Chinese Cyber-Operatives Boosted Taiwan’s Insurgent Candidate

When a pro-Beijing Taiwanese politician won an upset victory in the city of Kaohsiung last year, his supporters credited it to his charisma, political savvy, and tempting promises of richness and economic wealth from China. Barely six months into office, Kaohsiung Mayor Han Kuo-yu is already eyeing a run for the presidency in 2020 and is seen as the godsend that Beijing has been waiting for: the emergence of a populist, pro-China candidate in Taiwan.

But Han’s rise from obscurity to superstardom had a little help: a campaign of social media manipulation orchestrated by a mysterious, seemingly professional cybergroup from China. As Taiwan’s presidential elections approach, with Han as one of the front-runners for the opposition Kuomintang (KMT) party, just who is surreptitiously backing him—and why—is a matter of critical importance.

On Nov. 24, 2018, President Tsai Ing-wen’s ruling Democratic Progressive Party (DPP), which has been putting off China’s demands for unification, suffered a landslide defeat in the local elections, losing 12 out of Taiwan’s 18 cities and counties to the KMT.

Even before Election Day, there were already strong suspicions of Chinese interference, which the New York Times described as the “specter of meddling.” In the following months, various reports and allegations prompted six U.S. senators to write a letter to Secretary of State Mike Pompeo and FBI Director Christopher Wray in December 2018 asking them to investigate and respond to China’s election-meddling capability. But specific evidence was rarely, if ever, offered.

Tsai was already unpopular in 2018, with her approval rating plummeting from its high point of 70 percent in 2016 to below 30 just before the election. The decline was attributed to a series of controversial domestic reforms and by some accounts her ineffective communication and leadership style.

But few expected the DPP would lose Kaohsiung—the southern city of 2.8 million people was where the DPP won its first administrative foothold in 1998. The DPP has dominated the city for two decades, culminating in the 2014 local elections, when it routed the disorganized KMT, winning 68 percent of the vote. The DPP candidate for the 2018 race was Chen Chi-mai, an experienced, if somewhat bland, legislator.

In contrast, Han Kuo-yu was an initially puzzling choice for the KMT, an outsider to Kaohsiung politics whose pro-China rhetoric seemed out of touch with the city’s fierce pro-independent ethos. The KMT party establishment disliked Han, whom they considered an upstart, and only nominated him because it was considered a long-shot race, according to a KMT insider with knowledge of the matter.

Many observers compared Han to U.S. President Donald Trump, especially with his “Make Kaohsiung rich and great” slogan. How would he deliver that? The answer was always China. Sell more of Kaohsiung’s vegetable and fruit products to China, bring in more Chinese tourists, don’t say things Beijing doesn’t want to hear, and the cash will flow in naturally and magically. Han also made off-the-cuff remarks that often earned him accusations of sexism and harboring prejudice against minorities.

But unlike Trump, who was a celebrity businessman before he became president, Han was a largely unknown name until late in the summer of 2018, barely four months before the voting date. Observers watched in awe as Han started his meteoric rise through the polls, and by November he had extinguished the 20-something percent lead the DPP once held.

Weighted aggregate poll data. Source: Taiwanese opinion poll analysis website tsjh301.blogspot.com.

The unexpected emergence of the “Han wave” surprised even the KMT, and Han’s popularity spilled over to many parts of Taiwan. The DPP’s political machine and grassroots in Kaohsiung scrambled to help Chen’s campaign. But by then it was too late: Han eventually won with a solid 892,000 votes, or 53 percent versus Chen’s 44 percent, a record for a KMT candidate in Kaohsiung.

Han’s overwhelming presence swept across the internet and social media. Big data firms such as the Taiwan Public Opinion Center cited this digital campaign as having played a critical role in propelling him to victory. For example, it was estimated that news related to Han consistently solicited “community engagements” (an aggregate of likes, comments, and shares across the internet) many times more than all other KMT candidates combined. Online presence is extremely important in Taiwan, a highly connected society, where how loud a candidate’s digital voice is can be a critical factor in electoral success.

At a glance, it would appear as if a populist candidate, riding on an incumbent president’s unpopularity, defied unfavorable electoral odds through his charisma and the sheer power of social media. That’s not an uncommon story.

