Trolling Taiwan

Key Findings

• Graphika has identified a coordinated and sustained effort to promote narratives critical of Taiwanese President Tsai Ing-wen following U.S. Congresswoman Nancy Pelosi’s visit to Taiwan in August this year.
• The campaign leveraged low-quality, likely inauthentic, accounts to seed and amplify a set of anti-Tsai videos across 40 different online platforms. As of Sept. 1, 2022, we have identified tens of thousands of copies of these videos promoted online in more than five languages.
• These videos were produced primarily in Taiwanese and Chinese and directly addressed the Taiwanese people. Taiwanese is predominantly spoken by older people in Taiwan, who are reportedly more receptive to pro-Chinese narratives than younger generations.
• We did not attribute this activity to a specific actor based on the open-source indicators identified in our investigation. We saw some limited connections to the Spamouflage network, including Spamouflage assets sharing the same content as this campaign, but currently view the two activity sets as distinct and separate. 

Activity Overview

Graphika has identified a coordinated and sustained effort to manipulate online conversations around the topic of Taiwanese independence between Aug. 14 - Sept. 1, 2022. The campaign launched following U.S. Congresswoman Nancy Pelosi’s visit to Taiwan on Aug. 2 and promoted narratives critical of Taiwanese President Tsai Ing-wen’s foreign and defense policies across 40 different online platforms.

The campaign centered around six similar but visually distinct videos. Each version uses the exact same script and shows different images and video clips of military activity cut with footage of Tsai and other Taiwanese politicians. The videos assert that as of Aug. 2, 2022, the median line of the Taiwan Strait no longer exists and the Taiwanese military is secretly planning to surrender to China. We identified versions of the videos in Chinese, but the majority directly addressed the people of Taiwan in Taiwanese. Of note, Taiwanese is primarily spoken by older people in Taiwan, who are reportedly more receptive to pro-Chinese narratives than younger generations.

The actors behind this activity then promoted the videos across multiple online platforms using accounts that showed clear signs of inauthentic behavior. In most cases, likely inauthentic accounts uploaded the videos to YouTube and other assets then shared links to the content across platforms including Instagram, Facebook, Twitter, and Reddit. The campaign also targeted alternative platforms such as Gettr and Chinese-language discussion forums. Posts typically used identical or near-identical language, often consisting of the video title alongside the hashtags #敦促蔡英文及其軍政首腦投降書 [urging Tsai Ing-wen and her civil and military leaders to surrender] or its simplified Chinese equivalent #敦促蔡英文及其军政首脑投降书, #蔡英文 [#TsaiIngwen], and #taiwan. We also identified posts in Korean, Japanese, and French languages sharing links to the videos.

Our analysis allowed for the likelihood that authentic users organically discovered and independently shared the same videos on social media. However, the identical language, synchronized posting patterns, signs of inauthentic behavior, and other TTPs provide high confidence that the activity discussed in this blog post represents a coordinated effort to manipulate the online conversation around Taiwan at a time of heightened tensions with Beijing.

Patriotic Penmanship & Unix Timestamps

The script used to narrate all of the videos in the campaign appears to have been lifted verbatim from an article by Chen Xianyi, a Chinese left-wing nationalist author and former publicity officer in China’s People’s Liberation Army. Chen’s article was first published on Aug. 8 by Kunlunce, an outlet operated by Kunlun Research Institute, while the first video we identified associated with this campaign was posted on Aug. 14. The article’s title – “敦促蔡英文及其军政首脑投降书” [Urging Tsai Ing-wen and her civil and military leaders to surrender] – is also an exact match for the simplified Chinese hashtag used by the campaign to promote copies of the videos.

In his writing, Chen asserts that China has the right and means to conquer Taiwan and demands that Taiwan’s leadership cease reliance on the U.S. for its pro-independence agenda. “Ms. Tsai Ing-wen,” Chen writes in Chinese, “you have committed numerous and unforgivable crimes … You have nowhere to escape and the People’s Liberation Army’s missiles will always be a step ahead of you.”

On Aug. 9, Sima Nan, an online commentator and social media influencer popular with Chinese nationalist audiences, posted a video promoting Chen’s article to Bilibili, YouTube, Douyin, WeChat, and Weibo, where he has a combined following of almost 1 million. Interestingly, the campaign promoted one video primarily composed of recycled clips from Sima’s Aug. 9 post.

