Thread by @benimmo

JUST OUT: @Graphika_Inc has uncovered an active and prolific, but ultimately low-impact, cross-platform political spam network in Chinese boosting attacks on the #HongKongProtests.

For more on the network we're calling "Spamouflage Dragon", read here.
graphika.com/posts/spamoufl…

@Graphika_Inc We call it "Spamouflage Dragon" because the network posted high volumes of spam around lower volumes of political content, presumably as camouflage against detection algorithms.

Like this YouTube account, mixing TikTok videos and politics.

@Graphika_Inc A lot of the assets it used appear to have been hijacked and repurposed, clumsily and hastily.

This YouTube channel, for example, had almost 800,000 views in total, but almost all of them came from episodes of "The Good Life", over two years ago.

@Graphika_Inc Two years ago, it was averaging around 20,000 views per video. Then it fell silent for two years, before it started posting videos about the #HongKongProtests in June. Since then, it averaged about 30 views per video.

This screenshot captures the change.

@Graphika_Inc The YouTube network revolved around a channel called "Rumour Shredder" (谣言碎纸机). It mainly posted attacks on Chinese émigré billionaire Guo Wengui ((郭文贵, aka Miles Kwok).

YouTube took the original channel down in April. The spamouflage network amplified a repeat version.

@Graphika_Inc Whenever "Rumour Shredder" posted a video, other channels would re-post it, usually between spamouflage such as cats, landscapes, and TikTok.

Some of the amplifer channels kept running the same videos at the same time. Subtle.

@Graphika_Inc There were dozens of channels like this; we still don't have a complete list.

But the number of channels didn't match the number of views. This one got under 200 views for one of its political videos. Many got not views at all.

Note, again, the shift in content.

@Graphika_Inc Some of the sharing was just incompetent. Check out the bottom four posts here. Two-second clips of the same video. That's not even enough for the credits.

@Graphika_Inc An intriguing number of the channels that posted anti-Guo content, and then pivoted to criticising the Hong Kong protests, used his photo and name.

Their posting patterns weren't all the same, so it's not clear if all were connected. But there's a definite theme here.

@Graphika_Inc This wasn't just a YouTube network. Groups of similarly clunky accounts amplified the videos on Twitter and Facebook.

It's important to remember this. These days, assume that cross-platform amplification is the default, even for incompetent networks.

@Graphika_Inc On Twitter, different clusters of accounts promoted different parts of the YouTube network.

Some appeared to have their own retweet botnets to back them up, complete with recycled profile pictures.

Beyond the bots, they didn't seem to get traction.

@Graphika_Inc It was much the same on Facebook. Clusters of accounts, and Pages trying to look like accounts, interspersed attacks on Guo and the Hong Kong protests with landscapes, glamour shots, puppies, and wise sayings in English and Chinese. Spamouflage.

Note the stolen profile pic, too.

@Graphika_Inc A startling number of these accounts started off with Bangladeshi identities, and then shifted to Chinese posting in April.

Most likely hijacked or bought, to avoid Facebook's detection systems.

@Graphika_Inc I love this one. A Bangladeshi account that's been taken over and repurposed to Chinese, and a friend asks in Bengali, "what did you say?".

@Graphika_Inc The network on Facebook wasn't any more subtle than on YouTube. Check out these Chinese-language accounts with English names, posting the same content in the same order.

@Graphika_Inc It bears repeating how useful Facebook's transparency tool is for investigations like this. #OSINT community, take note.

Many Pages were merged with other assets of the same name, the day they were created.

Audience boosting? Clearing out a prior history? Hard to judge.

@Graphika_Inc But, as in the YouTube core of the network, the impact on other platforms was minimal.

Almost all the likes, shares and comments to each asset came from other assets in the same network. It was basically one big echo chamber, and they didn't break out of it.

@Graphika_Inc There are a couple of important lessons here.

First, it's a lot harder to run a successful information operation, reaching significant numbers of unaffiliated users, than some operators seem to think.

Bots can boost your numbers, but that's not the same as reaching people.

@Graphika_Inc Second, even incompetent networks these days go cross-platform.

That means that analysis needs to go broad, as well as deep.

@Graphika_Inc Third, one of the enduring questions in the disinfo space has been what China's doing away from its own platforms.

Whoever was behind Spamouflage Dragon, the network gives us more understanding of manipulation attempts in the Chinese-language space on Western platforms.