But that’s not the whole of the tale here.

A screenshot from December 2018 showing the unofficial Han Kuo-yu fan group created on April 10.

But another group played a critical role in the campaign. A Facebook group named “Han Kuo-yu Fans For Victory! Holding up a Blue Sky!” was created on April 10, 2018, just one day after Han declared his candidacy for the Kaohsiung mayoral race. At the time he was little more than an obscure footnote in Taiwan’s politics; only a few dozen supporters showed up at his first rally.

As the campaign gained momentum, the group soon grew to become the largest unofficial community page for Han’s die-hard fans on Facebook, with a total of more than 61,000 members by the election in November. (It currently has 88,000 members.) Users promoted Han through posting talking points, memes, and very often fake news attacking Han’s opponent Chen, the DPP government, and anyone who said a bad word about Han.

Thousands of such posts were shared through the group during the campaign, making it a hub for Han supporters to create, disseminate, and amplify weaponized information in their respective corner of social media, messaging apps, friend circles, or the family dinner table. Fake news originating from this group often made its way to Line, a WhatsApp-alike messaging app used by most digitally connected Taiwanese.

Their menacing effects did not go unnoticed by the DPP’s Chen, whose campaign held a press conference denouncing and threatening to sue a few specific users of the group for spreading obviously fake news. One particularly prolific user, Chen’s campaign alleged, could be traced back to an “overseas IP address.” A close aide to Chen confirmed to me, however, that their campaign did not attempt to track down who created the unofficial fan group in the first place.

As it turned out, the group was not spontaneously created by Han’s fans. It was created, managed, and nurtured by what looks very much like a professional cybergroup from China.

The group page listed six administrators in November 2018. Two of them, under the usernames “Fang Jianzhu” and “Yun Chi,” are listed as having joined the group on April 10, 2018, when it was first launched by Fang. Another admin, “Chen Geng,” joined on April 18, while all the others joined many months later. Fang, Yun, and Chen apparently had the foresight to create a fan group for Han months before he became a viral hit.

Except that wasn’t a coincidence. I identified three profiles on the professional networking site LinkedIn that corresponded to the same Chinese names as Fang’s, Yun’s, and Chen’s.

All three LinkedIn profiles identified themselves as employees of Tencent—China’s giant technology and social media company, which owns the world’s largest messaging app, WeChat, and which cooperates closely with the Chinese government in enforcing censorship and mass surveillance. The three also all claim to be graduates of China’s Peking University, and two of them describe themselves as having “worked in public relations for many foreign companies.”

Names of three administrators and original creators of the Han fan group on Facebook also appear on LinkedIn, where they identified themselves as employees of Tencent. Two of them have bios that say, “Worked in public relations for many foreign companies.”

Of course, there’s no evidence other than their own claim that the creators of these profiles actually worked for Tencent. But a search for this very specific Chinese phrase “worked in public relations for many foreign companies” (在多家外企做过公关) yielded a further 249 search results on LinkedIn—every single one sharing identical characteristics, including mugshot-style photos cropped from decades-old graduation pictures and claims of being Tencent employees and Peking University graduates. This particular search phrase ceased to work on LinkedIn in late May, but many of the profiles are still searchable through Google.

The profiles have some tell-tale signs of being fakes. Several of them use the same photo, but a different name, and most have few and sometimes no LinkedIn connections at all. And all of them use simplified Chinese characters, instead of the traditional Chinese used in Taiwan.

I first discovered the connection in December 2018 and have been observing their activities since then. All three Facebook profiles in question appear to have gone dormant and haven’t posted anything since Nov. 24, 2018. The fan group page on Facebook has taken on a life of its own since the election—now, it seems to be managed by a handful of other active administrators with uncertain connection with Fang, Yun, and Chen.

It’s unclear how the Facebook group went from a handful of members to its current numbers. Part of it was undoubtedly Han’s own charisma driving interest in his campaign. But it’s also likely that the administrators paid to promote the group on Facebook, where Chinese state media has also brought itself a considerable presence.

A collection of screenshots from LinkedIn search results show some of the 249 profiles identified as belonging to an unnamed Chinese cybergroup.

