A new Sino-Russian high-tech partnership

Authoritarian innovation in an era of great-power rivalry

What’s the problem?

Sino-Russian relations have been adapting to an era of great-power rivalry. This complex relationship, categorised as a ‘comprehensive strategic partnership of coordination for a new era’, has continued to evolve as global strategic competition has intensified.1 China and Russia have not only expanded military cooperation but are also undertaking more extensive technological cooperation, including in fifth-generation telecommunications, artificial intelligence (AI), biotechnology and the digital economy.

When Russia and China commemorated the 70th anniversary of the establishment of diplomatic relations between Soviet Union and the People’s Republic of China in October 2019,2 the celebrations highlighted the history of this ‘friendship’ and a positive agenda for contemporary partnership that is pursuing bilateral security, ‘the spirit of innovation’, and ‘cooperation in all areas’.3

Such partnerships show that Beijing and Moscow recognise the potential synergies of joining forces in the development of these dual-use technologies, which possess clear military and commercial significance. This distinct deepening of China–Russia technological collaborations is also a response to increased pressures imposed by the US. Over the past couple of years, US policy has sought to limit Chinese and Russian engagements with the global technological ecosystem, including through sanctions and export controls. Under these geopolitical circumstances, the determination of Chinese and Russian leaders to develop indigenous replacements for foreign, particularly American technologies, from chips to operating systems, has provided further motivation for cooperation.

These advances in authoritarian innovation should provoke concerns for democracies for reasons of security, human rights, and overall competitiveness. Notably, the Chinese and Russian governments are also cooperating on techniques for improved censorship and surveillance and increasingly coordinating on approaches to governance that justify and promote their preferred approach of cyber sovereignty and internet management, to other countries and through international standards and other institutions. Today’s trends in technological collaboration and competition also possess strategic and ideological implications for great-power rivalry.

What’s the solution?

This paper is intended to start an initial mapping and exploration of the expanding cooperative ecosystem involving Moscow and Beijing.4 It will be important to track the trajectory and assess the implications of these Sino-Russian technological collaborations, given the risks and threats that could result from those advances. In a world of globalised innovation, the diffusion of even the most sensitive and strategic technologies, particularly those that are dual-use in nature and driven by commercial developments, will remain inherently challenging to constrain but essential to understand and anticipate.

  • To avoid strategic surprise, it’s important to assess and anticipate these technological advancements by potential adversaries. Like-minded democracies that are concerned about the capabilities of these authoritarian regimes should monitor and evaluate the potential implications of these continuing developments.
  • The US and Australia, along with allies and partners, should monitor and mitigate tech transfer and collaborative research activities that can involve intellectual property (IP) theft and extra-legal activities, including through expanding information-sharing mechanisms. This collaboration should include coordinating on export controls, screening of investments, and restrictions against collaboration with military-linked or otherwise problematic institutions in China and Russia.
  • It’s critical to continue to deepen cooperation and coordination on policy responses to the challenges and opportunities that emerging technologies present. For instance, improvements in sharing data among allies and partners within and beyond the Five Eyes nations could be conducive to advancing the future development of AI in a manner that’s consistent with our ethics and values.
  • Today, like-minded democracies must recognise the threats from advances in and the diffusion of technologies that can be used to empower autocratic regimes. For that reason, it will be vital to mount a more unified response to promulgate norms for the use of next-generation technologies, particularly AI and biotech.

Background: Cold War antecedents to contemporary military-technological cooperation

The history of Sino-Russian technological cooperation can be traced back to the early years of the Cold War. The large-scale assistance provided by the Soviet Union to China in the 1950s involved supplying equipment, technology and expertise for Chinese enterprises, including thousands of highly qualified Soviet specialists working across China.5 Sino-Russian scientific and technical cooperation, ranging from the education of Chinese students in the Soviet Union to joint research and the transfer of scientific information, contributed to China’s development of its own industrial, scientific and technical foundations. Initially, China’s defence industry benefited greatly from the availability of Soviet technology and armaments, which were later reverse-engineered and indigenised. The Sino-Soviet split that started in the late 1950s and lasted through the 1970s interrupted those efforts, which didn’t resume at scale until after the end of the Cold War.6

Russia’s arms sales to China have since recovered to high levels, and China remains fairly reliant upon certain Russian defense technologies. This is exemplified by China’s recent acquisition of the S-400 advanced air defence system,7 for which China’s Central Military Commission Equipment Development Department was sanctioned by the US.8 Traditionally, China has also looked to Russia for access to aero-engines.9 Today, China’s tech sector and defence industry have surpassed Russia in certain sectors and technologies. For instance, China has developed unmanned aerial vehicles (UAVs) that are far more advanced than those currently operational in Russia.10 Nonetheless, the Russian military has been unwilling to acquire Chinese UAVs, instead deciding to attempt to develop indigenous counterparts in mid-range and heavy unmanned combat models.11 Nonetheless, for Russia, nearto mid-term access to certain Chinese products, services and experience may become the very lifeline that Russia’s industry, government and military will require in order to wean themselves off high-tech imports12, although even that approach may be challenged by limited availability of Chinese components.13

Underscoring the apparent strength of this evolving relationship, China and Russia have recently elevated their military-to-military relationship. In September 2019, the Russian and Chinese defence ministers agreed to sign official documents to jointly pursue military and military–technical cooperation.14 According to the Russian Defence Minister, ‘the results of the [bilateral] meeting will serve the further development of a comprehensive strategic partnership between Russia and China.’15

Reportedly, Russia plans to aid China in developing a missile defense warning system, according to remarks by President Putin in October 2019.16 At the moment, only the United States and Russian Federation have fully operationalized such technology, and according to Moscow, sharing this technology with Beijing could ‘cardinally increase China’s defense capability’.17 For China, access to Russian lessons learned in new conflicts such as Syria may prove extremely valuable as Beijing digests key data and lessons.18 Of course, this technological cooperation has also extended into joint exercises, including joint air patrols and naval drills.19

A strategic partnership for technological advancement

The strategic partnership between China and Russia has increasingly concentrated on technology and innovation.20 Starting with the state visit of Xi Jinping to Moscow in May 2015, in particular, the Chinese and Russian governments have signed a series of new agreements that concentrate on expanding into new realms of cooperation, including the digital economy.21 In June 2016, China’s Ministry of Science and Technology and Russia’s Ministry of Economic Development signed the ‘Memorandum of Understanding on Launching Cooperation in the Domain of Innovation’.22 With the elevation of the China–Russia relationship as a ‘comprehensive strategic partnership of coordination for a new era’, the notion of these nations as being linked in a ‘science and technology cooperation partnership for shared innovation’ (作共同创新的科技合作伙伴) has been elevated as one of the major pillars of this relationship.23

To some degree, this designation has been primarily rhetorical and symbolic, but it has also corresponded with progress and greater substance over time. The Chinese and Russian governments have launched a number of new forums and mechanisms that are intended to promote deeper collaboration, including fostering joint projects and partnerships among companies. Over time, the Sino-Russian partnership has become more and more institutionalised.24 This policy support for collaboration in innovation has manifested in active initiatives that are just starting to take shape.

This section outlines five areas where the Sino-Russian relationship is deepening, including in dialogues and exchanges, the development of industrial science and technology (S&T) parks, and the expansion of academic cooperation.

Dialogues and exchanges

Concurrently, a growing number of dialogues between Chinese and Russian governments and departments have attempted to promote exchanges and partnerships, and those engagements have also become particularly prominent since 2016. While the initiatives listed below remain relatively nascent, these new mechanisms constitute a network of science, technology, engineering and mathematics (STEM) cooperation that could continue to expand in the years to come and provide the two countries with new vehicles for engagement and information sharing across their respective scientific communities.

  • Starting in 2016, the Russian–Chinese High-Tech Forum has been convened annually. During the 2017 forum, both sides worked on the creation of direct and open dialogue between tech investors of Russia and China, as well as on the expansion and diversification of cooperation in the field of innovations and high technologies.25 During the 2018 forum, proposed initiatives for expanded cooperation included the introduction of new information technologies. This forum wasn’t merely a symbolic indication of interest in cooperation but appeared to produce concrete results, including the signing of a number of bilateral agreements.26 In particular, the Novosibirsk State University of Architecture and Civil Engineering signed an agreement with Chinese partners on the development of technologies for construction and operation in cold conditions.27 The specific projects featured included China’s accession to the Russian project of a synchrotron accelerator.28
  • Beginning in 2017, the Sino-Russian Innovation Dialogue has been convened annually by China’s Ministry of Science and Technology and Russia’s Ministry of Economic Development.29 In the first dialogue, in Beijing, more than 100 Chinese and Russian enterprises participated, from industries that included biomedicine, nanotechnology, new materials, robotics, drones and AI, showcasing their innovative technologies and concluding new agreements for cooperation. During the second dialogue, in Moscow, the Russian and Chinese governments determined the 2019–2024 China–Russia Innovation Cooperation Work Plan.30 Each country regards the plan as an opportunity for its own development, as it combines the advantages of China’s industry, capital and market with the resources, technology and talents of Russia.31 Contemporaneously, forums have been convened in parallel on ‘Investing in Innovations’ and have brought together prominent investors and entrepreneurs.32 When the third dialogue was convened in Shanghai in September 2019, the agenda included a competition in innovation and entrepreneurship, a forum on investment cooperation and a meeting for ‘matchmaking’ projects and investments.33 The 70th anniversary of diplomatic relations will also be commemorated with the Sino-Russian Innovation Cooperation Week.34

Science and technology parks

The establishment of a growing number of Sino-Russian S&T parks has been among the most tangible manifestations of growing cooperation. Moscow and Beijing believe that scientific and industrial parks can create a foundation and an infrastructure that’s critical to sustained bilateral cooperation. Since so many of these efforts remain relatively nascent, it’s too early to gauge their success—yet the growing number of such efforts reflects growing bilateral cooperation.

  • As early as 2006, the Changchun Sino-Russian Science and Technology Park was established as a base for S&T cooperation and innovation. It was founded by the Jilin Provincial Government and the Chinese Academy of Sciences, in cooperation with the Russian Academy of Sciences’ Siberian Branch and the Novosibirsk state of the Russian Federation.35 The park has specialised in creating new opportunities for collaboration and for the transfer and commercialisation of research and technology.36 Over more than a decade, it has built an ‘innovation team’ composed of colleges and universities, scientific research institutions and private enterprises.37
  • In June 2016, the plan for the China–Russia Innovation Park was inaugurated with support from the Shaanxi Provincial Government, the Russian Direct Investment Fund and the Sino-Russian Investment Fund. The park was completed in 2018, with information technology, biomedical and artificial intelligence enterprises invited to take part. According to the development plan, the park aims at research and development of new technologies and the integration of new tech with the social infrastructure of both countries.38
  • Also in June 2016, the Sino-Russian Investment Fund and the Skolkovo Foundation signed an agreement to build a medical robot centre and to manufacture medical robots in China with support from experts at the Russian Academy of Sciences’ School of Design and Technology.39 The state-funded Skolkovo initiative, launched in 2010, is Russia’s leading technology innovation space. The foundation manages many high-tech projects that include deep machine learning and neural network techniques.40
  • In June 2016, the China–Russia Silk Road Innovation Park was established in the Xixian New District of Xian.41 This initiative is framed as an opportunity to construct a modern industrial system as the main line of development, ‘striv[ing] to create an innovation and entrepreneurship centre with the highest degree of openness and the best development environment in the Silk Road Economic Belt’. This park welcomes entrepreneurs from China and Russia.
  • In December 2017, S&T parks from China and Russia agreed to promote the construction of a Sino-Russian high-tech centre at Skolkovo, which aims to become Russia’s Silicon Valley.42 The Skolkovo Foundation, which manages the site, agreed to provide the land, while Tus-Holdings Co Ltd and the Russia–China Investment Fund will jointly finance the project. This high-tech centre is intended to serve as a platform to promote new start-ups, including by attracting promising Chinese companies.
  • In October 2018, the Chinese city of Harbin also emerged as a major centre for Sino-Russian technological cooperation.43 This initiative is co-founded by GEMMA, which is an international economic cooperation organisation registered in Russia, and the Harbin Ministry of Science and Technology.44 At present, 19 companies are resident in the centre, which is expected to expand and receive robust support from the local government. Harbin’s Nangan District has expressed interest in cooperation with Russian research institutes in the field of AI.45
  • The cities of Harbin and Shenzhen have been selected for a new ‘Two Countries, Four Cities’ program, which is intended to unite the potentials of Moscow, Yekaterinburg, Harbin and Shenzhen.46 As of 2019, there are plans for the opening of another Russian innovation centre in the city of Shenzhen—a high-tech park that will concentrate on information technology47—enabling resident companies to enter the China market with their own software and technologies, such as big data and automation systems for mining.48

Joint funds

China and Russia are also increasing investments into special funds for research on advanced technology development.

