176. Spamouflage: Is China’s best known disinformation gang taking new aim at the US?

Summary

Click Here Podcast Episode 176: Spamouflage: Is China’s Best-Known Disinformation Gang Taking New Aim at the US?

Release Date: October 22, 2024

Hosts: Dina Temple-Raston and Darren Linville

---

Introduction

In Episode 176 of "Click Here," hosted by Dina Temple-Raston and featuring Clemson University professor Darren Linville, the spotlight is on an evolving Chinese disinformation campaign known as "Spamouflage Dragon." This episode explores how China’s sophisticated information warfare tactics extend beyond election interference, serving as testing grounds for new methods to manipulate public discourse and social media platforms.

The 2022 Florida Senate Race Incident

The episode opens with a peculiar event during the 2022 Florida Senate race. In the early hours of election day, a sudden surge of strange social media posts emerged supporting Senator Marco Rubio. Darren Linville explains:

“We saw tens of thousands of posts from thousands of accounts that can best be described as vaguely supportive of Marco Rubio, but its appearance was really amateurish.” ([00:39])

These posts, resembling comic strips and originating from newly created accounts with no followers, puzzled researchers since their lack of engagement contradicted typical social media strategies aimed at maximizing reach. The activity abruptly ceased by mid-morning, raising suspicions about its authenticity and purpose.

Discovery of Spamouflage Dragon

Professor Linville, co-founder of Clemson’s Media Forensics Lab, and his team investigated the anomaly. They traced the burst of Rubio-related posts back to China, identifying them as part of a disinformation group called Spamouflage Dragon. Linville states:

“China is a much bigger threat to America than the Soviet Union ever was to America or the world.” ([01:51])

Initially, it seemed China was attempting to influence the Senate race. However, given Rubio's substantial 16-point victory, it became clear that the objective wasn’t election interference per se. Instead, China appeared to be using the Senate race as a "laboratory" to test and refine influence tactics for more critical future operations.

From the 50 Cent Army to Spamouflage

The podcast delves into the evolution of Chinese disinformation operations. The "50 Cent Army," allegedly comprising individuals paid to manipulate online discourse, has transformed into the more sophisticated Spamouflage Dragon. Dina Temple-Raston describes:

“The 50 Cent army was just the beginning. And it kind of evolved into spamouflage, which is supposed to be an improvement on the model.” ([06:56])

Spamouflage Dragon employs similar tactics seen in other nations like Venezuela and Rwanda, utilizing automated accounts to flood social media with targeted messages. Linville adds:

“It is similar to what we've seen in other countries. It's not just China that does this.” ([06:53])

The 50 Cent Army’s scale is substantial, potentially comprising hundreds of thousands of part-time workers, including university students who engage in these activities as extracurricular tasks for pocket money. Linville reflects on his own university experience, drawing parallels to Chinese operations:

“When I was in university... in China, you post on behalf of Xi in your spare time.” ([07:23])

Tactics and Impact of Spamouflage Dragon

Spamouflage Dragon's strategy involves overwhelming social media with positive content to drown out negative discussions about China. For instance, when brands like Nike criticized labor practices in Xinjiang, Spamouflage Dragon countered with thousands of positive posts about Uyghur culture and education, effectively deflecting attention from the critical issues:

“They flooded conversations around Xinjiang and Xinjiang cotton with overtly positive content.” ([08:07])

Ji Feng Li, an independent researcher featured in the episode, elaborates on China’s narrative strategies during crises, such as the 2019 Hong Kong protests. He highlights the Ministry of Public Security's involvement, indicating high-priority national security threats and a more aggressive operational scale:

“The Ministry of Public Security's involvement signals a more severe level of repression.” ([12:24])

US Response and Escalation of Chinese Operations

In response to these influence operations, the US Department of Justice indicted 34 Chinese intelligence officers in April, aiming to hold China accountable. However, as Linville notes, China has continued to escalate its efforts, adapting and expanding tactics to target high-value figures and communities, including attempts to interfere in Taiwan elections:

