Operation Naval Gazing

On September 22, 2020, Facebook announced that it had taken down a cluster of fake assets on Facebook and Instagram that it attributed to individuals in China. The assets posted about a range of issues in Chinese, English, Filipino, and Indonesian, including a small volume of content on the U.S. 2020 election, but they showed a particular interest in maritime security, especially in the South China Sea. For this reason, we have dubbed this activity Operation Naval Gazing.

This is the second time that Facebook has attributed a takedown set to actors in China. In August 2019, the platform took down seven pages, three groups, and five accounts that mainly posted about the Hong Kong protests from a pro-China point of view; Facebook attributed that activity to “individuals associated with the Chinese government.” The latest takedown was larger and wider ranging, but it, too, primarily posted about regional issues from a pro-China perspective.

Before the takedown, Facebook shared a list of assets with Graphika for independent analysis.

Operation Naval Gazing enlarges our understanding of information operations emanating from China. Some of its content reflected Chinese messaging, both overt and covert, on issues such as the Hong Kong protests, Taiwan’s independence, and COVID-19. Other content promoted China’s position in its geopolitical rivalry with the United States, especially in the South China Sea. The operation’s use of covert assets to promote favored politicians - notably members of the Duterte family in the Philippines, and President Joko Widodo (“Jokowi”) in Indonesia - appears more novel. Its use of fake American accounts was also novel, but these assets were generally too rudimentary to establish a persona.

The operation began in late 2016 by posting about Taiwan; some of its posts attacked President Tsai Ing-Wen. In early 2018, it started posting about the Philippines with content that supported President Rodrigo Duterte and argued in favor of Chinese regional influence. Around the same time, it also created a collection of pages that focused more broadly on the South China Sea and defended China’s policies there. For a few months in late 2018, one page began posting in support of President Joko Widodo in Indonesia, shortly before Indonesia’s presidential election.

In 2019-2020, the operation began running accounts that posed as Americans and posted a small amount of content about the U.S. presidential election. Different assets supported President Donald Trump and his rival Joe Biden; one short-lived group supported former presidential candidate Pete Buttigieg. The operation did not single out either candidate for preferential treatment. Many of the accounts in this phase of the operation were barely active.

Throughout all of these phases, the operation kept returning to the theme of maritime security, especially the achievements of the Chinese Navy.

The operation used a number of techniques to disguise its fake accounts. Some stole their profile pictures from authentic individuals. Others used AI-generated profile pictures, a technique that is becoming increasingly prevalent in information operations around the world. The operation typically set up its accounts in small batches spread out over a few days and linked by stylistic features, such as the choice of profile picture or the location that they claimed. None of the accounts made large numbers of friends on Facebook.

The operation’s success in audience building was mixed. Two pages that focused on the Philippines attracted around 57,000 and 40,000 followers, respectively. A page that mainly posted about security in the South China Sea attracted 16,000. None of the other pages had more than 10,000 followers, and one, focused on criticizing Donald Trump, had none at all. Similarly, a group focused on the Philippines had over 51,000 members, but none of the operation’s other groups had more than 2,000, and the one dedicated to Buttigieg had only two - both run by the operation.

Naval Gazing showed little cross-platform activity. In addition to the assets on its own platform, Facebook found six Instagram accounts, four of which never posted. Graphika found one related high-confidence asset on Twitter and a handful of accounts on Chinese platforms. The operation did post its content in front of various different audiences, but it does not appear to have broken out of social media to be picked up by the mainstream media or other influencers.