  • The Russia–China Investment Fund for Regional Development signed on as an anchor investor in two new funds at Skolkovo Ventures to the tune of US$300 million in October 2018.49 This fund will also pour money into Skolkovo’s funds for emerging companies in information technology, which each currently have US$50 million in capital.50
  • The Russia–China Science and Technology Fund was established as a partnership between Russia’s ‘Leader’ management company and Shenzhen Innovation Investment Group to invest as much as 100 million yuan (about US$14 million) into Russian companies looking to enter the China market.51
  • The Chinese and Russian governments have been negotiating to establish the Sino-Russian Joint Innovation Investment Fund.52 In July 2019, the fund was officially established, with the Russian Direct Investment Fund and the China Investment Corporation financing the $1 billion project.53

Contests and competitions

Engagement between the Chinese and Russian S&T sectors has also been promoted through recent contests and competitions that have convened and displayed projects with the aim of facilitating cooperation.

  • In September 2018, the first China–Russia Industry Innovation Competition was convened in Xixian New District.54 The competition focused on the theme of ‘Innovation Drives the Future’, highlighting big data, AI and high-end manufacturing.55 The projects that competed included a flying robot project from Beijing University of Aeronautics and Astronautics and a brain-controlled rehabilitation robot based on virtual reality and functional electrical stimulation.
  • In April 2019, the Roscongress Foundation together with VEB Innovations and the Skolkovo Foundation launched the second round of the EAST BOUND contest, which gives Russian start-ups an opportunity to tell foreign investors about their projects. This time, the contest will support AI developments.56 The finalists spoke at SPIEF–2019 (the St Petersburg International Economic Forum) and presented their projects to a high-profile jury consisting of major investors from the Asia–Pacific region.57

Expansion of academic cooperation

In July 2018, the Russian and Chinese academies of sciences signed a road-map agreement to work on six projects.58 The agreement joins together some of the largest academic and research institutions around the world and includes commitments to expand research collaboration and pursue personnel exchanges. The Chinese Academy of Sciences has more than 67,900 scientists engaged in research activities,59 while the Russian Academy of Sciences includes 550 scientific institutions and research centres across the country employing more than 55,000 scientists.60

These projects include a concentration on brain functions that will include elements of AI.61 The Russian side is motivated by the fact that China occupies a world-leading position in the field of neuroscience,62 including through the launch of the China Brain Project.63 The Russian Academy of Sciences delegation visited laboratories in Shanghai in August 2019 and commented on their counterpart academy’s achievements:

Brain research is a whole range of tasks, starting with genetics and ending with psychophysical functions. This includes the study of neurodegenerative diseases and the creation of artificial intelligence systems based on neuromorphic intelligence. Participation in this project is very important for Russia. China is investing a lot in this and has become a world leader in some areas …64

Priorities for partnership

Chinese–Russian technological cooperation extends across a range of industries, and the degree of engagement and productivity varies across industries and disciplines. As Sino-Russian relations enter this ‘new era’, sectors that have been highly prioritised include, but are not limited to, telecommunications; robotics and AI; biotechnology; new media; and the digital economy.

Next-generation telecommunications

The ongoing feud between the US and China over the Huawei mobile giant has contributed to unexpectedly rapid counterbalancing cooperation between Russia and China. In fact, President Vladimir Putin went on the record about this issue, calling the American pressure on the Chinese company the ‘first technological war of the coming digital age’.65 Encountering greater pressure globally, and this year in particular, Huawei has expanded its engagement with Russia, looking to leverage its STEM expertise through engaging with Russian academia. Since 2018, Huawei has opened centres first in Moscow, St Petersburg and Kazan and then in Novosibirsk and Nizhny Novgorod.66

Huawei also began monitoring the research capabilities of Russian universities, searching for potential joint projects, and in August 2019 the company signed a cooperation agreement on AI with Russia’s National Technology Initiative, which is a state-run program to promote high-tech development in the country.67 Based on a competition run by the Huawei Academy and Huawei Cloud, Russia’s best academic STEM institutions were selected.68 In May 2019, Huawei and the Siberian Branch of the Russian Academy of Sciences outlined areas and means of future cooperation.69

Underscoring its bullishness, China recently announced plans for a fourfold increase in its R&D staff in Russia going forward. In May 2019, the Huawei Innovation Research Program in Russia was launched, and Russian institutions have received 140 technological requests from Huawei in various areas of scientific cooperation.70 By the end of 2019, the company intends to hire 500 people, and within five years it will attract more than 1,000 new specialists.71 Huawei now has two local R&D centres in Moscow and St Petersburg, where 400 and 150 people work, respectively.72 By the end of the year, it plans to open three new R&D centres, and Russia will then be ranked among the top three Huawei R&D centres, after Europe and North America.73 The company plans to engage in close cooperation with Russian scientific communities, universities and other research centres.

At present, Russia doesn’t appear to share deep American concerns about security related to Huawei technology.74 Huawei has started actively expanding its 5G testing in the Russian Federation, partnering with Russia’s Vimplecom to test a 5G pilot area in downtown Moscow starting in August 2019.75 Commentators have stated that Russia, which isn’t considered a technological leader, has ‘the potential to get ahead globally’ now that it has Chinese high-tech enterprises as allies.76 During the summer of 2019 at SPIEF, Huawei continued to discuss with Skolkovo plans to develop 5G network technology at the innovation centre, and also to do research in AI and internet of things (IoT) projects.77

In fact, at that forum, Russia and China outlined a large-scale cooperation program in order to prepare a road map for future investment and cooperation on issues such as cybersecurity and the IoT.78 As US pressure on Huawei continues, there’s even a possibility that the Chinese company might abandon the Android operating system (OS) altogether and replace it with the Russian Avrora OS.79 If this transaction goes through, it would be the first time that a Russian OS has contributed to a significant global telecoms player.

Whether Huawei can become a trusted name in Russia’s tech sector and defence industries remains to be seen. There are also reasons to question whether Russia truly trusts the security of Huawei’s systems, but it may be forced to rely upon them, absent better options. As an illustration of potential complications, in August 2019, Russia’s MiG Corporation, which builds Russia’s fighter jets, was caught in a legal battle with one of its subcontractors over software and hardware equipment.80 The subcontractor in question, Bulat, has been one of Russia’s most active companies in riding the wave of the ‘import substitution’ drive in effect since Western sanctions were imposed on the Russian defence industry. However, in this case, Bulat didn’t offer Russian-made technology; rather, it used Huawei’s servers and processors.81 Although MiG did not say publicly why it didn’t pay Bulat, it appears that the aircraft corporation actually requested Chinese technology for its operations. 82

Big data, robotics and artificial intelligence

For China and Russia, AI has emerged as a new priority in technological cooperation. For instance, the countries are seeking to expand the sharing of big data through the Sino-Russian Big Data Headquarters Base Project,83 while another project has been launched to leverage AI technologies, particularly natural language processing, to facilitate cross-border commercial activities, intended for use by Chinese and Russian businesses.84 China’s Ambassador to Russia, Li Hui, said at an investment forum in the autumn of 2018 that the two countries should increase the quality of bilateral cooperation and emphasise the digital economy as a new growth engine, highlighting opportunities for collaboration in AI, along with big data, the internet and smart cities.85 Ambassador Li emphasised:

Russia has unique strength in technological innovation and has achieved significant innovations in many fields of science and technology. China and Russia have unique economic potential and have rich experience in cooperation in many fields. Strengthening collaboration, promoting mutual investment, actively implementing promising innovation projects, expanding direct links between the scientific, business and financial communities of the two countries is particularly important today.86

This bilateral AI development will benefit from each country’s engineers and entrepreneurs.87 From Russia’s perspective, the combined capabilities of China and Russia could contribute to advancing AI, given the high-tech capabilities of Russia’s R&D sector.88 While Russia’s share of the global AI market is small, that market is growing and maturing.89 In Russia, a number of STEM and political figures have spoken favourably about the potential of bilateral R&D in AI. At the World Robotics Forum in August 2017, Vitaly Nedelskiy, the president of the Russian Robotics Association, delivered a keynote speech in which he emphasised that ‘Russian scientists and Chinese robot companies can join hands and make more breakthroughs in this field of robotics and artificial intelligence. Russia is very willing to cooperate with China in the field of robotics.’90 According to Song Kui, the president of the Contemporary China– Russia Regional Economy Research Institute in northeast China’s Heilongjiang Province, ‘High-tech cooperation including AI will be the next highlight of China–Russia cooperation.’91

In fact, bilateral cooperation in robotics development has some Russian developers and experts cautiously optimistic. According to the chief designer at Android Technologies, the Russian firm behind the FEDOR (Skybot F-850) robot that was launched to the International Space Station on 22 August 2019, ‘medicine may be the most promising for cooperation with China in the field of robotics.’92

However, hinting at potential copyright issues with respect to China, he further clarified:

[M]edical robotics is better protected from some kind of copying, because if we [Russians] implement some components or mechatronic systems here [in China], then we can sell no more than a few pieces … But since medical robotics is protected by technology, protected by the software itself, which is the key, the very methods of working with patients, on the basis of this, this area is more secure and most promising for [Russian] interaction with the Chinese.93

Revealingly, concerns about copying are a constraint but might not impede joint initiatives, given the potential for mutual benefit nonetheless.

Indeed, advances in AI depend upon massive computing capabilities, enough data for machines to learn from, and the human talent to operate those systems.94 Today, China leads the world in AI subcategories such as connected vehicles and facial and audio recognition technologies, while Russia has manifest strengths in industrial automation, defence and security applications, and surveillance.95 Based on recent activities and exchanges, there are a growing number of indications that Chinese–Russian collaboration in AI is a priority that should be expected to expand.

  • In August 2017, the Russian Robotics Association signed agreements with the China Robotics Industry Alliance and the China Electronics Society with support from China’s Minister of Industry and Information Technology and Russia’s Minister of Industrial Trade.96
  • In October 2017, Chinese and Russian experts participated in a bilateral engagement, hosted by the Harbin Institute of Technology and the Engineering University of the Russian Federation, that focused on robotics and intelligent manufacturing, exploring opportunities for future cooperation in those technologies.97
  • In April 2018, Russia hosted the Industrial Robotics Workshop for the first time.98 The workshop participants included the leading suppliers of technology and robotic solutions, including Zhejiang Buddha Technology.99 The Chinese participants noted that the Chinese market in robotics is now stronger than ever and advised Russian colleagues to seek help from the state.100
  • In May 2019, NtechLab, which is one of Russia’s leading developers in AI and facial recognition, and Dahua Technology, which is a Chinese manufacturer of video surveillance solutions, jointly presented a wearable camera with a face recognition function, the potential users of which could include law enforcement agencies and security personnel.101 According to NtechLab, the company sees law enforcement agencies and private security enterprises among its potential customers.102
  • In September 2019, Russian and Chinese partners discussed cooperation in AI at the sixth annual bilateral ‘Invest in Innovation’ forum held in Shanghai. The forum outlined the possibility of a direct dialogue between venture investors and technology companies in Russia and China.103 There, the head of Russian Venture Company (a state investor) noted that ‘artificial intelligence seems to be promising, given the potential of the Chinese market, the results of cooperation, and the accumulated scientific potential of Russia.’104

Biotechnology

Chinese and Russian researchers are exploring opportunities to expand collaboration in the domain of biotechnology. In September 2018, Sistema PJSFC (a publicly traded diversified Russian holding company), CapitalBio Technology (an industry-leading Chinese life science company that develops and commercialises total healthcare solutions), and the Russia–China Investment Fund agreed to create the largest innovative biotechnology laboratory in Russia.105 The laboratory will focus on genetic and molecular research. Junquan Xu, the CEO of CapitalBio Technology, said:

[W]e are honoured to have this opportunity to cooperate with the Russia–China Investment Fund and Sistema … We do believe that the establishment of the joint laboratory will further achieve resource sharing, complementary advantages and improve the medical standards.106

New media and communications

Chinese and Russian interests also converge on issues involving new media. In 2019, Russia intends to submit to the Chinese side a draft program of cooperation in the digital domain.107 China recently hosted the 4th Media Forum of Russia and China in Shanghai with the goal of creating a common digital environment conducive to the development of the media of the two countries, the implementation of joint projects and the strengthening of joint positions in global markets.108 In fact, China’s side discussed joint actions aimed at countering Western pressure against the Russian and Chinese media.109 Both Russia and China aim to develop common approaches and response measures to improve their capacity to promote their point of view—a dynamic that the Chinese Communist Party characterises as ‘discourse power’ (话语权).110 According to Alexey Volin, the Russian Deputy Minister of Digital Development, Telecommunications and Mass Media:

If Twitter, YouTube or Facebook follow the path of throwing out Russian and Chinese media from their environment, then we will have nothing else to do but create new distribution channels, how to think about alternative social networks and instant messengers.111

Such cooperation in new media, internet governance, and propaganda extends from technical to policy-oriented engagements. For instance, at SPIEF–2019, Sogou Inc. (an innovator in research and a leader in China’s internet industry) announced the launch of the world’s first Russian-speaking AI news anchor, which was developed through a partnership with ITAR-TASS, which is Russia’s official news agency, and China’s Xinhua news agency.112 According to the official announcement, the Russian-speaking news anchor features Sogou’s latest advances in speech synthesis, image detection and prediction capabilities, introducing more engaging and interactive content for Russian audiences.113 ‘AI anchors,’ which are starting to become a fixture and feature of China’s media ecosystem, can contribute to the landscape of authoritarian propaganda. During the World Internet Conference in October 2018, China and Russia also plan to sign a treaty involving the Cyberspace Administration of China and Roskomnadzor about ‘combatting illegal internet content.’114

The digital economy

China’s tech giants see business opportunities in Russia’s nascent digital economy. Russia’s data centres are gaining increased capabilities as Chinese companies move into this market. Over the past year, more than 600 Tencent racks have been installed in IXcellerate Moscow One, becoming its largest project. Tencent’s infrastructure will be used for the development of its cloud services and gaming. This project opens up new prospects for Tencent in Russia, which has the highest number of internet users in Europe (about 100 million—a 75% penetration rate).115 All provided services, including the storage and processing of personal data, are expected to be in full compliance with Russian legislation.116 In late 2018, Alibaba Group Holding Ltd started establishing a US$2 billion joint venture with billionaire Alisher Usmanov’s internet services firm Mail.ru Group Ltd to strengthen the Chinese company’s foothold in Russian e-commerce.117 Usmanov is one of Russia’s richest and most powerful businessmen, and his fortunes depend upon the Kremlin’s goodwill as much as on his own business acumen. In this deal, Alibaba signed an accord with Mail.ru to merge their online marketplaces in Russia, which is home to 146 million people. The deal was backed by the Kremlin through the Russian Direct Investment Fund, and the local investors will collectively control the new business.118

Problems in partnership and obstacles to technological development

To date, Sino-Russian cooperation in S&T has encountered some problems. Those issues have included not only insufficient marketisation but also initial Russian reservations about China’s One Belt, One Road initiative, which has been closely linked to scientific and technological collaboration.119 Additionally, there’s evidence that there may still be significant trust issues that impede adopting or acquiring Chinese-made high-tech products for the Russian markets. For example, in a February 2019 interview, Evgeny Dudorov, the CEO of Android Technologies (which built the FEDOR robot), said in a public interview that his company did not want to adopt Chinese robotics parts ‘due to their poor quality’.120

China’s track record over IP theft may be a concern, but it doesn’t seem that Russia is presently as anxious as others about this issue.For instance, Vladimir Lopatin, the Director of the Intellectual Property Department at the Russian Republican Centre for Intellectual Property, sounded a warning about Chinese activities back in 2013:

[T]he prevailing practice of theft and illegal use of Russian intellectual property in the production of counterfeit products by Chinese partners has led to a widespread critical decline in the level of confidence in them from Russian academic and university science centres and enterprises. This is a significant factor in restraining the implementation of strategic initiatives of innovative cooperation between the two countries …121

However, such sentiment does not appear to be so widespread at present. For instance, the Russian media typically concentrates on US–China IP disputes while presenting Sino-Russian high-tech activity in a primarily positive light. Moscow today may be merely resigned, given the long history of Chinese reverse-engineering of Russian defence technologies, but it’s notable that the Chinese Government is publicising promises to enforce IP protection vis-a-vis its Russian counterpart, implying that perhaps a detente has been reached.122 At this point, Russia seems to be more concerned about China possibly stealing its best and brightest scientists—in September 2019, the head of the Russian Academy of Sciences expressed concern that Beijing seems to be successful in starting to attract Russian STEM talent with better pay and work conditions.123 He also seemed concerned that, due to its better organisation and development goals, China was becoming a ‘big brother’ to Russia in not just economic but scientific development and called for a study of China’s overall STEM success.124

At the same time, such bilateral cooperation isn’t immune to the internal politics and certain economic realities in both nations. For instance, in what was obviously an unexpected setback, Tencent admitted back in 2017 it was ‘deeply sorry’ that its social media app WeChat had been blocked in Russia, adding that it was in touch with authorities to try to resolve the issue.125 Russian telecoms watchdog Roskomnadzor listed WeChat on the register of prohibited websites, according to information posted on the regulator’s website. ‘Russian regulations say online service providers have to register with the government, but WeChat doesn’t have the same understanding [of the rules],’ Tencent said in a statement at the time. Equally important is Russia’s ongoing uphill battle in import-substitution of high-tech and industrial components, as a result of the sanctions imposed by the West in 2014 and 2015. Despite significant progress, Russia is still reliant upon Western technology procured by direct or indirect means, and Moscow is not always keen to embrace Chinese high-tech as a substitute.

In Russia, the most lucrative companies are entangled within semi-monoplistic structures close to the Russian Government. Those players are few in number and tend to wield enormous influence in the Russian economy. As a result, the possible high-tech contact nodes between Moscow and Beijing lead through a small number of offices belonging to the most powerful and connected individuals. The true test of the Sino-Russian bilateral relationship concerning high-tech products and services may be in attempting to expand to the medium- and small-sized businesses and enterprises offering the most nimble and capable solutions. For example, the head of Russian Venture Company, a state investor, noted the difficulties in creating tools for a joint venture fund:

We did not resolve the problem of investing in a Russian venture fund. Withdrawing money from China to Russian jurisdictions under an understandable partnership and an understandable instrument is nevertheless difficult.126

Moreover, for both China and Russia, a significant challenge remains: promising young scientists in both countries would prefer to work elsewhere, namely in the US. Some recent polls and anecdotal evidence point to a continuously strong desire for emigration among the best educated, and especially among those with already established international professional relationships.127 This is especially true for Russia. However, as its National Technology Initiative has observed:

We believe that everybody for whom the Californian comfort, sun, wine, mountains and oceans are important has already left Russia. Others realise that the wine, mountains and sea in Sevastopol are just as good.128

For China, the current paradox is that, while Beijing offers plenty of incentives for its STEM community to stay in the country, many researchers choose, in fact, to work overseas, particularly in American institutions.129 The establishment of numerous S&T initiatives outlined in this paper is meant to offset that trend, but the trajectory of so many efforts launched recently remains to be seen.

Conclusions and implications

The Chinese–Russian high-tech partnership may continue to progress in the coming years, as both countries look to leverage each other’s capabilities to advance high-tech developments. China is clearly approaching Russia for its STEM R&D and S&T proficiencies, and Russia seems to be happy to integrate itself more into Chinese high-tech capabilities, and yet it is Beijing that emerges as a dominant player in this bilateral cooperation, while Russia tends to find itself in a position of relative disadvantage. Russia lacks such giants as China’s Baidu, Tencent and Alibaba, which are starting to expand globally, including into the Russian market.130 Nonetheless, as the Russian Government seeks to jump-start its own indigenous innovation, China is seen as a means to an end—and vice versa.

After all, Russian Deputy Prime Minister Maxim Akimov told reporters on the sidelines of the VI Russia–China Expo in Harbin that Russia is interested in cooperation with China in the cybersecurity sphere and in the development of technology solutions: ‘We keep a close eye on the experience of Chinese colleagues.’131

However, the future trajectory of this relationship could be complicated by questions of status and standing, not to mention politics and bureaucracy, as such projects, financing and research accelerate.

Russia may benefit from its embrace of China’s technology prowess and financing, but the full range of risks and potential externalities is still emerging and perhaps poorly understood. As Sino-Russian partnership has deepened, observers of this complex relationship have often anticipated some kind of ‘break’ in the ongoing Russo-Chinese ‘entente’.132 Many commentators find it difficult to believe that countries with such global ambitions and past historical grievances can place much trust in each other.

Certainly, there have been subtle indications of underlying friction, including Russia’s initial reluctance to embrace Xi’s signature One Belt, One Road initiative, to which Moscow has since warmed, or so it seems.

Going forward, high-tech cooperation between Moscow and Beijing appears likely to deepen and accelerate in the near term, based on current trends and initiatives. In a world of globalised innovation, scientific knowledge and advanced technologies have been able to cross borders freely over the past quarter of a century. China and Russia have been able to take advantage of free and open STEM development, from life sciences to information technology and emerging technologies, applying the results to their own distinctive technological ecosystems. Today, however, as new policies and countermeasures are introduced to limit that access, China and Russia are seeking to develop and demonstrate the dividends from a new model for scientific cooperation that relies less and less on foreign, and especially American, expertise and technology, instead seeking independence in innovation and pursuing developments that may have strategic implications.

Policy considerations and recommendations

In response to these trends and emerging challenges, like-minded democracies, particularly the Five Eyes states, should pursue courses of action that include the following measures.

  • Track the trajectory of China–Russia tech collaborations to mitigate the risks of technological surprise and have early warning of future threats. This calls for better awareness of Sino-Russian joint high-tech efforts among the Five Eyes states, in conjunction with allies and partners and relevant stakeholders, that goes beyond the hype of media headlines by developing better expertise on and understanding of the strengths and weaknesses of Russian and Chinese technological developments.
  • Monitor and respond to tech transfer activities that involve IP theft or the extra-legal acquisition of technologies that have dual-use or military potential, including those activities where there is a nexus between companies and universities with Russian and Chinese links. The US and Australia, along with their allies and partners, should coordinate on export controls, screening of investment and restrictions against collaborations with military-linked or otherwise problematic institutions in China and Russia. Otherwise, unilateral responses will prove inadequate to counter the global threat of Chinese industrial espionage, which is undertaken through a range of tech transfer tactics and is truly international in scope at scale.133
  • Deepen cooperation among allies and partners on emerging technologies, including by pursuing improvements in data sharing. The US and Australia should promote greater technological collaboration between Five Eyes governments in the high-tech sectors that are shared priorities in order to maintain an edge relative to competitors. For instance, arrangements for sharing of data among allies and partners could contribute to advances in important applications of AI. To compete, it will be critical to increase funding for STEM and high-tech programs and education in the Five Eyes countries.
  • Promulgate norms and ethical frameworks for the use of next-generation technologies, particularly AI, that are consistent with liberal values and democratic governance. In the process, the US and Australia, along with concerned democracies worldwide, should mount a more coordinated response to Russian and Chinese promotion of the concept of cyber sovereignty as a means of justifying repressive approaches to managing the internet and their advancement of AI for censorship and surveillance.

Acknowledgements

The authors would like to thank Danielle Cave, Fergus Hanson, Alex Joske, Rob Lee and Michael Shoebridge for helpful comments and suggestions on the paper.

What is ASPI?

The Australian Strategic Policy Institute was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally.

ASPI International Cyber Policy Centre

ASPI’s International Cyber Policy Centre (ICPC) is a leading voice in global debates on cyber and emerging technologies and their impact on broader strategic policy. The ICPC informs public debate and supports sound public policy by producing original empirical research, bringing together researchers with diverse expertise, often working together in teams. To develop capability in Australia and our region, the ICPC has a capacity building team that conducts workshops, training programs and large-scale exercises both in Australia and overseas for both the public and private sectors. The ICPC enriches the national debate on cyber and strategic policy by running an international visits program that brings leading experts to Australia.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional.

© The Australian Strategic Policy Institute Limited 2019

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

  1. ‘China, Russia agree to upgrade relations for new era’, Xinhua, 6 June 2019, online. ↩︎
  2. ‘Russia and China celebrate 70 years of the establishment of diplomatic relations’ [Россия и Китай отмечают 70-летие установления дипотношений], TVC.ru, 30 September 2019, online. ↩︎
  3. Official evening commemorating 70th years of diplomatic relations between Russia and China (Вечер, посвящённый 70-летию установления дипломатических отношений между Россией и Китаем), Official website of the Russian President, June 5, 2019 ↩︎
  4. This paper uses entirely open sources, and there are inherently limitations in the information that is accessible. Nonetheless, we hope this is a useful overview that leverages publicly available information to explore current trends. ↩︎

Joint BBC-ASPI investigation into West Papua information operations

A joint investigation between the BBC and ASPI’s International Cyber Policy Centre analysed a well-funded and co-ordinated information campaign aimed at distorting the truth about events in Indonesia’s West Papua province, and has identified those responsible for its operation.