“Their operations have continued to escalate.” ([13:57])

Recently, Spamouflage Dragon has targeted Senator Marco Rubio once again, even though he is not running for re-election. This time, the campaign incorporated new methods such as AI-driven content, shifting from supportive to critical messaging. Linville suggests this indicates a broader strategy to experiment with different influence mechanisms:

“Sometimes you gotta throw a lot of spaghetti at the wall and some of that spaghetti is gonna stick and some of it's not.” ([15:58])

Broader Implications and Future Threats

Dina Temple-Raston and Linville discuss the broader implications of these operations on American social media and public discourse. They suggest that China's aims extend beyond direct political influence to manipulating the very algorithms and structures of social media platforms. Linville underscores the necessity of understanding and countering these tactics to safeguard the integrity of information and democratic processes:

“It's important that we... try to have as full an understanding of what countries like China and Russia and Iran are doing...” ([16:17])

Additional Cyber and Intelligence Highlights

While the primary focus remains on Spamouflage Dragon, the episode briefly touches on other top cybersecurity and intelligence stories of the week:

• North Korean Military Deployments: Ukrainian President Volodymyr Zelensky announced that North Korean soldiers are training in Russian military bases to aid Moscow in its conflict with Ukraine. This includes the deployment of North Korean missiles, providing Pyongyang with valuable intelligence on missile performance and Western anti-missile defenses.

• Interpol’s Soga X Operation: During the European Football Championship, Interpol launched a global crackdown on illegal sports betting, arresting approximately 5,000 individuals across 28 countries and recovering over $59 million in illicit proceeds. The operation dismantled scam centers, human trafficking rings, and money laundering schemes.

• Game Freak Data Breach: The Pokémon franchise developer, Game Freak, confirmed a massive data breach in August 2024, resulting in the theft of thousands of employee names, email addresses, concept art, and details about upcoming games. In response, Game Freak has rebuilt its servers and enhanced security measures.

Conclusion

Episode 176 of "Click Here" underscores the sophisticated nature of Chinese disinformation operations through Spamouflage Dragon. Professor Darren Linville emphasizes the critical need for continuous research and vigilance to counteract these covert influence campaigns. The episode serves as a stark reminder of the evolving threats posed by state-sponsored disinformation and the importance of safeguarding democratic institutions and public discourse.

Notable Quotes:

• Darren Linville [00:39]: “We saw tens of thousands of posts from thousands of accounts that can best be described as vaguely supportive of Marco Rubio, but its appearance was really amateurish.”

• Ji Feng Li [12:24]: “The Ministry of Public Security's involvement signals a more severe level of repression.”

• Darren Linville [15:58]: “Sometimes you gotta throw a lot of spaghetti at the wall and some of that spaghetti is gonna stick and some of it's not.”

• Darren Linville [16:17]: “It's important that we... try to have as full an understanding of what countries like China and Russia and Iran are doing...”

---

Producer Credits: Today's episode was produced by Megan Dietry, Sean Powers, Erica Gaeda, and Jade Abdul Malik. It was edited by Karen Duffin, back-checked by Darren Ancrum, and features original music by Ben Levingston with additional tracks from Blue Dot Sessions. Staff contributions include writer Lucas Riley and illustrator Megan Gough, with Martin Peralta serving as sound designer and engineer.

Stay Tuned: Tune in on Friday for "Mic Drop," featuring our favorite interview of the week, and catch the next episode of "Click Here" on Tuesday.

Transcript

[Dina Temple Rest]

From Recorded Future news, I'm Dina Temple Rest and this is Click here. Live from the early on election day in 2022, this weird thing happened in the Florida Senate race. Senator Marco Rubio Congresswoman val Demings decision 2022 before you vote U. S Senate debate in the wee small hours of the morning, there was this sudden explosion of strange posts about Senator Marco Rubio, the Republican incumbent.

