Twitter has permanently removed over 32,000 state-linked accounts which were part of three distinct operations from China, Russia, and Turkey spreading political propaganda favourable to the ruling government of these countries, and critical of dissidents and protesters. The accounts were suspended for various violations of Twitter’s platform manipulation policies.

Anti-Hong Kong protest content, regimented tweets showed accounts were suspicious

150,000 amplifier accounts also removed: From China, 23,750 accounts comprising of the “highly engaged core network” were deleted. Twitter said these were “largely caught early and failed to achieve considerable traction on the service” with few followers and engagement. In addition, 150,000 “amplifier” accounts that were boosting this content were removed. A majority of these accounts had little to no follower counter and were strategically designed to “artificially inflate impression metrics and engage with the core accounts”.

Put together, both sets of accounts were tweeting predominantly in Chinese languages and spreading geopolitical narratives favourable to the Chinese government, while pushing “deceptive narratives about the political dynamics in Hong Kong”.

Who the network targeted: While Twitter is blocked in China, researchers at the Australian Strategic Policy Institute found that the campaign was targeted at Chinese-speaking people outside the country “with the intention of influencing perceptions on key issues, including the Hong Kong protests, exiled Chinese billionaire Guo Wengui and, to a lesser extent Covid-19 and Taiwan”.

Active period: Tweets were posted at Beijing working hours and dropped off on weekends “clearly suggested coordination and inauthenticity”.

Content was anti- Hong Kong protesters and exile Chinese businessman:

  • Tweets targeted at Hong Kong were about accusations of protesters being violent, demands to support the Hong Kong police, and allegations of US interference.
  • Those about Wengui focussed on his relationship with former White House strategist and right-wing media executive Steve Bannon, and contained accusations of him being a liar, immoral, and a rapist.
  • The investigation also found that this operation has shifted focus to incorporate current US domestic protests and civil unrest within pro-China narratives.

Roughly a thousand accounts connected to Current Policy posted pro-Putin pro-Krelim content

In Russia, 1,152 accounts and their media, associated with media website Current Policy, “a group of social-media accounts primarily engaged in publishing pro-Kremlin, anti-opposition, and anti-Western content”, according to the Stanford Internet Observatory. This network was crossposting and amplifying content with the goal of promoting the United Russia party and attacking political dissidents “in an inauthentic, coordinated manner”.

  • Several of the accounts purported to represent official government offices, such as the Moscow Construction Bureau and the Voronezh branch of the United Russia party. Others were purported to represent United Russia politicians, including members of the Duma and the Moscow City Duma.
  • One of the accounts posed as a polling company “independently studying Russian public opinion” and used leading questions to elicit pro-government and anti-opposition responses.

Many of the most popular accounts “were involved in a commercial operation called twishop that sold retweets and tweeted links“. However, they ranged from humour to photography accounts and were typically not politically engaged.

Turkey: tweets included promoting a referendum that consolidated Erdogan’s power

A network of 7,340 “fake and compromised” accounts from Turkey were removed for amplifying narratives favourable to AK Parti (the ruling Justice & Development Party) and showed support for President Erdogan. The network also includes a significant number of compromised accounts associated with organisations critical of the Erdogan and the ruling government. “These compromised accounts have been repeated targets of account hacking and takeover efforts by the state actors identified above. The broader network was also used for commercial activities, such as cryptocurrency-related spam,” Twitter said. According to the Stanford Internet Observatory’s analysis:

  • Some of the suspended accounts were linked to organizations that were critical of the government. According to Twitter, they are included in the takedown because their accounts were compromised by this network.
  • Tweets promoted the 2017 Turkish constitutional referendum, which consolidated power in Turkish President Recep Tayyip Erdoğan.
  • Tweets were critical of the Peoples’ Democratic Party (HDP) and accused it of terrorism and social media ploys. Tweets were also critical of the Republican People’s Party (CHP).