identified large clusters of accounts behaving in a coordinated manner to amplify messages related to the Hong Kong protests.
As Twitter is blocked in PRC, many of these accounts accessed Twitter using VPNs. However, some accounts accessed Twitter from specific unblocked IP addresses originating in mainland China. The accounts we are sharing today represent the most active portions of this campaign; a larger, spammy network of approximately 200,000 accounts — many created following our initial suspensions — were proactively suspended before they were substantially active on the service.
All the accounts have been suspended for a range of violations of our platform manipulation policies, which we define as:
- Coordinated activity
- Fake accounts
- Attributed activity
- Ban evasion
Examples of violative content
Covert, manipulative behaviors have no place on our service — they violate the fundamental principles on which our company is built. As we have said before, it is clear that information operations and coordinated inauthentic behavior will not cease. These deceptive strategies have been around for far longer than Twitter has existed. They adapt and change as the geopolitical terrain evolves worldwide and as new technologies emerge. For our part, we are committed to understanding and combating how bad-faith actors use our services.
Today we are adding archives containing complete Tweet and user information for the 936 accounts we’ve disclosed to our archive of information operations — the largest of its kind in the industry.
We will continue to be vigilant, learning from this network and proactively enforcing our policies to serve the public conversation. We hope that by being transparent and open we will empower further learning and public understanding of these nefarious tactics. You can access relevant information on these account sets below.
August 2019, set 1:
August 2019, set 2:
Note: We have divided these archives into two parts to better enable review of the intersecting networks of accounts which comprise this campaign. We have evidence to indicate that both sets are associated with the same entity.