[Darren Linville]

We saw tens of thousands of posts from thousands of accounts that can best be described as vaguely supportive of Marco Rubio, but its appearance was really amateurish.

[Dina Temple Rest]

This is Darren Linville. He's a professor at Clemson University and the co founder of Clemson's media forensics lab. And the Rubio posts he spotted looked almost like comic strips.

[Darren Linville]

It was not his official campaign content and it was being posted by accounts that had just been created that had no followers. Nobody was going to see this content.

[Dina Temple Rest]

Which was a head scratcher because engagement is pretty much the point of social media, especially during election season. The posts kept pouring in until mid morning when just as quickly as they started, they stopped. So, always curious, Darren and his researchers at the lab started poking around and they traced that burst of election day activity back to China, which is perhaps not surprising. Senator Rubio is a big China hawk.

[Darren Linville]

I will just say China is a much bigger threat to America than the Soviet Union ever was to America or the world.

[Dina Temple Rest]

More specifically though, they traced the post to a Chinese disinformation group that we've been hearing a lot about these days, something called spamoflage or spamoflage Dragon. A new report shows a rise in what's known as Spamoflage, with accounts claiming to be US voters posting about hot button issues. Your first assumption when you hear about something like these Rubio posts is that China might be trying to sway an election, but this Rubio race wasn't tight. He won by 16 points. What Darin finally realized was that China's goal wasn't to swing the race so much as to sort of use it as a laboratory. A chance to test different ways to influence conversations, perhaps in preparation for future elections or other situations where the stakes would be much higher. So do you think that Rubio is kind of a canary in the coal mine?

[Darren Linville]

That's my suspicion.

[Dina Temple Rest]

I'm Dina Temple Rest, and this is Click Here, a podcast about all things cyber and intelligence. We tell true stories about the people making and breaking our digital world. And today, a look at China's evolving influence operations and how Beijing's apparent obsession with one Florida Senate could give us a window into what it's planning to do next.

[Darren Linville]

This is something that nobody has reported on. It's a story that I've been wanting somebody to tell.

[Dina Temple Rest]

I'm all ears. Stay with us.

[Tim Harford]

Do nice guys really finish last? I'm Tim Harford, host of the Cautionary Tales podcast, and I'm exploring that very question. Join me for my new miniseries on the art of fairness. From New York to Tahiti, we'll examine villains undone by their villainy, monstrous self devouring egos, and accounts of the extraordinary power of decency. Listen on the iHeartRadio app, Apple Podcasts, or wherever you listen to podcasts.

[Dina Temple Rest]

From. Recorded Future News. This is Click Here. I'm Dina Temple. Rest Darren Linville never intended to focus his research on social media.

[Darren Linville]

I saw social media as just a sort of easy place to collect data. You know, I use social media to study other things.

[Dina Temple Rest]

But he said all that changed when he started constructing a pretty unusual data set in the spring of 2018. It was a database of some 3 million posts from the Internet Research Agency. The troll farm Moscow created to send disinformation around the world.

[Jade Abdul Malik]

During the 2016 presidential election, suspected Russian operators created bots on Twitter to promote hashtags like war against Democrats. A troll is an actual as he.

[Dina Temple Rest]

Studied these posts and wrote academic papers about it, he went from seeing social media as something that he just used to get data for other research to becoming the center of his research itself. He eventually helped found the Media Forensics lab at Clemson.

[Darren Linville]

We started looking at other campaigns and other actors and other tactics that state actors mostly were using to influence conversations on social media and the wider digital ecosystem.

[Dina Temple Rest]

And that led you to China, and.

[Darren Linville]

That led us to China.

