Kalen Keegan, a college student at the University of Nebraska Omaha, immediately noticed when her Twitter account unleashed a torrent of posts in Chinese. “My other account got hacked👍🏽,” the soccer player posted on a replacement account. The new author tweeting as @Kalenkayyy had strong views on geopolitics — all aligned with the Chinese Communist Party. It was obsessed with the protests in Hong Kong, offered uncritical praise of the Hong Kong police and accused demonstrators of fomenting a “color revolution” backed by an “anti-Chinese American conspiracy.”

As the coronavirus outbreak led to a lockdown of Wuhan and its surrounding cities in late January, the Hong Kong posts were suddenly deleted. The account continued to post relentlessly in Chinese, but it now focused on the burgeoning epidemic. About a month later, her Twitter profile began to change in other ways. The reference to her college disappeared and her headshot was replaced by a generic photo of two people kissing. By the end of the week, her Twitter transformation was complete. @Kalenkayyy was now a Chinese propaganda-posting zombie account belonging to someone purportedly named Kalun Tang.

Her new tagline? “When women arm themselves with softness, they are the strongest.”

Later, the account deleted more of its tweets and unfollowed all of its former friends. It is currently temporarily restricted by Twitter for unusual activity.

Since August 2019, ProPublica has tracked more than 10,000 suspected fake Twitter accounts involved in a coordinated influence campaign with ties to the Chinese government. Among those are the hacked accounts of users from around the world that now post propaganda and disinformation about the coronavirus outbreak, the Hong Kong protests and other topics of state interest. They included a professor in North Carolina; a graphic artist and a mother in Massachusetts; a web designer in the U.K.; and a business analyst in Australia. (It is unclear whether the current fake account holders hacked the accounts themselves or purchased them from elsewhere.) Suspected Chinese operatives have stepped up their efforts in recent days, according to private messages shared with ProPublica, offering influential Chinese-speaking Twitter users cash for favorable posts.

These efforts appear to be aimed at disparate audiences outside the country. Most of the posts we found are in Chinese and appear aimed at influencing the millions of ethnic Chinese who live outside of China’s borders. Others are in English. The tweets are seen by few people living in China; the Great Firewall blocks Twitter from the Chinese internet, though tech-savvy domestic users find workarounds.

Twitter is well aware of China’s influence operations. In August and September, the platform announced that it had suspended more than 5,000 suspected Chinese state-controlled accounts and released data about them. Twitter also banned around 200,000 related accounts that had been created but were not yet very active.

An analysis by ProPublica shows that the Chinese government’s covert attempts to wield influence on Twitter have persisted. Our examination of an interlocking group of accounts within our data linked the effort to OneSight (Beijing) Technology Ltd., a Beijing-based internet marketing company. OneSight, records show, held a contract to boost the Twitter following of China News Service, the country’s second-largest state-owned news agency. The news service operates under the United Front Work Department, an arm of the Chinese Communist Party long responsible for influence operations in foreign countries. OneSight declined to comment and China News Service did not respond to our inquiries.

We asked Twitter whether it was aware of this continuing activity from Chinese-backed influence accounts. We identified some of the fake accounts, and sent a list of questions about the campaign. A spokesperson declined to respond specifically, instead providing the following statement: “Using technology and human review in concert, we proactively monitor Twitter to identify attempts at platform manipulation and mitigate them. If we identify further information campaigns on our service that we can reliably attribute to state-backed activity either domestic or foreign-led, we will disclose them.”

ProPublica’s research tracked how the government-linked influence accounts that had targeted political dissidents and the Hong Kong protests turned their focus to the coronavirus outbreak. During the height of the epidemic in China, many of them became cheerleaders for the government, calling on citizens to unite in support of efforts to fight the epidemic and urging them to “dispel online rumors.”

With the epidemic spreading across the world, these accounts have sought to promote the Chinese government’s image abroad and shore up its support at home. One typical recent tweet in Chinese proclaimed: “We were not scared during the outbreak because our country was our rearguard. Many disease-fighting warriors were thrust to the front lines. Even more volunteers helped in seemingly trivial yet important ways.”