The researchers found that the campaign used slanted or factually untrue content (including “news” articles, infographics and videos) to promote narratives supportive of the Indonesian government’s actions in West Papua, and to undermine the pro-independence movement.

In a context like this in which independent media is restricted and verified information is scarce, a disinformation campaign such as the one the researchers uncovered has the potential to have a substantial impact on how the situation is perceived by the international community. This in turn could have implications for policies and decisions made by other governments, and in international forums such as the UN.

Building off earlier research published on Bellingcat, the researchers used open source data and digital forensics to analyse the campaign’s operations across multiple platforms and identify Jakarta-based communications consultancy InsightID as the source of the operation. 

This attribution was then confirmed by Facebook, and later acknowledged by the organisation itself.

A second, smaller campaign was also uncovered. Researchers tracked this campaign back to an individual with political connections. On being approached by the BBC, the individual eventually admitted his role in the campaign but insisted that they had been undertaken in his personal capacity and were not connected to his political work.

The investigation was led by BBC’s open source investigator Benjamin Strick and ASPI International Cyber Policy Centre researcher Elise Thomas and included:

A detailed report outlining the full investigation published on Bellingcat

Coverage of the investigation on the BBC in English and in Indonesian

Engineering global consent: The Chinese Communist Party’s data-driven power expansion

The Chinese party-state engages in data collection on a massive scale as a means of generating information to enhance state security—and, crucially, the political security of the Chinese Communist Party (CCP)—across multiple domains. The party-state intends to shape, manage and control its global operating environment so that public sentiment is favourable to its own interests. The party’s interests are prioritised over simply the Chinese state’s interests or simply the Chinese people’s interests. The effort requires continuous expansion of the party’s power overseas because, according to its own articulation of its threat perceptions, external risks to its power are just as likely—if not more likely—to emerge from outside the People’s Republic of China’s (PRC) borders as from within.

This report explains how the party-state’s tech-enhanced authoritarianism is expanding globally. The effort doesn’t always involve distinctly coercive and overtly invasive technology, such as surveillance cameras. In fact, it often relies on technologies that provide useful services. Those services are designed to bring efficiency to everyday governance and convenience to everyday life. The problem is that it’s not only the customer deploying these technologies—notably those associated with ‘smart cities’, such as ‘internet of things’ (IoT) devices—that derives benefit from their use. Whoever has the opportunity to access the data a product generates and collects can derive value from the data. How the data is processed, and then used, depends on the intent of the actor processing it.

Tweeting through the Great Firewall

Preliminary Analysis of PRC-linked Information Operations on the Hong Kong Protests

Introduction

On August 19th 2019, Twitter released data on a network of accounts which it has identified as being involved in an information operation directed against the protests in Hong Kong. After a tip-off from Twitter, Facebook also dismantled a smaller information network operating on its platform. This network has been identified as being linked to the Chinese government. 

Researchers from the International Cyber Policy Centre (ICPC) at the Australian Strategic Policy Institute have conducted a preliminary analysis of the dataset. Our research indicates that the information operation targeted at the protests appears to have been a relatively small and hastily assembled operation rather than a sophisticated information campaign planned well in advance.

However, our research has also found that the accounts included in the information operation identified by Twitter were active in earlier information operations targeting political opponents of the Chinese government, including an exiled billionaire, a human rights lawyer, a bookseller and protestors in mainland China. The earliest of these operations date back to April 2017.

This is significant because—if the attribution to state-backed actors made by Twitter is correct—it indicates that actors linked to the Chinese government may have been running covert information operations on Western social media platforms for at least two years. 

Methodology

This analysis used a mixed-methods approach combining quantitative analysis of bulk Twitter data with qualitative analysis of tweet content.

The dataset for quantitative analysis was the tweets and accounts identified by Twitter as being associated with a state-backed information operation targeting Hong Kong and is available here.

This dataset consisted of 

  • account information about the 940 accounts Twitter suspended from their service
    • The oldest account was created in December 2007, although half of accounts were created after August 2017 
  • 3.6 million tweets from these accounts, ranging from December 2007 to May 2019

The R statistics package was used for quantitative analysis, which informed phases of social network analysis (using Gephi) and qualitative content analysis.

Research limitations: ICPC does not have access to the relevant data to independently verify that these accounts are linked to the Chinese government; this research proceeds on the assumption that Twitter’s attribution is correct. It is also important to note that Twitter has not released the methodology by which this dataset was selected, and the dataset may not represent a complete picture of Chinese state-linked information operations on Twitter.

Information operation against Hong Kong protests

Indications of a hastily constructed campaign

Carefully crafted, long-running influence operations on social media will have tight network clusters that delineate target audiences. We explored the retweet patterns across the Twitter take-down data from June 2019 – as the network was mobilising to target the Hong Kong protests – and did not find a network that suggested sophisticated coordination. Topics of interest to the PRC emerge in the dataset from mid-2017 but there is little attempt to target online communities with any degree of psychological sophistication.

There have been suggestions that Taiwanese social media, during recent gubernatorial elections, had been manipulated by suspicious public relations contractors operating as proxies for the Chinese government. It is notable that the network targeting the Hong Kong protests was not cultivated to influence targeted communities; it too acted like a marketing spam network. These accounts did not attempt to behave in ways that would have integrated them into – and positioned them to influence – online communities. This lack of coordination was reflected in the messaging. Audiences were not steered into self-contained disinformation ecosystems external to Twitter, nor were hashtags used to build audience, then drive the amplification of specific political positions. As this network was mobilising against the Hong Kong protests, several nodes in the time-sliced retweet data (see Figure 1) were accounts to promote the sex industry, accounts that would have gained attention because of the nature of their content. These central nodes were not accounts that had invested in cultivating engagement with target audiences (beyond their previous marketing function). These accounts spammed retweets at others outside the network in attempts to get engagement rather than working together to drive amplification of a consistent message.

Figure 1: Retweet network from June 2019, derived from Twitter’s take-down data, showing the significant presence of likely pornography-related accounts within the coordinated network that targeted the Hong Kong protests.

This was a blunt–force influence operation, using spam accounts to disseminate messaging, leveraging an influence-for-hire network. The predominant use of Chinese language suggests that the target audiences were Hong Kongers and the overseas diaspora.

This operation is in stark contrast to the efforts of Russia’s Internet Research Agency (IRA) to target US political discourse, particularly through 2015-2017.

The Russian effort displayed well-planned coordination. Analysis of IRA account data has shown that networks of influence activity cluster around identity or issue-based online communities. IRA accounts disseminated messaging that inflamed both sides of the debates around controversial issues in order to further the divide between protagonist communities. High-value and long-running personas cultivated influence within US political discourse. These accounts were retweeted by political figures, and quoted by media outlets.

The IRA sent four staff to the US to undertake ‘market research’ as the IRA geared up its election meddling campaign. The IRA campaign displayed clear understanding of audience segmentation, colloquial language, and the ways in which online communities framed their identities and political stances.

In contrast, this PRC-linked operation is clumsily re-purposed and reactive. Freedom of expression on China’s domestic internet is framed by a combination of top-down technocratic control managed by the Cyberspace Administration of China and devolved, crowdsourced content regulation by government entities, industry and Chinese netizens. Researchers have suggested that Chinese government efforts to shape sentiment on the domestic internet go beyond these approaches. One study estimated that the Chinese government pays for as many as 448 million inauthentic social media posts and comments a year. The aim is to distract the population from social mobilisation and collective forms of protest action. This approach to manipulating China’s domestic internet appears to be much less effective on Western social media platforms that are not bounded by state control.

Yet, the CCP continues to use blunt efforts to grow the reach, impact and influence of its narratives abroad. Elements of the party propaganda apparatus – including the foreign media wing of the United Front Work Department – have issued (as recently as 16 August) tenders for contracts to grow their international influence on Twitter, with specific targets for numbers of followers in particular countries.

In the longer term, China’s investments in AI may lift its capacity to target and manipulate international social media audiences. However, this operation lacks the sophistication of those deployed by other significant state proponents of cyber-enabled influence operations; particularly Iran and Russia, who have demonstrated the capacity to operate with some degree of subtlety across linguistic and cultural boundaries.

This was the quintessential authoritarian approach to influence – one-way floods of messaging, primarily at Hong Kongers.

Use of repurposed spam accounts

Many of the accounts included in the Twitter dataset are repurposed spam or marketing accounts. Such accounts are readily and cheaply available for purchase from resellers, often for a few dollars or less. Accounts in the dataset have tweeted in a variety of languages including Indonesian, Arabic, English, Korean, Japanese and Russian, and on topics ranging from British football to Indonesian tech support, Korean boy bands and pornography.

This graph shows the language used in tweets over time, (although Twitter did not automatically detect language in tweets prior to 2013). The dataset includes accounts tweeting in a variety of languages over a long period of time. Chinese language tweets appear more often after mid-2017.

This map shows the self-reported locations of the accounts suspended by twitter, color-coded for the language they tweeted in. These locations do not reliably indicate the true location of the account-holder, but in this data set there is a discrepancy between language and location. The self-reported locations are likely to reflect the former nature of the accounts as spam and marketing bots – i.e., they report their locations in developed markets where the consumers they are targeting are located in order to make the accounts appear more credible, even if the true operators of the account are based somewhere else entirely.

Evidence of reselling is clearly present in the dataset. Over 630 tweets within the dataset contain phrases like ‘test new owner’, ‘test’, ‘new own’, etc. As an example, the account @SamanthxBerg tweeted in Indonesian on the 2nd of October 2016, ‘lelang acc f/t 14k/135k via duit. minat? rep aja’ – meaning that the @SamanthxBerg account with 14,000 followers and following 135,000 users, was up for auction. The next tweet on 6th October 2016 reads ‘i just become the new owner, wanna be my friend?.’

  • tweetid: 782380635990200320
  • Time stamp: 2016-10-02 00:44:00 UTC
  • userid: 769790067183190016
  • User display name: 阿丽木琴
  • User screen name: SamanthxBerg
  • Tweet text: PLAYMFS: #ptl lelang acc f/t 14k/135k via duit. minat? rep aja

Use of these kinds of accounts suggests that the operators behind the information operation did not have time to establish the kinds of credible digital assets used in the Russian campaign targeting the US 2016 elections. Building that kind of ‘influence infrastructure’ takes time and the situation in Hong Kong was evolving too rapidly, so it appears that the actors behind this campaign effectively took a short-cut by buying established accounts with many followers.

 

Timeline of activity

The amount of content directly targeting the Hong Kong protests makes up only a relatively small fraction of the total dataset released by Twitter, comprising just 112 accounts and approximately 1600 tweets, of which the vast majority are in Chinese with a much smaller number in English.

Content relevant to the current crisis in Hong Kong appears to have begun on 14 April 2019, when the account @HKpoliticalnew (profile description: Love Hong Kong, love China. We should pay attention to current policies and people’s livelihood. 愛港、愛國,關注時政、民生。) tweeted about the planned amendments to the extradition bill. Tweets in the released dataset mentioning Hong Kong continued at the pace of a few tweets every few days, steadily increasing over April and May, until a significant spike on 14 June, the day of a huge protest in which over a million Hong Kongers (1 in 7) marched in protest against the extradition bill.

Hong Kong related tweets per day from 14 April 2019 to 25 July 2019.

Thereafter, spikes in activity correlate with significant developments in the protests. A major spike occurred on 1 July, the day when protestors stormed the Legislative Council building. This is also the start of the English-language tweets, presumably in response to the growing international interest in the Hong Kong protests. Relevant tweets then appear to have tapered off in this dataset, ending on 25 July.

It is worthwhile noting that the tapering off in this dataset may not reflect the tapering off of the operation itself – instead, it is possible that it reflects a move away from this hastily-constructed information operation to more fully developed digital assets which have not been captured in this data.

Lack of targeted messaging and narratives

One of the features of well-planned information operations is the ability to subtly target specific audiences. By contrast, the information operation targeting the Hong Kong protests is relatively blunt.

Three main narratives emerge:

  • Condemnation of the protestors
  • Support for the Hong Kong police and ‘rule of law’
  • Conspiracy theories about Western involvement in the protests

Support for ‘rule of law’:

  • tweetid: 1139524030371733504
  • Time stamp: 2019-06-14 13:24:00 UTC
  • userid: r+QLQEgpn4eFuN1qhvccxtPRmBJk3+rfO3k9wmPZTQI=
  • User display name: r+QLQEgpn4eFuN1qhvccxtPRmBJk3+rfO3k9wmPZTQI=
  • User screen name: r+QLQEgpn4eFuN1qhvccxtPRmBJk3+rfO3k9wmPZTQI=
  • Tweet text: @uallaoeea 《逃犯条例》的修改,只会让香港的法制更加完备,毕竟法律是维护社会公平正义的基石。不能默认法律的漏洞用来让犯罪分子逃避法律制裁而不管。 – 14 June 2019

Translated: ‘The amendment to the Fugitive Offenders Ordinance will only make Hong Kong’s legal system more complete. After all, the law is the cornerstone for safeguarding fairness and justice in society. We can’t allow loopholes in the legal system to allow criminals to escape the arm of the law.’