Graphika has not been able to determine who created the videos subsequently employed by the anti-Tsai campaign. We have no evidence to suggest that Chen or Sima were involved in the coordinated effort to promote them.

Starting from Aug. 15, however, the actors behind the campaign appear to have made a concerted effort to distribute the videos via WeChat. According to Google search results, as of Aug. 31, over 400 copies of the anti-Tsai videos were available under the title “mmexport1660466180684.” Based on this title, it is highly likely that the videos were exported from WeChat at 08:36:20 (UTC) on Aug. 14, 2022. “Mmexport” followed by a Unix timestamp indicating the time of export is the default naming rule for files downloaded from WeChat.

Tactics, Techniques, & Procedures (TTPs)

Graphika analyzed social media accounts involved in the campaign to identify TTPs employed by their operators. This analysis revealed a set of at least 1,485 assets that promoted the six anti-Tsai videos across no less than 40 online platforms and displayed clear signs of coordination and inauthentic behavior.

Notably, when mapping Twitter mentions of the campaign’s primary hashtag - “urging Tsai Ing-wen and her civil and military leaders to surrender” - between Aug. 14 - 30, we identified a set of 1,077 Twitter accounts that repeatedly posted the hashtag but showed no network connections between them. This is highly unusual for accounts engaged in conversation around the same topic and consistent with an attempt to artificially boost a hashtag using low-quality inauthentic accounts. Many of these accounts posted links to copies of the six anti-Tsai videos using identical language, often within the same hour and from the same source client.

Picture-Perfect Profiles?

Accounts involved in the campaign often presented as thinly-developed fake personas, with stolen profile pictures, missing or nonsensical bios, and suspect usernames (e.g., “Pelosi Paul” and “adshkj asjdka”). One such account on Twitter, for example, was created in August this year under the name “Sandra Fields” but used a profile picture of a 2017 Miss Kyiv contestant. On Instagram, an account with the username “xuwn77” posted the anti-Tsai videos and related screenshots alongside hashtags in multiple languages but appears to have sourced its profile picture from a 2020 blog post about pageant hairstyles.

Batches of Bogus Accounts

Graphika identified repeated evidence of batch account creations, a common indicator of coordinated activity. Of the 1,077 likely inauthentic Twitter accounts mentioned above, 1,023 were created between June - August this year, with 149 registered on the same day: Aug. 1. On YouTube, we identified 310 channels that had posted hashtags or key terms used in the campaign. Most of these were created between July and August, with 97 created on Aug. 15 alone.

Flood the Zone

Graphika found evidence of the coordinated anti-Tsai messaging effort active on at least 40 sites and platforms, a significantly larger scale and breadth than similar online campaigns we have previously analyzed. The range of online spaces targeted by this campaign suggests that although much of the content was tailored to specific language audiences, the dissemination of these videos prioritized quantity and scale over precision.

Between Aug. 14 - 31, we identified copies of the six campaign videos, or links to the videos hosted on YouTube, posted by assets in the campaign to mainstream social media platforms, including Twitter, Facebook, Instagram, and Google Groups, as well as video- and audio-hosting sites such as Vimeo and Soundcloud. Accounts also targeted U.S. alt-tech platform Gettr, Russian social networking site Odnoklassniki, and pro- and anti-CCP Chinese discussion forums. Most unusual was the one instance we identified of a campaign video posted to the English-language Nigerian internet forum Nairaland.

According to Google’s site-specific search, a total of 4,230 posts containing the hashtag #敦促蔡英文及其軍政首腦投降書 [urging Tsai Ing-wen and her civil and military leaders to surrender] were posted to Reddit as of Aug. 29. All of these Reddit posts were published on or after Aug. 14 and included either embedded copies of the anti-Tsai videos or links to the same videos on YouTube.

Hashtag This

Accounts associated with this campaign used identical or near-identical language in their posts, which usually consisted of a video title and the hashtag “urging Tsai Ing-wen and her civil and military leaders to surrender” in either traditional or simplified Chinese. Some posts included more generic hashtags, such as #taiwan and #蔡英文 [Tsai Ing-wen], possibly an attempt to reach wider audiences.

However, this consistent use of a relatively limited number of hashtags made the activity easy to track across multiple platforms, including YouTube, Instagram, Facebook, Twitter, Reddit, and other social media platforms. As of Sept. 1, for instance, we identified 561 Instagram posts containing different versions of the anti-Tsai videos, all paired with the traditional Chinese hashtag #敦促蔡英文及其軍政首腦投降書.