Another post in English trumpeted aid the Chinese government recently provided to Italy. It came from the Twitter handle @RNA_Chinese, an account that appears to have been an attempt to fool the casual reader into believing it was coming from the U.S. government-funded broadcaster Radio Free Asia (@RFA_Chinese).

Others accounts we found have taken a darker turn in response to the pandemic, using it as a vehicle for disinformation and attacks on Beijing’s usual political opponents.

“We will completely wipe out the belligerent rioters, just like the coronavirus!” declared a user who called herself Melinda Butler. Her post slammed Joshua Wong, a leader of the Hong Kong protests who spoke out in support of a medical workers’ strike in early February. Another post by Butler called on the Hong Kong Hospital Authority to “clean out” the striking “black medical workers,” alongside a graphic accusing protestors of wanting a “color revolution” in Hong Kong.

Yet another Butler tweet featured a graphic accusing foreign politicians of interfering in Chinese domestic affairs, including House Speaker Nancy Pelosi, Secretary of State Mike Pompeo, U.K. Foreign Secretary Dominic Raab and a number of other U.S. legislators. Also included in the lineup was a State Department employee scapegoated by disinformation campaigns by Chinese state media during the Hong Kong protests. “Hong Kong belongs to China,” the graphic read in bold characters, “Resist meddling by foreign powers!” A logo for the People’s Daily, the official newspaper of the Chinese Communist Party’s Central Committee, was displayed prominently below.

Butler’s account showed all the signs of being a low-quality fake. The account was new, created in January 2020, and it offered no personal or biographical details. It followed no one else on Twitter and had a single follower for its obsessive posts about the coronavirus outbreak and the Hong Kong protests. The account has since been suspended by Twitter.

Butler’s posts were written to sound like a Hong Konger — in vernacular Cantonese with the traditional Chinese characters widely used in Hong Kong. But whoever was writing the posts occasionally slipped and included some of the simplified Chinese characters used in mainland China. And though the account was ostensibly created by a person named Melinda Butler, the profile photo showed a middle-aged Chinese woman wearing a beige baseball cap.

That photo can be seen all over the internet — ProPublica found it used on nearly a dozen user accounts under a variety of monikers on various social media platforms. One account spammed horoscopes and product promotions on the social networking site Weibo. On a Chinese adult e-commerce site, another account bearing that photo left a positive review for a male enhancement spray called Blisswater: “After using this item the effect was especially clear. Our bedroom became much more harmonious, and I’m very satisfied. Thumbs up.”

Many of the fake Twitter accounts that ProPublica identified, such as Butler’s, appeared to have been automatically generated using a bank of fake profile photos and usernames. But others, like Keegan’s, belonged to real Twitter users at some point, indicating that the accounts had likely been hijacked. ProPublica wrote computer programs to document millions of interactions between the 10,000 suspected fake accounts and trace an interrelated network of more than 2,000. The true scale of the influence campaign is likely much bigger; our tracking suggests that the accounts we identified comprise only a portion of the operation.

We found a pattern of coordinated activity among the fake accounts that appeared to be aimed at building momentum for particular storylines. Central accounts with more legitimate-looking histories such as Keegan’s would make eye-catching posts; for example, a political message accompanied by a bold graphic or a meme, or a provocative video. An army of obvious fake accounts would then engage the posts with likes, reposts and positive comments, presumably to boost their visibility in Twitter’s algorithms.

Posts also used hashtags about trending topics such as the coronavirus outbreak or the Hong Kong protests to gain visibility for an account that had few followers. Other posts would use hashtags unique to the influence network, presumably to try to make them trend on Twitter. Remarkably, some of the fake accounts accumulated hundreds, and, in a few cases, thousands of followers (It’s not clear whether the fakes were being followed by real people or other fake accounts.)