Conspiracy theories:

  • tweetid: 1142349485906919424
  • Time stamp: 2019-06-22 08:31:00 UTC
  • Userid: 2156741893
  • User display name: 披荆斩棘
  • User screen name: saydullos1d
  • Tweet text: 香港特區警察總部受到包圍和攻擊, 黑衣人嘅真實身份係咩? 係受西方反華勢力指使,然後係背後操縱, 目的明確, 唆使他人參與包圍同遊行示威。把香港特區搞亂, 目的就係非法政治目的, 破環社會秩序。  – 22 June 2019

Translated: ‘Hong Kong SAR police headquarters were surrounded and attacked. Who were the people wearing black? They were acting under the direction of western anti-China forces. They’re manipulating things behind the scenes, with a clear purpose to instigate others to participate in the demonstration and the encirclement. They’re bringing chaos to Hong Kong SAR with an illegal political goal and disrupting the social order.’

[NB: Important to note that this was written in traditional Chinese characters and switches between Standard Chinese and Cantonese, suggesting that the author was a native mandarin speaker but their target audience was Cantonese speakers in Hong Kong.]

  • tweetid: 1147398800786382848
  • Time stamp: 2019-07-06 06:56:00 UTC
  • Userid: 886933306599776257
  • User display name: lingmoms
  • User screen name: lingmoms
  • Tweet text: 無底線的自由,絕不是幸事;不講法治的民主,只能帶來禍亂。香港雖有不錯的家底,但經不起折騰,經不起內耗,惡意製造對立對抗,只會斷送香港前途。法治是香港的核心價值,嚴懲違法行為,是對法治最好的維護,認為太平山下應享太平。 – 6 July 2019

Translated: ‘Freedom without a bottom line is by no means a blessing; democracy without the rule of law can only bring disaster and chaos. Although Hong Kong has a good financial background, it can’t afford to vacillate. It can’t take all of this internal friction and maliciously created agitation, which will only ruin Hong Kong’s future. The rule of law is the core value of Hong Kong. Severe punishment for illegal acts is the best safeguard for the rule of law. Peace should be enjoyed at the foot of The Peak.’’

[NB: This Tweet is also written in Standard Chinese using traditional Chinese characters. The original text says ‘at the foot of Taiping mountain’, meaning Victoria Peak, but is more commonly referred to in Hong Kong as “The Peak” (山頂). However, the use of Taiping mountain instead of ‘The Peak’ to refer to the feature is a deliberate pun, because Taiping means ‘great peace’]

  • tweetid: 1152024329325957120
  • Time stamp: 2019-07-19 01:16:00 UTC
  • Userid: 58615166
  • User display name: 流金岁月
  • User screen name: Licuwangxiaoyua
  • Tweet text: #HongKong #HK #香港 #逃犯条例 #游行 古话说的好,听其言而观其行。看看那些反对派和港独分子,除了煽动上街游行、暴力冲击、袭警、扰乱香港社会秩序之外,就没做过什么实质性有利于香港发展的事情。反对派和港独孕育的“变态游行”这个怪胎,在暴力宣泄这条邪路上愈演愈烈。 – 19 July 2019

Translated: ‘#HongKong #HK #HongKong #FugitiveOffendersOrdinance #Protests The old Chinese saying put it well: ‘Judge a person by their words, as well as their actions’. Take a look at those in the opposition parties and the Hong Kong independence extremists. Apart from instigating street demonstrations, violent attacks, assaulting police officers and disturbing the social order in Hong Kong, they have done nothing that is actually conducive to the development of Hong Kong. This abnormal fetus of a “freak demonstration” that the opposition parties and Hong Kong independence people gave birth to is becoming more violent as it heads down this evil road.’

This approach of vilifying opponents, emphasising the need for law and order as a justification for authoritarian behaviour is consistent with the narrative approaches adopted in earlier information operations contained within the dataset (see below).

Earlier information operations against political opponents

Our research has uncovered evidence that the accounts identified by Twitter were also engaged in earlier information campaigns targeting opponents of the Chinese government.

It appears likely that these information operations were intended to influence the opinions of overseas Chinese diasporas, perhaps in an attempt to undermine critical coverage in Western media of issues of interest to the Chinese government. This is supported by a notice released by China News Service, a Chinese-language media company owned by the United Front Work Department that targets the Chinese diaspora, requesting tenders to expand its Twitter reach.

Campaign against Guo Wengui

The most significant and sustained of these earlier information operations targets Guo Wengui, an exiled Chinese businessman who now resides in the United States. The campaign directed at Guo is by far the most extensive campaign in the dataset and is significantly larger than the activity directed at the Hong Kong protests. This is the earliest activity the report authors have identified that aligns with PRC interests.

Graph showing activity in an information operation targeting Guo from 2017 to the end of the dataset in July 2019

Guo, also known as Miles Kwok, fled to the United States in 2017 following the arrest of one of his associates, former Ministry of State Security vice minister Ma Jian. Guo has made highly public allegations of corruption against senior members of the Chinese government. The Chinese government in turn accused Guo of corruption, prompting an Interpol red notice for his arrest and return to China. Guo has become a vocal opponent of the Chinese government, despite having himself been accused of spying on their behalf in July 2019.

Within the Twitter Hong Kong dataset, the online information campaign targeting Guo began on 24 April 2017, five days after the Interpol red notice was issued at the request of the Chinese government, and continued until the end of July 2019. Guo continues to be targeted on Twitter, although it is unclear if the PRC government is directly involved in the ongoing effort.

Tweets mentioning Guo Wengui over time from 23 April 2017 to 4 May 2017: Graph showing activity in tweet volume by day. Activity appears to take place during the working week (except Wednesdays), suggesting that this activity may be professional rather than authentic personal social media use.

In total, our research identified at least 38,732 tweets from 618 accounts in the dataset which directly targeted Guo. These tweets consist largely of vitriolic attacks on his character, ranging from highly personal criticisms to accusations of criminality, treachery against China and criticisms of his relationship with controversial US political figure Steve Bannon. 

  • tweetid: 1123765841919660032
  • Time stamp: 2019-05-02 01:47:00 UTC
  • Userid: 4752742142
  • User display name: 漂泊一生
  • User screen name: futuretopic
  • Tweet text: “郭文贵用钱收买班农,一方面想找靠山,一方面想继续为自己的骗子生涯增加点砝码,其实班农只是爱财并非真想和郭文贵做什么, 很快双方会发现对方都 是在欺骗自己,那时必将反目成 仇.” – 2 May 2019

Translated: “Guo Wengui used his money to buy Bannon. On the one hand, he needed his backing. On the other hand, he wanted to continue to add weight to his career as a swindler. In fact, Bannon just loves money and doesn’t really want to do anything with Guo Wengui. Soon both sides will find out that they’re both deceiving the other, and then they’ll turn into enemies.”

  • tweetid: 1153122108655861760
  • Time stamp: 2019-07-22 01:58:00 UTC
  • Userid: 1368044863
  • User display name: asdwyzkexa
  • User screen name: asdwyzkexa
  • Tweet text: ‘近日的郭文贵继续自己自欺欺人的把戏,疯狂的直播,疯狂的欺骗,疯狂鼓动煽风点火,疯狂的鼓吹自己所谓的民主,鼓吹自己的“爆料革命”。但其越是疯狂,越是难掩日暮西山之态,无论其吹的再如何天花乱坠,也终要为自己的过往负责,亲自画上句点.’ – 22 July 2019

Translated: ‘Lately, Guo Wengui has continued to use his cheap trick of deceiving himself and others with a crazy live-stream where he lied like crazy, incited and fanned the flames like crazy, and agitated for his so-called democracy like crazy—enthusiastically promoting his “Expose Revolution”. But the crazier he gets the harder it is to hide the fact that the sun has already set on him. It doesn’t matter how much he embellishes things; eventually, he will have to take responsibility and put an end to all of this himself.’

Spikes in activity in this campaign appear to correspond with significant developments in the timeline of Guo’s falling out with the Chinese government. For example, a spike around 23 April 2018 (see below chart) correlates with the publishing of a report by the New York Times exposing a complex plan to pull Guo back to China with the assistance of the United Arab Emirates and Trump fundraiser Elliott Broidy. 

  • tweetid: 988088232075083776
  • Time stamp: 2018-04-22 16:12:00 UTC
  • Userid: 908589031944081408
  • User display name: 如果
  • User screen name: bagaudinzhigj
  • Tweet text: ‘‘谎言说一千遍仍是谎言,郭文贵纵有巧舌如簧的口才,也有录制性爱视频等污蔑他人的手段,更有给人设套录制音频威胁他人的前科,还有诈骗他人钱财的146项民事诉讼和19项刑事犯罪指控,但您在美国再卖力的表演也掩盖不了事实.’ – 22nd April 2018

Translated: ‘Even if a lie is repeated a thousand times, it’s still a lie. Guo Wengui is an eloquent smooth talker and uses sex tapes and other methods to slander people. He also has a criminal record for trying to threaten and set people up with recorded audio. He has 146 civil lawsuits and 19 criminal charges for swindling other people’s money. No matter how much effort you put in in the United States, you still can’t hide the truth.’

This tweet was repeated 41 times by this user from 7 November 2017 to 15 June 2018, at varying hours of the day, but at only 12 or 42 minutes past the hour, suggesting an automated or pre-scheduled process:

Volume of tweets mentioning Guo Wengui over time from 14 April 2019 to 29 April 2019.

Like the information operation targeting the Hong Kong protests, the campaign targeting Guo is primarily in Chinese language. There are approximately 133 tweets in English, many of which are retweets or duplicates. On 5th November 2017, for example, 27 accounts in the dataset tweeted or retweeted: ‘#郭文贵 #RepatriateKwok、#Antiasylumabused、 sooner or later, your fake mask will be revealed.’

As the Hong Kong protests began to increase in size and significance, the information operations against Guo and the protests began to cross over, with some accounts directing tweets at both Guo and the protests.

  • tweetid: 1148407166920876032
  • Time stamp: 2019-07-09 01:42:00 UTC
  • Userid: 886933306599776257
  • User display name: lingmoms
  • User screen name: lingmoms
  • Tweet text: ‘唯恐天下不乱、企图颠覆香港的郭文贵不仅暗中支持香港占中分子搞暴力破坏,还公开支持暴力游行示威,难道这一小撮入狱的暴民就是文贵口中的“香港人”?’– 9 July 2019

Translated: ‘Guo Wengui, who fears only a world not in chaos and schemes to toppleHong Kong, is not only secretly supporting the violent and destructive Occupy extremists in Hong Kong, he’s also openly supporting violent demonstrations.  Is this small mob of criminals the “Hong Kong people” Guo Wengui keeps talking about?’ 

The dataset provided by Twitter ends in late July 2019, but all indications suggest that the information campaign targeting Guo will continue.
 

Campaign against Gui Minhai

Although the campaign targeting Guo Wengui is by far the most extensive in the dataset, other individuals have also been targeted.

One is Gui Minhai, a Chinese-born Swedish citizen. Gui is one of a number of Hong Kong-based publishers specialising in books about China’s political elite who disappeared under mysterious circumstances in 2015. It was later revealed that he had been taken into Chinese police custody. The official reason for his detention is his role in a fatal traffic accident in 2003 in which a schoolgirl was killed. Gui has been in and out of detention since 2015, and has made a number of televised confessions which many human rights advocates believe to have been forced by the Chinese government.

The information operation targeting Gui Minhai is relatively small, involving 193 accounts and at least 350 tweets. With some exceptions, the accounts used in the activity directed against Gui appear to be primarily ‘clean’ accounts created specifically for use in information operations, unlike the repurposed spam accounts utilised by the activity targeted at Hong Kong.

The campaign runs for one month, from 23 January to 23 February 2018. The preciseness of the timing is indicative of an organised campaign rather than authentic social media activity. The posting activity also largely corresponds with the working week, with breaks for weekends and holidays like Chinese New Year.

A graph showing campaign activity in tweets per day. Weekends and public holidays are indicated by grey shading.