[Dina Temple Rest]

Now, the Chinese Communist Party has always been good at weaponizing and controlling information. Mao Zedong sent China into a revolution by creating a party line and having young Red Guards enforce it. For 10 years, they attacked what Mao called the four olds of Chinese society. Old customs, old culture, old habits, and old ideas. Mao instructed the guards to brutally and often physically target anyone who dared to disagree. Chinese President Xi Jinping has ginned up a modern version of this and taken it online. They created something people now call the 50 Cent Army. Allegedly, workers are paid 50 cents every time they post something. But it turns out the 50 Cent army was just the beginning. And it kind of evolved into spamouflage, which is supposed to be an improvement on the model.

[Darren Linville]

It is similar to what we've seen in other countries. It's not just China that does this. Venezuela is known to do this. And we recently identified a campaign from Rwanda doing it as well.

[Dina Temple Rest]

Do we have any idea how big the 50 Cent army is?

[Darren Linville]

I've seen huge ranges in estimates, but it may be hundreds of thousands. Because it's typically people working part time.

[Dina Temple Rest]

Some research suggests that the army doesn't just include government workers, but also university students. Posting for the party may be almost like a club or an extracurricular activity that might earn them a little pocket money.

[Darren Linville]

You know, when I was in university, I was in a number of clubs. You know, I did some theater and other activity after class. Then in China, you post on behalf of Xi in your spare time.

[Dina Temple Rest]

Some days, the 50 Cent army might be told to post about something specific, like how great the Chinese economy is doing. Other times, they'll be instructed to address something making the rounds on social media, something that isn't to the CCP's liking. Take, for example, what happened a few years ago when brands like Nike expressed concern about labor practices in China.

[Unknown]

Hundreds of thousands of people from ethnic.

[Dina Temple Rest]

Minorities, including the Uyghur community, are being.

[Unknown]

Forced by the Chinese authorities to pick cotton.

[Dina Temple Rest]

Beijing's 50 Cent army responded with thousands of posts that had nothing to do with cotton.

[Darren Linville]

So they flooded conversations around Xinjiang and Xinjiang cotton with overtly positive content. So posts that were happy Uyghur people, posts about Uyghur culture, posts about Uyghur children going to school.

[Dina Temple Rest]

It's a very particular kind of disinformation warfare. Not a direct attack as much as a kind of deluge.

[Darren Linville]

China and Spamouflage Dragon in particular routinely uses these accounts that have no followers and were just created, and they. They use them to engage in flooding attacks. So if there's a hashtag that China doesn't like, or even an individual they don't like, they might just start posting thousands of posts using that hashtag.

[Dina Temple Rest]

The conversation they don't want just gets washed away in this flood of content about things China does want heard. It can be subtle and even hard.

[Darren Linville]

To spot things that don't overtly look like Chinese disinformation. You know it doesn't. Yeah, okay, let's. Let's talk about culture in Xinjiang. I'm happy to have that conversation, but in reality was there for a really deceptive reason.

[Dina Temple Rest]

And the technique does work with real world impact. Just before the Beijing Winter Olympics in 2022, human rights groups began calling for a boycott. Pro China automated accounts swooped into action and drowned out the hashtags they were using. Since then, China appears to have formalized the effort. Now they have a special unit dedicated to this kind of work.

[Ji Feng Li]

The operation structure would be primarily based in Beijing, involving hundreds of Ministry of Public Security officers across the country.

[Dina Temple Rest]

That's when we come back. Stay with us.

[Joseph Cox]

Hey, I'm Joseph Cox, the host of another podcast I think you'll like the 404 Media Podcast. We're an independent news outlet covering the bleeding edge of technology and every week we discuss our latest stories. Whether that's how AI images are taking over Facebook and fooling people, how drugs are being sold on Instagram or the spread of AI enabled surveillance cameras. We hold tech to account. Catch me and the rest of the 404 Media gang, wherever you listen, just search for the 404 Media podcast. Chat to you soon.

[Dina Temple Rest]

Ji Feng Li is an independent researcher who focuses on China's hybrid operations and disinformation campaigns.