Those accounts’ content and behavior closely mirrored the tactics of the Chinese government influence campaigns publicly unmasked by Twitter in August and September 2019. Elise Thomas, a researcher at the Australian Strategic Policy Institute, co-authored a report that discovered content and tactics that we found in the activities of the more recent influence network. In both instances, posts criticized the Hong Kong protests and government opponents such as Guo Wengui and were primarily made during working hours in Beijing. In addition, accounts with established histories suddenly began posting propaganda and disinformation in a different language. Thomas’ analysis found covert Twitter campaigns by the Chinese government going back at least two years: “These actors appear to have been active for much longer than we previously realized,” she said.

ProPublica uncovered additional evidence that these accounts operated as part of a Chinese government influence campaign. Posts in the network were often accompanied by a chorus of approving comments from obviously fake accounts. The same comments were used over and over to create false engagement. Comment texts were often lifted word-for-word from state editorials, which have long served as political lodestars for government agencies and party officials.

While some hijacked accounts deleted old posts and laundered evidence from their profile, hints of their origins sometimes remained. One such example is @HKguardian, a Hong Kong account that claims to be a Twitter handle for a citizens’ league protecting the city from the protesters.

The Chinese-language account was created in 2009 but did not appear to make any posts until September 2019. We found several posts in Portugese from July 2009 when the account was first created. @HKguardian now has more than 4,000 followers and the appearance of a legitimate account. It is currently temporarily restricted by Twitter for unusual activity.

Some of the people banned by Twitter have popped up under new handles. Consider Amanda Chen, a widely followed account claiming to belong to the wife of a Hong Kong policeman. Its Twitter posts attracted attention from pro-Beijing media during the 2019 protests. The persona has tweeted under at least two other handles (@HKvigilance and @AmandaChen202) previously suspended by Twitter. Whoever she is, she now posts with the handle @Nuca12345, an account that was created a decade ago but had no activity before October 2019. @Nuca12345 has amassed more than 4,000 followers in its brief posting history. We have found no independent evidence that the real Amanda Chen exists.

While we cannot measure the exact reach and effectiveness of the campaign, it has attracted notice from its target audience. Skeptical internet users reported to Twitter suspected fake accounts that we had also identified. Many fake accounts within the network we identified were suspended, but it is unclear which of these suspensions resulted from users’ reports, and which from Twitter’s automated systems for detecting coordinated inauthentic behavior.

---

The evidence linking the influence network to OneSight, the Beijing-based internet marketing company connected to the Chinese government, is circumstantial. In 2019, a handful of fake boosting accounts within the network we identified promoted OneSight’s own social media marketing posts with likes. The data released by Twitter in September 2019 also included a number of posts connected to OneSight’s Twitter account. Our review of the data we collected found no other similar company benefiting from similar boosting.

Outside social media contractors have long been suspected of pushing Chinese government messaging abroad. Last year, ProPublica obtained a copy of a 1,244,880 renminbi (around $175,000) contract won by OneSight to increase the Twitter following of China News Service. We also found the influence network boosting the Twitter account of China News Service, as well as other Chinese state media Twitter accounts, including Xinhua and People’s Daily.

The activities of the influence network were consistent with the timing of the government’s handling of the epidemic and the themes it was publicly pushing. Discussions of a novel coronavirus in Wuhan began swirling on Chinese social media in early January, but the network made no mention of it, continuing to criticize the Hong Kong protests and attack political dissidents. On Jan. 29, six days after the Chinese central government imposed a lockdown on Wuhan, the influence network suddenly shifted its focus to the coronavirus epidemic. That same day, OneSight announced a new app that tracked virus-related information. The announcement was accompanied by a graphic declaring that OneSight would “transmit the correct voice of China” to the world.

OneSight bills itself as the top overseas social marketing company in China. It contracts with domestic companies and government agencies to help them market their brands or goods on social media seen outside of China. Its website names prominent Chinese companies such as Huawei, Alibaba and Baidu as clients. Besides China News Service, its state media clients include China Daily, the English-language newspaper, and CGTN, China’s foreign language TV news channel, both of which are run by the propaganda department of the Chinese Communist Party. The state-owned news service Xinhua News Agency is also a client.

CEO Li Lei, who founded the company in October 2017 (about two years before the Australian report), is a social media entrepreneur who, according to media interviews, previously worked at the Beijing city foreign propaganda department. In China, government propaganda departments exist at various levels of government and are responsible for a wide range of activities, including public information and public relations, as well as censorship and propaganda, both online and offline.