The campaign started on 23 January 2018, the day on which news broke that Chinese police had seized Gui off a Beijing-bound train while he was travelling with Swedish diplomats to their embassy. The campaign then continued at a slower pace across several weeks, ending on 23 February 2018. The tweets are entirely in Chinese language and emphasise Gui’s role in the traffic accident, painting him as a coward for attempting to leave the country and blaming Western media for interfering in the Chinese criminal justice process. Some also used Gui’s name as a hashtag.

  • tweetid: 956700365289807872
  • Time stamp: 2018-01-26 01:28:00 UTC
  • Userid: 930592773668945920
  • User display name: 赵祥
  • User screen name: JonesJones4780
  • Tweet text: ‘#桂民海 因为自己一次醉驾,让一个幸福家庭瞬间支离破碎,这令桂敏海痛悔不已。但是,他更担心自己真的因此入狱服刑。于是,在法院判决后不久、民事赔偿还未全部执行完的时候,桂敏海做出了另一个错误选择.’ – 26 January 2018

Translation: ‘#GuiMinhai deeply regrets that a happy family was shattered because of his drunk driving. However, he’s even more worried that he’s actually going to have to serve a prison sentence for it. Therefore, not long after the court’s decision and before any civil compensation was paid out, Gui Minhai made another bad choice’

  • tweetid: 956411588386279424
  • Time stamp: 2018-01-25 06:21:00 UTC
  • Userid: 1454274516
  • User display name: 熏君
  • User screen name: nkisomekusua
  • Tweet data: ‘#桂敏海 西方舆论力量仍想运用它们的话语霸权和双重标准,控制有关中国各种敏感信息的价值判断,延续对中国政治体制的舆论攻击,不过西方媒体这样的炒作都只是自导自演,自娱自乐.’ – 25 January 2018

Translation: ‘#GuiMinhai Western public opinion forces still want to use their discourse hegemony and double standards to control value judgments of all kinds of sensitive information about China and are continuing their public opinion attacks on the Chinese political system. However, this kind of hype in the Western media is just a performance they’re doing for themselves for their own personal entertainment.’

Others amplify the messages of Gui’s “confession”, claiming that he chose to hand himself in to police of his own volition due to his sense of guilt.

  • tweetid: 959276160038289408
  • Time stamp: 2018-02-02 04:03:00 UTC
  • Userid: 898580789952118784
  • User display name: 雪芙
  • User screen name: Ryy7v3wQkXnsGO8
  • Tweet text: ‘#桂敏海     父亲去世他不能奔丧这件事情,对桂敏海触动很大。他的母亲也80多岁了,已经是风烛残年,更让他百般思念、日夜煎熬,心里总是有一种很强烈的愧疚不安。所以他选择回国自首.’ – 2 February 2018

Translation: The death of #GuiMinhai’s father and the fact he couldn’t return home for the funeral greatly affected him. His mother is also over 80 years old and is already in her twilight years, causing him to suffer day and night in every possible way. There was always a strong sense of guilt and uneasiness in his heart. So he chose to return to China and give himself up.’

It seems likely that this was a short-term campaign intended to influence the opinions of overseas Chinese who might see reports of Gui’s case in international media.
 

Campaign against Yu Wensheng

On precisely the same day as the information operation against Gui started, another mini-campaign appears to have been launched. This one was aimed against human rights lawyer and prominent CCP-critic Yu Wensheng.

Yu was arrested by Chinese police whilst walking his son to school on 19 January 2018. Only hours before, Yu had tweeted an open letter critical of the Chinese government, and called for open elections and constitutional reform. Shortly after, an apparently doctored video was released, raising questions about whether Chinese authorities were attempting to launch a smear campaign against Yu.

In this dataset, tweets targeting Yu Wensheng begin on 23 January 2018—the same day as the campaign against Gui Minhai—and continue through until 31 January (only four tweets take place after this, the latest on 10 February 2018). This was a small campaign, consisting of roughly 218 tweets from 80 accounts, many of which were the same content amplified across these accounts. As with Gui, Yu’s name was often used as a hashtag.

This graph shows campaign activity in tweets per day over time. Selected weekends are highlighted in grey.

The content shared by the campaign was primarily condemning Yu for his alleged violence against the police as shown by the doctored video.

  • tweetid: 956707469677359104
  • Time stamp: 2018-01-26 01:56:00
  • Userid: 0jFZp2sQdCYj8hUveyN4Llxe2UvFbQgTqxaymZihMM0
  • User display name: 0jFZp2sQdCYj8hUveyN4Llxe2UvFbQgTqxaymZihMM0
  • User screen name: 0jFZp2sQdCYj8hUveyN4Llxe2UvFbQgTqxaymZihMM0
  • Tweet text: ‘#余文生 1月19日,一余姓男子在接受公安机关依法传唤时暴力袭警致民警受伤,被公安机关依法以妨害公务罪刑事拘留。澎湃新闻从北京市公安机关获悉,涉案男子系在被警方强制传唤时,先后打伤、咬伤两名民警.’ – 26 January 2018.

Translation: ‘#YuWensheng On January 19, a man surnamed Yu violently assaulted a police officer while receiving a legal summons from the public security bureau, and was arrested for obstructing government administration. Beijing Public Security Bureau told The Paper [a Chinese publication] that the man involved in the case wounded the officers repeatedly by biting them when he was being forcibly summoned by the police.’

As with the other campaigns, however, accusations of supposed Western influence were also notable: 

  • tweetid: 956742165845090304
  • Time stamp: 2018-01-26 04:14:00 UTC
  • Userid: 2l1eDka0eiClBUYoDXlwYaKcUaeelnz44aDM9OJRM
  • User display name: 2l1eDka0eiClBUYoDXlwYaKcUaeelnz44aDM9OJRM
  • User screen name: 2l1eDka0eiClBUYoDXlwYaKcUaeelnz44aDM9OJRM
  • Tweet text: ‘#余文生  在中国,有一批人自称维权律师,他们自诩通过行政及法律诉讼来维护公共利益、宪法及公民权利,并鼓吹西方民主、自由,攻击中国黑暗、专制、暴力执法、缺乏法治精神,视频主人公余文生律师也正是其中的一员.’ – 26 January 2018

Translation: ‘#YuWensheng  It can be seen from Yu Wensheng’s past activities that he is one of the so-called rights lawyers in China. Yu Wensheng thinks that with the support of foreign media and rights lawyers, he can become a hero and that naturally, some people will cheer for him. Little did he know that this time the police were wearing a law enforcement recording device that they used to record an overview of the incident and quickly published it to the world. Yu’s ugly face was undoubtedly revealed to the public.’

  • tweetid: 958222061972832256
  • Time stamp: 2018-01-30 06:15:00 UTC
  • Userid: Kmto+XqJ6hcowk0GvAGVEasNxHUW11beLphANrm3uhE=
  • User display name: Kmto+XqJ6hcowk0GvAGVEasNxHUW11beLphANrm3uhE=
  • User screen name: Kmto+XqJ6hcowk0GvAGVEasNxHUW11beLphANrm3uhE=
  • Tweet text: ‘#余文生 从余文生过去的活动中可以看到,他是国内所谓维权律师中的一员。余文生认为身后有国外媒体以及维权律师群体的支持,他就能成为英雄,自然有人为他摇旗呐喊。殊不知这次警察佩戴了执法记录仪,录下了事件的概况,并迅速公布于世,余的丑陋嘴脸在公众暴露无疑.’ – 30 January 2018.

Translation: ‘#YuWensheng In China, a group of people claim to be rights defenders. They claim to protect the public interest, constitution and civil rights through administrative and legal proceedings. They advocate for Western democracy and freedom and attack China’s darkness, autocracy, violent law enforcement and the lack of the rule of law. Lawyer Yu Wensheng, the star of the video, is also one of them.’

As with the other campaigns seen in this dataset, it seems probable that the motivation behind this effort was to convince overseas Chinese to believe the Chinese Communist Party’s version of events, bolstering the doctored video of Yu and amplifying the smear campaign.

Campaign against protesting PLA veterans

Another information campaign aimed at influencing public opinion appears to have taken place in response to the arrest of ten Chinese army veterans over protests in the eastern province of Shandong.

The protests took place in October 2018, when around 300 people demonstrated in Pingdu city to demand unpaid retirement benefits for veterans of the People’s Liberation Army (PLA). The protests allegedly turned violent, leading to injuries and damage to police vehicles. On 9 December 2018, Chinese state media announced that ten veterans had been arrested for their role in the protest. China Digital Times, which publishes leaked censorship instructions, reported that state media had been instructed to adopt a “unified line” on the arrests.

On the same day, a small but structured information operation appears to have kicked into gear. Beginning at 8:43am Beijing time, accounts in the dataset began tweeting about the arrests. This continued with tweets spaced out every few minutes (a total of 683) until 3:52pm Beijing time. At 9:52pm Beijing time the tweets started up again, this time continuing until 11:49pm.

This graph shows campaign activity over the day by hour of the day adjusted for Beijing UTC+8 time.

Activity by the accounts in the dataset included tweets as well as retweeting and responding to one another’s tweets, creating the appearance of authentic conversation. There was significant repetition within and across accounts, however, with many accounts tweeting a phrase and then tweeting the exact same phrase repeatedly in replies to the tweets of other accounts.

The content of the tweets supported and reinforced the message being promoted by state media, in condemning the protestors as violent criminals and calling for them to be punished.

  • tweetid: 1071589476495835136
  • Time stamp: 2018-12-09 02:16:00 UTC
  • Userid: 53022020
  • User display name: sergentxgner
  • User screen name: sergentxgner
  • Tweet text: ‘中国是社会主义法治国家,绝对没有法外之地和法外之人,法律面前人人平等。自觉遵守国家法律、依法合理表达诉求、维护社会正常秩序,是每一位公民的义务和责任。对任何违法犯罪行为,公安机关都将坚决依法予以打击,为中国公安点赞,严厉惩治无视法律法规之人,全力保障人民群众生命、财产安全.’ – 9 December 2018

Translated: ‘China is a socialist country ruled by law. There’s no place and no people in it that are above the law. All people are equal before the law. It is the duty and responsibility of every citizen to consciously abide by the laws of the state, to express their demands reasonably and according to the law, and to maintain the normal social order. Public security organs will resolutely crack down on any illegal or criminal acts in accordance with the law. Like [this post] for China’s public security, severely punish those who ignore laws and regulations, and fully protect the lives and property of the people.’

  • tweetid: 1071614920846786560
  • Time stamp: 2018-12-09 03:58:00 UTC
  • Userid: 4249759479
  • User display name: 林深见鹿
  • User screen name: HcqcPapleyAshle
  • Tweet text: ‘这些人的行为严重造成人民群众的生命财产安全,就应该雷霆出击,绝不手软.’ – 9 December 2018

Translated: ‘The behaviour of these people has seriously caused [harm to] the safety of the lives and property of the people. They should strike out like a thunderclap and not relent.’

[NB: This tweet may have been typed incorrectly and missed out a character or two. It should probably say that the behaviour endangered the lives and property of these people.]

Again, it appears likely that the motivation behind this campaign was to influence the opinions of overseas Chinese against critical international reporting (although international coverage of the arrests appears to have been minimal, which perhaps helps to explain the short-lived nature of the campaign) and videos of the event being circulated on WeChat that contradicted the official narrative.

Dormant accounts and Chinese language tweets

The information operation against Guo Wengui appeared to begin on 24 April 2017. Our research also tried to determine whether earlier PRC-related information operations had taken place. 

Chinese language tweets.

One measure we examined was the percentage of Chinese language tweets per day in the dataset. Twitter assigns a ‘tweet_language’ value to tweets, and manual examination of a sample of tweets showed that this was approximately 90% accurate.

Figure 11: Percent Chinese language tweets per day from Jan 2017 onwards.

Figure 11 shows that prior to April 2017 there was no significant volume of Chinese language tweets in the network of accounts that Twitter identified. A noticeable increase is seen by July 2017, and a significant volume of the tweets are identified as Chinese from then on, with a peak at over 80% in October 2017.

This measure does not support the existence of significant PRC-related operations prior to April 2017, unless their initial operations occurred in languages other than Chinese.

Account creation and tweet language

A second measure examined when accounts were created and the language they tweeted in.

Figure 12: Account creation day by percent Chinese tweets and follower size from 2008 to July 2019.

Figure 12 shows when accounts were created with time on the x-axis, compared to percent Chinese tweets over the lifetime of the account y-axis, with size of point reflecting follower numbers.

Figure 13: Account creation day by percent Chinese tweets and follower size from April 2016 to July 2019.

Figure 13 is the same data from April 2016 to July 2019.

In Figure 12 and Figure 13 we can see a vertical stripe in July 2016, and more in August through October 2017. These stripes indicate many accounts being created at close to the same time. From July 2017 new accounts tweet mostly in Chinese.