The cybergroup’s use of simplified Chinese and the way in which the profiles were set up provide critical clues to their origin, according to an expert surnamed Chu, the executive director of a major social media marketing company in Taiwan, who wishes to remain anonymous. Chu said that LinkedIn has a very limited presence and user base in Taiwan, and the group’s extensive presence there suggests they are unlikely to be Taiwanese. Citing his knowledge of the industry, Chu said he does not know of any social media marketing firm in Taiwan—even those he knew that were hired by the KMT, that would have operated this same way this particular group did.

LinkedIn is known to be one of Beijing’s favorite playgrounds for conducting espionage and influence operations. Both U.S. and German intelligence agencies have documented numerous cases of suspected Chinese spies exploiting the networking site for intelligence purposes. Their favorite technique is to create mass fake accounts and identities—sometimes hundreds if not thousands of them—and use them to approach and recruit unsuspecting targets (often Western nationals) who would then leak secrets or become assets for Chinese intelligence handlers in the real world.

Ying-Yu Lin, an assistant professor at Taiwan’s National Chung Cheng University and an expert on the Chinese military, believes the cybergroup can be traced back to the Strategic Support Force (SSF) of China’s army. The SSF was created in December 2015 as part of a massive military reorganization initiated by Chinese President Xi Jinping, and it was made into an independent branch of the Chinese military that is now charged with conducting a wide range of operations including space, cyber, and electronic warfare. Citing a report by the U.S. cybersecurity firm FireEye last year, Lin said that Chinese cyberespionage activities heated up in late 2018, as a number of major Chinese hacker groups were observed to have returned to active duty after a few years of being dormant during the army’s reorganization.

If Lin is correct, this would be the first confirmed case of China’s new cyberforce attempting to influence foreign elections. U.S. experts on the Chinese military previously warned that the reorganized SSF could become Beijing’s favorite tool to unleash a new generation of informational and psychological warfare against foreign adversaries, learning from Russia’s interference in the 2016 U.S. presidential election.

But another expert has a different assessment. A psychological operations officer serving with the Political Warfare Bureau under Taiwan’s Ministry of National Defense who uses the pen name “Lieutenant Ho” believes this particular cybergroup was likely a private team contracted through a Chinese company rather than being a dedicated military or intelligence unit in itself—albeit with the Chinese government ultimately pulling the strings.

“They put in little effort to clean up the digital traces after the job was done; this could suggest whoever contracted them in the first place didn’t give out such instructions, or maybe they never saw the need for doing so,” Ho said. “This could explain why they used Tencent as a cover on LinkedIn, because the name of a big Chinese company can allow them to fool people elsewhere.”

This would not be the first time that Beijing has attempted to manipulate Taiwanese social media, Ho said. Though he cannot reveal his full name due to being in active service in Taiwan’s military, Ho has published articles in Taiwan’s the News Lens criticizing the passiveness and ineffectiveness of Taiwan’s defense against information and psychological warfare waged by China.

Ho and his colleagues tracked down a number of Facebook pages and content farms made to look like Taiwanese ones but that were assessed to be operated by the Chinese Communist Party’s Publicity Department. These findings were never disclosed to the public by Taiwan’s high leadership even after they were duly reported within the system. Mysteriously, those Facebook pages soon changed talking points and partisan stance and looked nothing like they did before, Ho revealed in one article.

But Lin, Ho, and other experts believe these are merely the tip of the iceberg in China’s massive interference operations in Taiwan’s local elections last year. They say there were many other groups, pages, content farms, and platforms out there beyond Facebook that Beijing used to propel Han to electoral success

There is no evidence Han himself colluded with this group or any other. But he was certainly aware that his support online was somewhat mysterious. “I don’t know who they are, but I thank them for the support,” was Han’s standard response to the accusations that unknown digital forces possibly originating in China were driving his campaign and popularity.

Han Kuo-yu is officially in the race for the KMT’s presidential primary for 2020 election, where his main competitor is Terry Gou, Taiwan’s richest man and the owner of Foxconn, which manufactures iPhones in China for Apple. If he is successful in gaining the nomination, he will face off against DPP President Tsai Ing-wen in the general election next January. High-level U.S. officials have already publicly warned that China will again interfere, even specifically citing social media as a battleground. The question is: Will Taiwan be able to do anything about it?