U.S. Based Disinfo Actors Spread Fear About Taiwan
Discover more from Hacking, but Legal
U.S. Based Disinfo Actors Spread Fear About Taiwan
Peeling back a Twitter influence operation with Taiwan-focused disinformation elements to show you how it works
Peeling back a Twitter influence operation with Taiwan-focused disinformation elements to show you how it works
Dear Reader,
If you're anything like me, you don't like being lied to.
Regrettably, dishonesty and those who perpetuate it have taken center stage on Twitter. Lies and the liars who tell them are now main characters, even though the platform remains a vital source of news and information.
The safety situation has severely deteriorated since Elon Musk acquired the company and transformed it into some sort of skeevy Internet dive bar serving up cognitive warfare iced teas.
Many of us knew right away things would go downhill.
What no one foresaw was the astonishing speed and depth at which the company would become mired in misconduct, a critical component of such being the total overhaul of the Trust & Safety department at the company (clearly not for the better).
During my time as a tech defense contractor in Iraq, I gained extensive knowledge about a specific type of infrastructure. In IT, it is commonly known as "client-server architecture," but the field of Information Security has maintained the military term: Command and Control, or C&C for short.
This is relevant, I promise.
The concept behind this infrastructure is that one or multiple nodes, either individually or in tandem, manage an array of other nodes. This model can be variously applied to describe the typical behavior of common Internet architecture, malware remotely controlled by a hacker using a C&C server, or the actions of influential individuals on social media engaging in hidden 'quid pro quo' arrangements or direct monetary transactions.
These individuals approach social media not with the objective to compromise computer systems as with operators of malware, but rather to manipulate the minds of their audience as operators of influence. Marketing is a lucrative business, and few can resist the siren song of the wealthy doling out money and reputation points to promote lines which are often ideologically aligned with their own beliefs. Influencers commonly provide polished rate cards that outline their fees, and they are usually compensated on a per-promotional-tweet basis.
Since most of us do not work for social media companies or have privileged access to the vast amount of data they collect about us, we must rely on external sources to identify patterns in the activities and public behaviors of those individuals promoting specific narratives.
While hard data (such as, say, an invoice or authenticated email) is always more desirable and circumstantial evidence may not be ideal, persistent macro-level analysis of a particular topic on a specific platform can still provide valuable insights because disinformation actors can be careless, allowing us to potentially uncover concealed financial connections through simple observation. The recent integration of affordable, high-quality AI into the workflows of influence operators workflows may lead to fewer mistakes over time. However, the low barrier to entry means that everyone is prone to errors, and these can often be discerned with the naked eye.
That's where that C&C infrastructure I was talking about comes in.
April 8, 8:44 AM
First, an account which has been repeatedly called out for global-level disinformation for years tweeted this:
This tweet is shared amid a backdrop of saber-rattling due to Taiwanese President Tsai Ing-Wen's recent return to Taiwan from the United States, where she met with Kevin McCarthy.
Image Source: Old Tabloid
While the information is factual–the Chinese ARE conducting exercises, and the Taiwanese did respond–the tweet is written alarmingly, suggesting imminent offensive military action, and the image featured in the tweet is outdated, originating from a tabloid article published in August 2022 (shown below).
The account boasts 117,000 followers, describes itself as anti-China, and its bio uses the term "Multipolarity", which is a term strongly suggestive of Russian influence, not only because their leader peddles it, but because this terminology originates directly from Aleksandr Dugin.
Again, this account has been called out for disinformation as far back as 2019.
Despite the fact that it does not accurately represent Taiwan's current situation, this old mockup is being actively recycled by disinformation actors who seem to be promoting China's saber-rattling.
Who else tweeted it?
April 8, 8:53 PM: @codeofvets: "Today China finished encircling Taiwan militarily under the excuse of..."
April 8, 9:35 PM: @MarioNawfal: "Taiwan is currently encircled"
April 8, 9:53 PM: @CollinRugg: "Taiwan is currently surrounded..."
April 8, 10:01 PM: @SebGorka: "Chinese warships have encircled Taiwan under the guise of..."
April 8, 11:08 PM: @michaelpsenger: "Chinese warships completely encircled the country today under the pretext of..."
April 8, 10:54 PM: @AsaadHannaa: "Taiwan is currently fully encircled..." then follows it up with, "What’s your take on this @elonmusk ?"
What are some commonalities among these early "super-spreader" influence tweets?
Their release timing is tightly linked, as the initial articles describing these exercises were released a full 24 hours prior to this initial cluster of tweets using the old image without a relevant news link
Three out of six tweets directly blame Joe Biden for China's purported actions or indirectly blame Nancy Pelosi
All use the language "encircled" (more on this below)
All use some variation of "pretext", "guise", "excuse", "drills", "planned exercise", often with scare quotes
Two of the accounts have variously claimed to either be located in Taiwan or to have confirmed with someone who is Taiwanese that they are "afraid"
From these initial tweets, the lie is spreading wildly, and appears intended to frighten people into believing that China's saber-rattling military exercises imply imminent invasion.
This is unmitigated psychological warfare.
The posts are accumulating millions of views, and many accounts, some with the blue check are now reposting this specific image directly in their tweets, not linking to any article, and amplifying the fear.
No news organization is using this image to represent the current state of Taiwan.
This is a disinformation amplification network. Now imagine this happening every day with every political topic you can imagine. And whoever's at the helm at Twitter Trust & Safety doesn't seem to have interest in stopping this kind of thing, unlike her predecessor and everyone else in her industry.
Notably, since one of the accounts called out to Elon Musk in his typical style of engagement, I went looking for other signs of alignment between these accounts and Musk.
Of course, I found many. Here's a fun one, supporting Musk's recent decision to label NPR as "state-affiliated media" as part of his onslaught on the institution of the press:
"Encirclement"
If you are sharp-eyed, you may have noticed the common term "encirclement" among most of these posts (variation: "surrounded").
This very specific terminology came from the Chinese People’s Liberation Army’s (PLA) Eastern Theater Command:
“The task force will simultaneously organize patrols and advances around Taiwan island, shaping an all-round encirclement and deterrence posture,” a report from China’s state broadcaster China Central Television said.
I don't think Western media (or influential social media accounts) should be uncritically parroting the Chinese military, and certainly not without quotes, but here we are.
A hat tip to @lnachman32 who was the sole individual to point out something smelled bad as early as 2AM!
This is misleading. This picture does not depict the current drills, it’s an old image. The language is also overstated, Taiwan is not “encircled by the Chinese military” as if invasion or war are imminent. These are just drills, and much less dire than we saw in August 2022. https://t.co/2vW4FjcFy5
— Lev Nachman (@lnachman32) April 9, 2023
Thanks for reading!