These data indicate that accounts were systematically created to be involved in this network. Accounts created after October 2017 tweet mostly in Chinese, with just a couple of exceptions. There are also a group of accounts that were created in July 2016 that were involved in the network that were created close to simultaneously.

Sleeper Accounts

The dataset contained 233 accounts that had greater than year-long breaks between tweets. These sleeper accounts were created as early as December 2007, and had breaks as long as ten years between tweets.

Figure 14: Tweets over time as represented as dots coloured by tweet language for accounts with a greater than one-year gap between tweets. More than year-long gaps between tweets are represented by grey lines.

Figure 14 shows the pattern of tweets for these accounts over time. These accounts tweeted in a variety of languages including Portugese, Spanish and English, but not Chinese prior to their break in activity. After they resumed tweeting there is a significant volume of Chinese language tweets.  

The bulk of these sleeper accounts begin to tweet again from late 2017 onwards. These data support the hypothesis that PRC-related groups began recruiting dormant accounts into their network from mid- to late-2017 and onwards. 

Figure 15: Tweets over time as represented as dots coloured by tweet language for accounts with a greater than one-year gap between tweets that were created between June and August 2016.

Figure 15 shows the tweeting pattern of accounts created in June and August 2016. These accounts can be seen as a vertical stripe in Figure 13.

The presence of long gaps in tweets immediately after account creation before reactivation and tweeting mostly in Chinese from early 2018 does not support the hypothesis that PRC-related elements were engaged in active information operations before April 2017. It is possible that these accounts were created by PRC-related entities expressly for use in subsequent information operations, but our assessment is that it is more likely that these inactive accounts were created en masse for other purposes and then acquired by PRC-related groups.

This research did not identify any evidence for other PRC-related information operations earlier than April 2017.

Conclusion

The ICPC’s preliminary research indicates that the information operation targeting the Hong Kong protests, as reflected in this dataset, was relatively small hastily constructed, and relatively unsophisticated. This suggests that the operation, which Twitter has identified as linked to state-backed actors, is likely to have been a rapid response to the unanticipated size and power of the Hong Kong protests rather than a campaign planned well in advance. The unsophisticated nature of the campaign suggests a crude understanding of information operations and rudimentary tradecraft that is a long way from the skill level demonstrated by other state actors. This may be because the campaigns were outsourced to a contractor, or may reflect a lack of familiarity on the part of Chinese state-backed actors when it comes to information operations on open social media platforms such as Twitter, as opposed to the highly proficient levels of control demonstrated by the Chinese government over heavily censored platforms such as WeChat or Weibo.

Our research has also uncovered evidence that these accounts had previously engaged in multiple information operations targeting political opponents of the Chinese government. Activity in these campaigns show clear signs of coordinated inauthentic behaviour, for example patterns of posting which correspond to working days and hours in Beijing. These information operations were likely aimed at overseas Chinese audiences. 

This research is intended to add to the knowledge-base available to researchers, governments and policymakers about the nature of Chinese state-linked information operations and coordinated inauthentic activity on Twitter. 

Notes

The authors would like to acknowledge the assistance of ICPC colleagues Fergus RyanAlex Joske and Nathan Ruser

Twitter did not provide any funding for this research. It has provided support for a separate ICPC project.


What is ASPI?

The Australian Strategic Policy Institute was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally.


ASPI International Cyber Policy Centre

The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society.


It seeks to improve debate, policy and understanding on cyber issues by:

  1. conducting applied, original empirical research
  2. linking government, business and civil society
  3. leading debates and influencing policy in Australia and the Asia–Pacific.

The work of ICPC would be impossible without the financial support of our partners and sponsors across government, industry and civil society. ASPI is grateful to the US State Department for providing funding for this research project.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.


© The Australian Strategic Policy Institute Limited 2019

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

Asia’s Great Huawei Debate – A special on The Diplomat

Experts on Singapore, South Korea, India, Japan, and Australia weigh in on the Chinese telecom firm’s reception. Experts Pauline ReichJune ParkAman ThakkerMotohiro Tsuchiya, and Danielle Cave explain how the Huawei debate has unfolded domestically in each of those countries, and what conclusions (if any) were reached.

Read a version of this article ‘Australia and the great Huawei debate: risks, transparency and trust on The Strategist here.

Access the Diplomat special Asia’s Great Huawei Debate here;

Mapping conditions in Rakhine State

Executive summary

The Australian Strategic Policy Institute’s International Cyber Policy Centre has combined open-source data with the collection and analysis of new satellite imagery to assess the current status of settlements in northern Rakhine State, Myanmar, which were burned, damaged or destroyed in 2017. As part of this research project, we have also mapped potential repatriation camps and military bases constructed on the sites of former Rohingya settlements.

Our research does not support assertions that conditions are in place to support a safe, dignified and sustainable return of Rohingya refugees to Rakhine State. Satellite analysis shows minimal preparation for a return of half a million refugees. The preparations that are being made raise significant concerns about the conditions under which returning Rohingya would be expected to live. Ongoing violence, instability, disruptions to internet and communications technologies and the lack of information about the security situation in Rakhine add to those concerns.

This research seeks to add to the evidence base available to policymakers and relevant stakeholders about conditions in northern Rakhine, and Rakhine State more broadly. It also seeks to contribute to informed discussions about the best path towards a safe, dignified and sustainable future for the Rohingya refugees.

Online report

Our findings and research methodology has been compiled as an interactive report which is available here.

Link to online research tool

Capabilities, competition and communication

Why the West needs a strategy for technology

Introduction

At the conclusion of his time as a Distinguished Visiting Fellow with ASPI’s International Cyber Policy Centre, Admiral Rogers shares five factors that government and policymakers should consider as they prepare for the next wave of disruptive technologies.

Seeing technology as a capability, not a product

Technology is going to be a core aspect of the future for us, and it’s not just cyber technology. It’s going to be technology writ large. I believe that we can assimilate this. Game-changing technologies with social implications have been a part of human history during our entire existence as a species. We tend to think that the time we’re living in is the most different or somehow the toughest, but it’s not.

There have been game-changing technologies with potential negative second- and third-order effects throughout the history of humanity. We’ve dealt with this before. I believe we can deal with it now. But we’ve got to be willing to sit down and think about this. And we really need to ask ourselves what’s the way forward.

One of my concerns as I left government was, quite frankly, that I didn’t think we fully understood the implications of technology in national security. I thought that in many ways we were still organised and focused along very industrial lines, that we tended to think of ‘technology’ through the prism of something that’s produced. It might be a particular good. It might be a particular service. It might be a particular product. On the other hand, the idea of technology as an underpinning that powers a broader set of activities—I didn’t think we were working our way through this enough.

What’s the right answer for the implementation of a technology that will be a fundamental building block for a nation’s economic competitiveness in this digital world that we’re living in?

I would argue 5G is emblematic of this, because 5G is not just about, ‘Well, I’m going to get a better phone service,’ right? That’s not the heart of it. 5G is going to enable us to address latency issues. We’re going to be able to move massive, increased amounts of data at incredible, stable rates that will turn our handheld digital devices into the kinds of capabilities and functionality that we take for granted today in our laptops and our mainframes.

5G is going to underpin all of that, and it’s only one of many foundational technologies that are being developed right now. As I used to say about 5G in our system, ‘Hey, it’s just the wolf closest to the sled.’ It’s emblematic of a broader set of challenges that we’re going to have to deal with over time.

Rethinking technological competition

In the US, our theory had always been that the edge for us is the innovative power of our private sector. And as long as the government largely stayed out of that, we could compete head to head, and compete very well.

I would argue that for 1G, 2G, 3G, 4G, that worked perfectly. But the dynamics we’re seeing now with 5G are prompting the question of how that strategy works when the competition isn’t a single foreign company. The competition now is an integrated national strategy in which that foreign company is just one component. How does a single private company compete against the integrated efforts and resources of an entire nation-state?

I think we have to be asking ourselves how we need to change our model, because if we think it’s bad now with 5G, I would argue it’ll be even worse when 6G comes along in about three years. It’ll be even worse with artificial intelligence, quantum computing and other new technologies coming down the pipeline right now. We’re going to have a series of technological changes coming up. They’re going to be so foundational that if we don’t change the dynamic, we’re going to have this conversation over and over again.

This is not about stopping any particular nation. This is not about contesting a particular company. This is about ensuring our own and our partners’ competitive ability in the 21st-century digital age. Because, again, you’re going to have to deal with this with other countries and other companies over time. Right now, that happens to be China, Huawei and 5G, but it’ll be something different in the future.

To me, China is not an enemy. They aren’t an adversary. They’re a competitor, and we need to ask ourselves, ‘How do we compete with them?’

Let’s not waste our time trying to figure out how we stop the growth of China, how we contain China. My view is that is a losing strategy. I think a much smarter strategy is that, given that growth, given that rise, how can we work together collaboratively to ensure that the growth is done in a way in which it becomes a part of the greater, broader world order? And that it’s done in a way that optimises outcomes both for China and for its neighbours, including the US.

We shouldn’t approach this as a zero-sum game; I never believe that. I think that for Australia and the US our respective relationships with China are going to be fundamental to our competitiveness and our economic performance in this century. You can’t pretend otherwise.

I think the goal is to make sure that the playing field is level. Once we have a level playing field, then it’s up to our private sector. But the challenge right now is that the playing field is not level, and it’s really difficult for the West’s firms to compete. And I just don’t think it’s realistic to expect them to do this on their own. Levelling the playing field is going to take work. It’s also about ensuring agreements are adhered to and there are consequences for clear breaches.

Developing a strategy

In the end, to me it’s all about developing a strategy. I’m watching other nations develop strategies, and I’m saying to myself, ‘Where’s ours? How did we get ourselves into this situation? And what are we going to do so that we can compete?’

So, let’s think about the strategy we’re going to develop. Let’s think about how we’re going to compete.

Let’s think about how we’re going to ensure our continued strong economic performance, our strong technological edge. How are we are going to retain that? And at the same time as we’re retaining that, how are we going to retain the values of the societies that we’re a part of?

Our number one competitive advantage, I argue, is our values: the idea of freedom, the idea of the choice of the individual, the idea of the private sector’s ability to compete without the constraint of the government. I also argue that the power of innovation is one of our competitive edges, and we should be doing more to support and protect that innovative edge. So I think, again, if we can get to a level playing field, then our inherent advantages—that structure, those values, that ability to innovate—will enable us to compete with anybody.

I think we have to acknowledge that our structures and our processes aren’t really optimised for this world. I also think we have to acknowledge that it all starts from recognition and acknowledgment of the problems, so we’ve got to be willing to do that. You can’t fix anything if you don’t acknowledge that you have an issue.

I think there’s an element of changing structures and changing process in the way we do things. Part of that model which needs to change, at least in the US, is the kind of wall we build between the functions of the government and the private sector. We really need to step back and ask ourselves—given this world of technological change, given technology’s impact on national security and economic competitiveness, given the speed with which this is happening, given the geopolitical applications of some of this technology—some really fundamental questions like, ‘So, what’s the role of the private sector in this world? What’s the role of the government in this world? Are there ways they could team together?’

It doesn’t mean control. A lot of times I hear people say, ‘You’re just arguing that the government should control everything.’ That isn’t what I’m saying. That hasn’t tended to work out so well in many areas, and it’s not a model that I would default to. On the other end, I think there are some things we can do in partnership with each other. I just think we have to be open to the fundamental idea that in this digital age we’ve got to be willing to look at very different approaches to how we do things.

Strengthening our alliances

I think if we’re honest with ourselves, we have tended to take the US–Australia relationship for granted for some time, and that just isn’t going to work for us anymore. We’ve been together in every major conflict in the past century. In the post-9/11 environment, we’ve worked and fought together. Everywhere I’ve been, on the battlefields in Afghanistan and Iraq, in my professional career, I’ve loved hearing the sound of an Australian accent in the middle of nowhere. In some really tough circumstances, hearing that cheery, ‘G’day, mate,’—I just really like that. I think there’s something really powerful about that. But we can’t take this relationship for granted.

The ability to bring like-minded nations together to work on tough problems is a great thing. Five like-minded nations with a broadly common set of values and a willingness to address not only their own national interests but to support others in the execution of theirs, all with the view of ensuring that we’re helping to make the world a better place: that’s a pretty powerful fundamental idea.

I think that’s still very relevant. It doesn’t pretend for one minute that we don’t have national interests and that those interests never differ. It doesn’t pretend that we don’t have respective national interests that we want to make sure are addressed. But I still think that within that framework we can do powerful things together.