OneSight provides its clients social media marketing services and a social media monitoring and management tool. ProPublica’s review of a free version of the tool found that it can be used to post messages en masse across a number of accounts on overseas social media platforms including Twitter and Facebook. The tool is used by China Daily’s official Twitter account. However, we did not find evidence of it being used within the influence network.

OneSight’s product tutorials show a familiarity with coordinated campaigns and government entity clients. One post tells clients how to regain access to Facebook if an account is suspended for behavior violating the terms of service. Another analyzed Huawei’s Facebook followers, implying that OneSight could make its social media fans look more natural and healthy. It also posted an analysis of how to make the social media followings of local governments appear more realistic.

The Chinese government’s information operations are not monolithic. Lotus Ruan, a researcher at the Citizen Lab at the University of Toronto and an expert on Chinese social media, explained that domestic censorship is “decentralized and fragmented, and the burden of information control is downloaded to private companies.” Government agencies rely on private companies for social media work outside of the Great Firewall as well. During 2019, as OneSight won its contract with China News Service, China’s Cyberspace Administration and Foreign Affairs Ministry also put out similar tenders. This follows a global trend of internet marketing companies being hired for political influence campaigns online.

The Chinese government has also made an official push onto social media in recent years. Its diplomats are logging onto Twitter to help fight its PR battles, developing a combative, Trump-like approach to defending the regime online. On Twitter, government spokespeople have unapologetically spread disinformation about the coronavirus, even promoting the conspiracy theory that Americans brought it to Wuhan. In official social media, China typically seeks to project an image of a well-governed state and a responsible international actor, according to Matthew Schrader, China analyst at the U.S.-based think tank Alliance for Securing Democracy. However, Schrader said, “the party has been dipping its toe into outright disinformation when it has sought to deflect blame for its own policy missteps.”

Schrader says that government influence campaigns on the Chinese internet, leaning on the crutch of censorship, have largely been successful. But outside of its borders, without compliant platforms and coercive state power, similar covert propaganda campaigns, presumably by various departments and their contractors, appear to have trouble achieving the same success.

Despite that, the Chinese government’s efforts persist and evolve as the coronavirus spreads across the globe. Over the past few weeks, ProPublica obtained records of propositions to several prominent Chinese Twitter users from what appear to be fake accounts. One private message offered a user with more than 10,000 followers a payment to promote a video of Wuhan’s battle against the coronavirus “for the public benefit.”

Another account calling itself an “international cultural exchange” company offered 1,700 renminbi (around $240) per post to the Chinese Australian artist Badiucao. The political dissident has nearly 70,000 followers on Twitter. After a day of feigned negotiations with the company, he obtained and shared with ProPublica a sample of what he would be asked to post — a 15-second propaganda clip. The video sought to show that the government defeated the coronavirus and everything is back on track. “This is what Chinese propagandists call a ‘positive energy wave,’” he said. He didn’t get the name of the company. It ultimately declined to provide a contract, replying: “Upon client review, your posting style does not fit this promotional topic.”

Badiucao is confident, based on their interactions, that the company he was communicating with was working for the Chinese government. When asked why they would contact such an outspoken opponent of the regime, he speculated that the company used social media monitoring tools to identify their targets (evidence shows they reached out to Chinese-speaking Twitter users having more than 10,000 followers). But the company seemed unfamiliar with the diaspora community on Twitter, he said: “They’re marketing pros, but they don’t have a nuanced political understanding.”

Recently exposed to the coronavirus himself, Badiucao spoke to ProPublica from self-isolation in Melbourne. “I resettled in Australia because I wanted a free and safe environment. I believed in the democratic system here,” he reflected, “but with the virus, we’re not even safe if we move away. And just like the coronavirus, values can be contagious as well.”

Daniel Huang and Lexi Campbell contributed research.

Do you have access to information about state-backed online influence campaigns that should be public? Email jeff.kao@propublica.org. Here’s how to send tips and documents to ProPublica securely.

---