The Chinese government has built up the world's largest known online disinformation operation and is using it to harass US residents, politicians, and businesses—at times threatening its targets with violence, a CNN review of court documents and public disclosures by social media companies has found.
The onslaught of attacks -- often of a vile and deeply personal nature -- is part of a well-organized, increasingly brazen Chinese government intimidation campaign targeting people in the United States, documents show.
The US State Department says the tactics are part of a broader multi-billion-dollar effort to shape the world's information environment and silence critics of Beijing that has expanded under President Xi Jinping. On Wednesday, President Biden is due to meet Xi at a summit in San Francisco.
Victims face a barrage of tens of thousands of social media posts that call them traitors, dogs, and racist and homophobic slurs. They say it's all part of an effort to drive them into a state of constant fear and paranoia.
Often, these victims don't know where to turn. Some have spoken to law enforcement, including the FBI -- but little has been done. While tech and social media companies have shut down thousands of accounts targeting these victims, they're outpaced by a slew of new accounts emerging virtually every day.
Known as "Spamouflage" or "Dragonbridge," the network's hundreds of thousands of accounts spread across every major social media platform have not only harassed Americans who have criticized the Chinese Communist Party, but have also sought to discredit US politicians, disparage American companies at odds with China's interests and hijack online conversations around the globe that could portray the CCP in a negative light.
Private researchers have tracked the network since its discovery more than four years ago, but only in recent months have federal prosecutors and Facebook's parent company Meta publicly concluded that the operation has ties to Chinese police.
Meta announced in August it had taken down a cluster of nearly 8,000 accounts attributed to this group in the second quarter of 2023 alone. Google, which owns YouTube, told CNN it had shut down more than 100,000 associated accounts in recent years, while X, formerly known as Twitter, has blocked hundreds of thousands of China "state-backed" or "state-linked" accounts, according to company blogs.
Still, given the relatively low cost of such operations, experts who monitor disinformation warn the Chinese government will continue to use these tactics to try to bend online discussions closer to the CCP's preferred narrative, which frequently entails trying to undermine the US and democratic values.
"We might think that this is confined to certain chatrooms, or this platform or that platform, but it's expanding across the board," Rep. Mike Gallagher, chairman of the House Select Committee on the CCP, told CNN. "And it's only a matter of time before it happens to that average American citizen who doesn't think it's their problem right now."
Trolling for a living
When trolls disrupted an anti-communism Zoom event organized by New York-based activist Chen Pokong in January 2021, he had little doubt who was responsible. The trolls mocked participants and threatened that one victim would "die miserably." Their conduct reminded Chen of repression by the government of China, where he spent nearly five years in prison for pro-democracy work.
But his suspicions about who was behind the interruption were solidified when the US Department of Justice charged more than 30 Chinese officials earlier this year with running a sprawling disinformation operation that had targeted dissidents in the US, including those in the Zoom meeting Chen says he hosted in 2021.
It was just one of multiple indictments the Justice Department unsealed in April exposing alleged Chinese government plots to target its perceived critics and enemies, while impugning the sovereignty of the United States. Two alleged Chinese operatives were charged with running an "undeclared police station" in New York City. Last year, another indictment outlined how Chinese agents allegedly tried to derail the congressional campaign of a Chinese dissident.
"They want to deprive my freedom of speech, so I feel like it's not only an attack on me," said Chen, who was ejected from his own meeting during the disruption. "They also attack America."
The DOJ complaint named 34 individual officers with China's Ministry of Public Security and published photographs of them at computers, allegedly working on the disinformation campaign known as the "912 Special Project Working Group." The operation, primarily based in Beijing, appears to involve "hundreds" of MPS officers across the country, according to an FBI agent's affidavit.
The complaint does not refer to the cluster of fake accounts as "Spamouflage," but private researchers and a spokesperson for Meta told CNN that the social media activity described by the DOJ is part of that network. As part of a mission "to manipulate public perceptions of [China], the Group uses its misattributed social media accounts to threaten, harass and intimidate specific victims," the complaint states.
When asked about Spamouflage's reported links to Chinese law enforcement, a spokesperson for China's embassy in Washington, Liu Pengyu, denied the allegations.
"China always respects the sovereignty of other countries. The US accusation has no factual evidence or legal basis. It is entirely politically motivated. China firmly opposes it," Liu said in a statement to CNN. He claimed that the US "invented the weaponizing of the global information space."
A report released by Meta in August illustrates how the posts from the network often align with the workday hours in China. The report described "bursts of activity in the mid-morning and early afternoon, Beijing time, with breaks for lunch and supper, and then a final burst of activity in the evening."
And while Meta detected posts from various regions in China, the company and other researchers have found centralized coordination that relentlessly pushed identical messages across multiple social media platforms, sometimes repeatedly insulting the same individuals who have questioned the Chinese government.
One of those individuals is Jiayang Fan, a journalist for The New Yorker who told CNN she began facing harassment by the network when she covered pro-democracy protests in Hong Kong in 2019.
Attacks directed at Fan -- which ranged from cartoons of her painting her face white as though rejecting her identity to accusations that she killed her mother for profit -- carry telltale signs of the Spamouflage network, said Darren Linvill of the Media Forensics Hub at Clemson University. Linvill's group found more than 12,000 tweets attacking Fan using the same hashtag, #TraitorJiayangFan.
Although she hasn't lived in China since she was a child, Fan believes such messages have been levelled against her to spark fear and silence others.
