Facebook Took Down a China-Linked COVID-19 Disinformation Campaign

On July 24 of this year, a Facebook user who claimed to be a Swiss biologist called Wilson Edwards wrote a post criticizing the US government for allegedly intimidating the World Health Organization to keep investigating the origins of COVID-19 in China. 

“WHO sources and a number of fellow researchers complained that they had endured enormous pressure and even intimidation from the U.S. side,” Edwards wrote in the post, according to a screenshot provided by Facebook. “The WHO sources told me that the U.S. is so obsessed with attacking China on the origin-tracing issue that it is reluctant to open its eyes to the data and findings.”

Except Edwards never actually existed. It was a fake account. Today, Facebook announced that Edwards was part of a coordinated campaign to spread disinformation on the platform using more than 500 fake accounts, 20 pages, four groups, and 86 Instagram accounts, according to a new report published on Wednesday. 

The company said that it was mostly fake accounts that engaged with the Edwards post. But before those fake accounts got involved, just an hour after the original post, “a number of Chinese government officials began interacting with the operation’s content.” 

Then other real people, including some working for a Chinese cybersecurity company called Sichuan Silence Information Technology, as well as people “associated with Chinese state infrastructure companies around the world,” liked and shared the Edwards post up to 12 hours before the fake accounts started amplifying it, according to Facebook.

“This is the first time we've seen an operation that included a coordinated cluster of state employees amplifying itself in this way,” Ben Nimmo, Facebook’s information operations threat intelligence lead, said in a call with reporters. 

Nimmo and his colleagues stressed that they are not linking this campaign to the Chinese government or these officials, but only that they saw government officials liking and engaging with the fake post. 

Facebook wrote in the report that they removed the Edwards account on August 10, when the Swiss Embassy in Beijing announced there was no record of a Wilson Edwards. A Facebook spokesperson said that many fake accounts were disabled between then and November by “automated systems,” and the rest were removed during the month of November. This means the account was up for weeks before it was actioned on.

While this disinformation campaign, in itself, did not go viral, it still ended up prompting news articles, and, generally speaking, acting on disinformation campaigns weeks after they were originally posted isn't ideal. This is because many viral posts end up going viral in the minutes or hours after they were posted, before their virality peters out and the news cycle moves on. And other disinformation related to COVID-19 campaigns on Facebook in the past have gone viral. Last year, the infamous “Plandemic” conspiracy video got 20 millions views in one day on Facebook. It has been so bad on Facebook that a group of more than 500 doctors demanded the company to publish data on the breadth of COVID-19 disinformation on its platform.   

The Chinese embassy in Washington D.C. did not immediately respond to a request for comment. 

Sichuan Silence Information Technology could not be reached for comment.

Despite the initial low impact of the disinformation campaign, the Edwards post was picked up by some Chinese state-run news organizations such as Global Times and People’s Daily: "COVID-19 Origin Tracing: Claim emerges of 'intimidation' from the U.S.," headlines stated.

“When you strip out the fake amplification, the original fake account got almost no organic engagement. Almost all the likes and shares we looked at came from the operation. So effectively, they were working in a bubble,” Nimmo said. “Yet somehow less than a week after it was created. The original fake account, the fake Swiss biologist, was being quoted by the Chinese state media. And it's only then that its story really took off, at least briefly.”

The Edwards campaign was at times incredibly sloppy. Two days after the Edwards post, an account in Indonesia shared the post and a link to a Yahoo News article, along with instructions about the disinformation campaign.

“Leaders and colleagues: Please link and forward the following content on overseas social media accounts, and feedback and disseminate by 15:00 tomorrow (July 26),” the post read, according to the report.

Facebook also announced that it shut down a disinformation network in France and Italy that spread anti-vaccination disinformation, intimidated and harassed users who promoted COVID vaccines, and called doctors and journalists “Nazi supporters” for promoting vaccines. The network, according to the company, was linked to the anti-vaccination conspiracy movement known as “V_V.” 

The company also detailed three other large disinformation campaigns in Palestine, Poland, and Belarus. 

And Facebook anticipates there will be many more in the future. 

“We build our defenses with the expectation that adversarial groups will not stop, but rather adapt and try new tactics to persist,” the report read. “Our goal over time is to make these behaviors more costly and difficult to hide, and less effective.” 

Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.