[Ji Feng Li]

You see them online, the narratives, the way they disseminate on social media, or how they micro target different type of audience.

[Dina Temple Rest]

Ji grew up in Hong Kong and was there on the ground for the 2019 protest and experienced firsthand how China weaponized information against demonstrators.

[Ji Feng Li]

Like, I've been analyzing them and I know what kind of, you know, techniques or tactics they're deploying. But still when you're on the ground, it's something else.

[Dina Temple Rest]

China flooded social media with tens of thousands of posts that focused on protester violence instead of what they were demonstrating for. They talked about how the students had become puppets of the west and how the disorder would come to hurt Hong Kong. It was all highly choreographed. And that was no accident. By 2019, China had put none other than the Ministry of Public Security, its main police authority, in charge of these kinds of information operations.

[Ji Feng Li]

The Ministry of Public Security's involvement signals a more severe level of repression. It indicates that the target or the situation itself is regarded as high priority, a national security threat to the Chinese authority. And it's also larger scale in terms of operations and often more aggressive in nature.

[Dina Temple Rest]

The spamouflage crew actually has a different name inside China. It's known as the 912 Special Project Working Group.

[Ji Feng Li]

They got a few duty teams. Sometimes during certain sensitive time periods, they will have more officers working on this. And they're operating in Dongcheng district, which is a district in Beijing.

[Dina Temple Rest]

And they work in shifts, apparently not just creating accounts, but hijacking existing ones and buying hacked accounts on the dark web. They tend to send a flurry of posts in the morning and early afternoon Beijing time.

[Ji Feng Li]

Basically, Beijing's time, working hours probably 9 to 5, 9 to 6, Monday to Friday with a lunch break.

[Dina Temple Rest]

The US isn't taking all of this lying down. Back in April, the Justice Department indicted 34 Chinese intelligence officers with the Ministry of Public Security. It was a bid to try to hold China accountable for its influence campaigns. But so far it doesn't seem to have had much impact. Their operations have continued to escalate, the.

[Ji Feng Li]

Scope is expanding and the targets they choose is high value. Targets that are influential on China related policies. Human rights activists, the Chinese diaspora communities who oppose Chinese policies and criticize Xi Jinping. And then earlier this year, used for interfering Taiwan elections.

[Dina Temple Rest]

Now the us which brings us back to Darren Linville over at Clemson and a discovery he made earlier this month. Spamouflage is targeting Marco Rubio again. By the way, we did reach out to the Senator for comment on all of this and he sent us a statement saying China is becoming increasingly more aggressive and needs to be taken very seriously. And then he added that China's goal is to shape American opinion on critical issues and target specific candidates, especially those they view as anti China. He said, people like Senator Rubio. This time around, spamouflage seems to be up to some of the same old tricks.

[Darren Linville]

In advance of the election, we've been monitoring conversations around a number of senators. And of course, even though Mark Rubio is not running for reelection this year, we saw a small number of accounts that were clearly automated, clearly connected to broader spamouflage campaigns.

[Dina Temple Rest]

Darren said there were some of the same tactics that he'd seen in 2022, and some new ones too. For example, it looks like they've started using AI. Also, the content wasn't supportive this time around. It was overtly critical. But this year, Rubio isn't even running, which just reinforced Darren's belief that this is not an attempt to influence an election, but rather just one more step in China's efforts to use elections as living labs to keep tweaking their new approaches.

[Darren Linville]

Sometimes you gotta throw us a lot of spaghetti at the wall and some of that spaghetti is gonna stick and some of it's not. And you gotta see what works.

[Dina Temple Rest]

And maybe the goal isn't to see what direct impact it might have on the outcome of, say, a political race. Maybe it's an attempt to interfere with something more basic to social media itself.

[Darren Linville]

They might again be trying to have some sort of effect on search engines or the algorithm and not on what you and I are seeing with our.