"This is part of a very old Chinese Communist Party playbook to intimidate offenders and aspiring offenders," said Fan, who questioned what her distant relatives in China may think when they see such content. "It is uncomfortable for me to know that they are seeing these portrayals of me and have no idea what to believe."
Evolving tactics
Experts who track online influence campaigns say there are signs of a shift in China's strategy in recent years. In the past, the Spamouflage network mostly focused on issues domestically relevant to China. However, more recently, accounts tied to the group have been stoking controversy around global issues, including developments in the United States.
Spamouflage accounts -- some of which posed as Texas residents -- called for protests of plans to build a rare-earths processing facility in Texas and spread negative messages about a separate US manufacturing company, according to a report by cybersecurity firm Mandiant last year. The report also described how the campaign promoted negative content about the Biden administration's efforts to hasten mineral production that would curb US reliance on China.
Other posts by the network have referenced how "racism is an indelible shame on American democracy" and how the US committed "cultural genocide against the Indians," according to a Meta report in August. Another post claimed that former House Speaker Nancy Pelosi is "riddled with scandals."
Chinese government-linked accounts have also posted messages that included a call to "kill" President Biden, a cartoon featuring the so-called QAnon Shaman who rioted at the US Capitol as a symbol of "western style democracy," and a post that suggested US defense contractors profit off the deaths of innocent people, according to a Department of Homeland Security report in April obtained through a records request.
The DOJ complaint filed against Chinese officials alleged that last year they sought to take advantage of the second anniversary of George Floyd's death and post on social media about his murder to "reveal the law enforcement brutality" in the US. They also received a task to "work on 2022 US midterm elections and criticize American democracy."
Spamouflage is "evolving in tactics. It's evolving in themes," said Ben Nimmo, the global lead for threat intelligence at Meta. "Our job is to keep on raising our defenses and keep on telling people about it, especially as we get closer to the election year."
Yet as social media companies race to stop disinformation and the US government files complaints against those allegedly responsible, accountability can be elusive.
"This is the rub with a lot of cybercrimes, that it becomes very, very difficult to actually put the perpetrators in jail," said Lindsay Gorman, the head of technology and geopolitics at the German Marshall Fund's Alliance for Securing Democracy.
But, Gorman added, that doesn't mean there are no consequences for China.
"Even if individuals have a degree of impunity because they are never planning on coming to the United States anyway, that doesn't mean that the party operation has impunity here -- certainly not in terms of public opinion, certainly not in terms of US-China relations," she said.
'Flooding' social media
Meta, Google, and other companies that have published reports outing Spamouflage stress that most of the social media accounts within the network receive little or no engagement, meaning they rarely go viral.
But Linvill of Clemson University argues that the network uses a unique strategy of "flooding" conversations with so many comments that posts from genuine users receive less attention. This includes posting on platforms typically not associated with disinformation, such as Pinterest.
"They are operating thousands of accounts at a time on a given platform, often to drown out conversations, just with sheer volume of messaging," Linvill said. "When we think of disinformation, we often think of pushing ideas on users and making ideas more salient, whereas what China is doing is the opposite. They are trying to remove conversations from social media."
When Beijing hosted the 2022 Winter Olympics, for example, human rights groups began promoting the hashtag #GenocideGames to bring attention to accusations that China has detained more than a million Uyghurs and other Muslim minorities in internment camps.
But then something surprising happened. Accounts that Linvill and his colleagues believed were part of Spamouflage started tweeting the hashtag too.
It might be counterintuitive for a pro-Chinese government group to start spreading a hashtag that brought attention to the Chinese government's human rights' abuses, Linvill explained. But by using the hashtag repeatedly in tweets that had nothing to do with the issue itself, Spamouflage was able to reduce views on the legitimate messages.
Jiajun Qiu, whose academic work focused on elections and who fled China in 2016, showed CNN what happens when he types his name into X, formerly known as Twitter. There are sometimes dozens of accounts pretending to be him by using his name and photo.
They are designed by the operators of Spamouflage, Linvill explained, to confuse people and prevent them from finding Qiu's real account by muddying the waters.
Now living in Virginia, Qiu runs a pro-democracy YouTube channel and has faced an onslaught of homophobic, racist and bizarre insults from social media accounts that Linvill's team and others have tied to Spamouflage.
Some accounts have posted cartoons that convey Qiu as an insect working on behalf of the US government. Another image depicts him being stomped by a cartoon Jesus. Yet another paints him as a dog on the leash of an American rat.
"I tell people the truth, so they want to do anything possible to insult me," Qiu said.
Linvill and his team have tracked hundreds of these cartoons across the internet, and said they are a "tell" of Spamouflage. Cartoons, Linvill explained, can be more effective than text because they are "eye-catching" and "you have to stop and look at it." In addition, these original cartoons can easily be translated into hundreds of languages at a very low cost.
Beyond the online smears, Qiu says he has also faced threats via other online messages and escalatory calls from unidentified sources who he believes have ties to the Chinese government. One anonymous message told him he would be arrested and brought to justice for breaking Chinese law. An email referenced the church he attends in Manassas, Virginia and said, "for his own safety and that of the worshippers, he would do well to find another place to stay."
Qiu told CNN that the FBI has interviewed him four times regarding these threats, and that he has been instructed to contact local police if he is ever followed.
"Every day I live in a sense of fear," Qiu said.