[Dina Temple Rest]

Own eyes or to see how algorithms respond when they do something.

[Darren Linville]

Exactly but even if it's not having an immediate effect, I think it's important that we, you know, try to have as full an understanding of what countries like China and Russia and Iran are doing, countries that do not have our best interest at heart.

[Dina Temple Rest]

Their efforts around the November election aren't limited to just targeting Marco Rubio. They seem also to be trying to just generally stir the pot and heighten tensions. They're creating accounts posing as American voters and soldiers posting about hot button issues like reproductive rights and the US Policy toward Israel. But if past is prologue, this is only the beginning.

[Darren Linville]

China gets a bad rap from some disinformation researchers. They suggest they don't have the cultural expertise, that they're not as sophisticated. But I think that just misidentifies what China is actually doing. And I think that anytime that we see something that we can attribute to a state actor, we need to talk about it.

[Dina Temple Rest]

This is Click here. Here are some of the top cyber and intelligence stories of the past week. We know about 10,000 soldiers of North Korea that they are preparing to send fight against us. On Thursday, Ukrainian President Volodymyr Zelensky said that North Korean soldiers are training in Russian military bases in order to help Moscow in its battle against Ukraine. According to South Korean media, some 1500 North Korean troops arrived in Russia earlier this month. Ukraine has already seen North Korean missiles and ammunition on the battlefield as President Vladimir Putin and Kim Jong Un strengthened their ties. Researchers say that the deployment of North Korean missiles in Ukraine have provided Pyongyang with invaluable intelligence, not just about how their missiles perform, but how Western anti missile systems fare against them in the same way. While North Korea is thought to have one of the largest militaries in the world, its troops lack combat experience. Fighting in Ukraine could remedy that.

[Darren Linville]

On that left foot, some danger here. Williams puts fight ahead. It's Nico Williams for the Spaniards.

[Dina Temple Rest]

Behind the scenes of last summer's UFO European Football Championship, Interpol quietly began stamping out illegal sports betting. They launched a global operation called Soga X and arrested some 5,000 people across 28 countries, recovering more than $59 million in illicit proceeds. The sting not only shut down thousands of illegal betting websites, but it unmasked scam centers and human trafficking operations and other money laundering schemes. In the Philippines, local authorities in Interpol broke up a scam center and rescued over 650 people held captive there. Game Freak, the developer behind the Pokemon franchise, has confirmed a massive data breach. The breach, now known online as the terror leak, occurred in August 2024. While the source of the leaks was hackers cracked into the systems over a Game Freak, and it appears they made off with thousands of names and email addresses of current and former employees. Also concept art for old games and details about upcoming games, including next year's Pokemon Legends. Pokemon is the third largest video game franchise in the world, behind Mario and Tetris, with more than 480 million games sold. Game Freak, for its part, announced that it had already rebuilt its servers and was beefing up security.

[Tim Harford]

Gotta catch em all okay.

[Jade Abdul Malik]

Today's episode was produced by Megan Dietry, Sean Powers, Erica Gaeda and me, Jade Abdul Malik. It was edited by Karen Duffin, back checked by Darren Ancrum, and contains original music by Ben Levingston with some other music from Blue Dot sessions. Our staff writer is Lucas Riley and our illustrator is Megan Gough. Martin Peralta is our sound designer and engineer. Click Here is a production of Recorded Future News. Tune in on Friday for Mic Drop, which features our favorite interview of the week. We'll have a new episode of Click Here on Tuesday. We'll see you then.

[Unknown]

If you're looking for a daily guide to cybersecurity news and policy, sign up for the Cyber Daily from Recorded Future News. It serves up the day's most interesting and important cyber stories from our sister publication the Record, and then aggregates all of the big cyber stories you might have missed from news outlets around the world. Just go to TheRecord Media and click on Cyber Daily to get all you need to know about the world of cybersecurity right in your inbox.