One of my concerns is that, if we don’t get this right, if we don’t think about national security, economic competitiveness and the implications of technology, then we’re individually going to make decisions that potentially increase the risk for other partners in the Five Eyes, or which potentially force other members of the Five Eyes to make some really tough choices that might not be in the interest of all five. If we’re not careful, we could start to go down the road where Five Eyes starts to splinter. If that happens, it should be a conscious decision, not something that kind of happens as an afterthought of other choices. We have to work at maintaining those alliances, and we have to be able to articulate their value. The Five Eyes structure is so important, and one of its strengths has been that we’re willing to have a discussion with each other on those kinds of issues.

Communicating with broader audiences about cyber strategy

As policymakers and as leaders, we’ve got to think about how to articulate the challenge of technology in a way that non-technical people can understand and relate to. I don’t think we’re particularly effective at this at times. One point I would make is, ‘Hey, look, we got to articulate these important topics in ways that non-technical people can understand.’

The second point I would make is this. We need to try to provide meaningful, concrete, specific examples, not an apocalyptic, cyber-could-destroy-the-world-around-us story, because what happens with that is you cry wolf too many times and people just tune you out. Instead, we should be trying to break these big, complex problems down into smaller, more understandable, more digestible components that enable us to build a comprehensive strategy.

Speaking only for the US, we have publicly started talking about how cyber is a tool within the toolkit which we will consider using in an appropriate manner, with a legal basis, for various measurable and proportionate responses to other activity.

For example, you saw us acknowledge in congressional testimony that for the November 2018 election cycle in the US, the US Government authorised and executed a strategy designed to preclude the Russians’ ability to do some of the things against US election infrastructure which they did in 2016. That’s significant: firstly, the fact that we did it; secondly, the fact that we’re willing to publicly talk about it.

What this indicates to me is a kind of evolution in strategy and policy which says, ‘Look, we need to acknowledge that being passive and responding quietly has not really gotten us to where we want to be or where we feel we need to be. Therefore, we need to try to do something different.’

The difference is that we need to start publicly talking about cyber as a tool: the fact that we have capabilities, the fact that we’re willing to use them, and then showing our willingness to use them — again, for very specific purposes, under a very specific legal regime and with a very specific sense of proportionality.


ASPI International Cyber Policy Centre

The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society.

It seeks to improve debate, policy and understanding on cyber issues by:

  1. conducting applied, original empirical research
  2. linking government, business and civil society
  3. leading debates and influencing policy in Australia and the Asia–Pacific.

The work of ICPC would be impossible without the financial support of our partners and sponsors across government, industry and civil society.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional.

© The Australian Strategic Policy Institute Limited 2019

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

AISA Partnership with the International Cyber Policy Centre

t

The Australian Strategic Policy Institute’s International Cyber Policy Centre is delighted to announce a new partnership with the Australian Information Security Association (AISA).

As a not-for-profit, AISA champions the development of a robust information security sector by building the capacity of professionals and advancing the cyber security and safety of the public, businesses, and government in Australia.

“We are delighted to have AISA join as a partner,” said the Head of the International Cyber Policy Centre, Fergus Hanson. “AISA has a prominent voice in the information security space in Australia, and we look forward to an enduring partnership.”

AISA chairman Damien Manuel said ASPI’s International Cyber Policy Centre provided the focus needed to highlight the growing importance and impact of cyber-related issues and the need for sustained dialogue.

“The partnership strengthens the relationship between government, businesses and the community,” Mr Manuel said.

In October, AISA will join forces with the Australian Cyber Security Centre in Melbourne to launch the inaugural Australian Cyber Conference. The International Cyber Policy Centre will be an active participant in the Australian Cyber Conference.

Protecting critical national infrastructure in an era of IT and OT convergence

ASPI Policy Brief 18/2019

What’s the problem?

Today, we’re seeing an increasing convergence between the digital and the physical worlds. This is sometimes referred to as the convergence of IT (information technology) and OT (operational technology)—devices that monitor physical effects, control them, or both. More and more devices are becoming interconnected to create the ‘internet of things’ (IoT).

While this brings many benefits, it also brings new types of risks to be managed—a cyberattack on OT systems can have consequences in the physical world and, in the context of a critical national infrastructure provider, those physical consequences can have a potentially major impact on society.

Insecure OT systems can also be a back door to allow attackers to penetrate IT systems that were otherwise thought to be well secured.

Among Australian critical national infrastructure providers, the level of maturity and understanding of the specific risks of OT systems lags behind that of IT systems. There’s a shortage of people with OT security skills, commercial solutions are less readily available, and boards lack specialist knowledge and experience. Mandating or recommending standards could help boards understand what’s expected of them, but it isn’t clear which standards are appropriate for managing these risks.

What’s the solution?

A lesson learned from IT security over the past decade is that impacts are severe unless security is considered up front and threats are managed proactively rather than reactively. As the convergence of IT and OT gathers pace in our critical national infrastructure, urgent action on a range of fronts is needed to address risks introduced by the IT–OT convergence.

Concerted effort is needed to ensure that boards of critical infrastructure organisations are mandated and enabled to decide, communicate and monitor their OT cyber risk appetite; that the right skills and tools are available to address the problems; and that there’s effective sharing of threat intelligence and best practice. Achieving this will require the prioritisation of resources to appropriate parts of government to support these actions.

This paper looks at critical infrastructure policy in Australia, the convergence of cyber and physical systems, and the risk and threat environment applicable to those systems. It then looks at the current state of maturity and how this could be improved, concluding with policy recommendations.

What are OT, ICS and SCADA?

OT refers to operational technology. Gartner defines it as ‘hardware and software that detects or causes a change through the direct monitoring and/or control of physical devices, processes and events’.1

Other terms commonly used in discussions of this area are ICSs (industrial control systems), which are a key sector in OT, and often a key area of concern since, as the name suggests, they’re used to control major industrial processes such as power plants. ICSs are often managed via SCADA (supervisory control and data acquisition) systems, so SCADA cybersecurity is a key focus, as the compromise of the SCADA system allows full control of the industrial process.

This report uses the term OT throughout, as this refers to the full range of cyber–physical systems that should be considered in developing policy approaches to securing critical infrastructure.

Convergence creates risk

IT and OT systems have traditionally been separate but have converged in recent years, as OT devices that monitor and control ‘real-world’ physical systems are increasingly connected to the internet or wider communication networks, in particular in our critical national infrastructure providers.

For example, managers may be provided with a dashboard of the performance of a power plant, allowing operational changes (such as changing load generation) and commercial decisions (such as the execution and pricing of electricity sale contracts) to be made in real time.

Although this brings clear benefits, it also brings new risks. OT systems are no longer isolated and stand-alone, so a cyberattack on the internet-connected combined IT–OT system can have direct physical consequences. When the organisation is part of our critical national infrastructure, such an attack can have a potentially major impact on national security.

Research and survey methodology

This study examined the understanding and management of the risks of IT–OT convergence in critical national infrastructure, particularly the telecommunications, energy, water and transport sectors. These areas are considered the most critical to the security of Australia and are the focus of government legislation. Many of the issues of IT–OT convergence identified here occur in other sectors of the economy and society, although exploring the implications outside of critical infrastructure is beyond the scope of this paper.

This paper drew on desktop research; interviews with key stakeholders in major Australian critical infrastructure providers, generally targeting the senior risk owners, government officials and subject-matter experts; and a survey of a limited sample of critical infrastructure operators (a dozen organisations in the four priority sectors). The survey explored approaches to IT–OT convergence, the level of understanding of the risks, and approaches to managing the risks.

Critical national infrastructure in Australia

In Australia, the federal, state and territory governments have defined critical infrastructure as:

those physical facilities, supply chains, information technologies and communication networks which, if destroyed, degraded or rendered unavailable for an extended period, would significantly impact the social or economic wellbeing of the nation or affect Australia’s ability to conduct national defence and ensure national security.2

Examples include the systems providing food, water, energy, transport, communications and health care.

Critical infrastructure providers in Australia cover a broad range of organisation types—some are government agencies or government-owned corporations, but a large proportion are run by commercial organisations, which may be privately owned companies, public corporations or part of multinational organisations. Government-owned providers may be at the federal, state or local government level, with differing access to resources and security expertise.

The policy for critical infrastructure resilience was launched by then Attorney-General George Brandis in 2015, and is now the responsibility of the Department of Home Affairs. Australian policy sets out two key objectives: to improve the management of reasonably foreseeable risks, and to improve resilience to unforeseen events. Much of our critical infrastructure is owned and operated by commercial organisations and the strategy recognises that, so implementation is intended to be through a broadly non-regulatory business–government partnership.

The Critical Infrastructure Centre was established in January 2017 with a mandate to work across all levels of government and with owners and operators to identify and manage the risks to Australia’s critical infrastructure. It aims to bring together expertise from across the Australian Government to manage complex and evolving national security risks to critical infrastructure from espionage, sabotage and foreign interference. Although other forums, such as the Trusted Information Sharing Network (TISN), look across a broader range of critical infrastructure sectors and threats, budget constraints mean that the Critical Infrastructure Centre has focused on a more limited range of sectors that pose the greatest potential threat to national security if attacked. Therefore, the initial work has focused on understanding potential foreign ownership and control risks, enabled by the Security of Critical Infrastructure Act 2018, which mandates obligations for a range of assets that meet specified thresholds in the electricity, gas, water and ports sectors (currently estimated to number around 165).

In managing broader security risks from potential foreign or domestic actors attacking our critical infrastructure, the Critical Infrastructure Centre also administers the telecommunications sector security reforms, which are based on the Telecommunications and Other Legislation Amendment Act 2017, which came into force on 18 September 2018. The reforms place obligations on providers in the telecommunications sector to ensure the security of their networks and to notify government of changes with potential security impacts, and enable government to obtain information to monitor compliance and to direct providers to do ‘a specified thing that is reasonably necessary to protect networks and facilities from national security risks’.

Cyber–physical convergence

Critical national infrastructure providers are typically significant users of OT in order to automate the services that they provide. They’re under pressure to deliver services more efficiently and at lower cost, due to market competition, technological change, reduced government funding and price regulation.

To achieve this, organisations have sought to automate and integrate more and more of their IT and OT systems. Research for this report showed that, although most organisations hadn’t seen much change in their degree of IT–OT convergence over the past two years, in the next two years they expect a rapid increase in convergence. Most providers interviewed for this report expect a high degree of convergence and extensive two-way connectivity.

Another convergence driver is the proliferation of interconnected devices, often referred to as the ‘industrial internet of things’ (IIoT). This has been helped by the development of open standards, low-powered sensors and electronic controllers, and short-range communication networks.

In the past, an organisation might have had a ‘stovepiped’ system provided by a single vendor communicating using proprietary protocols, with a single gateway into the back-office IT system.

Today, it’s more likely that there will be a range of different vendor systems communicating with each other in a complex mesh network, and the concept of a clear boundary between IT and OT domains is less relevant. A Kaspersky study of 320 worldwide professional OT security decision-makers showed that 53% saw implementing these types of IIoT solutions as one of their top priorities.3

As the volume of data grows due to the exponential increase in connected sensors, the data can be mined to monitor operational performance, scheduling and utilisation, faults and anomalies, compliance and so on. It can, in turn, be used to identify actions to improve effectiveness, often in real time. However, to implement effective machine learning and artificial intelligence algorithms, it is often easiest to connect to today’s public cloud services, which can provide flexible and easy-to-use processing power. This results in a more porous border between corporate IT systems and public networks, and effectively interconnects OT networks with public networks. Although the use of cloud services can bring security opportunities, unless managed appropriately it can bring new vulnerabilities by making formerly separate corporate systems accessible through the wider internet.

Some commentators have noted that getting full value from this sort of data analysis requires close partnership between the users and manufacturers of OT systems. Gartner predicts that, by 2020, 50% of OT service providers will create key partnerships with IT-centric providers for IoT offerings.4 Another report suggests that 95% of organisations using the IoT have some form of partnership with another organisation to implement their IoT solutions, so it’s likely that even for the other 50% of providers many will still have features and services that expect the OT devices to be connected to the internet.5

Communications technologies are also improving: 5G network rollouts by Telstra and Optus are expected to enable better latency and availability for remote applications. This means we’re likely to see more interconnectedness between IT and OT systems not only within organisations but between organisations and supply chains, further increasing complexity and the potential cyberattack surface.

Challenges of OT cybersecurity

The key principles may be similar, but IT cybersecurity is considered much more mature and advanced than OT cybersecurity. This is because IT systems are much more prevalent, the risks are well recognised and there are enough case studies of real-life attacks to ensure focus and understanding of how to address the risks. Historically, OT systems were physically isolated, and cybersecurity was not a priority until the recent convergence trend drove it up the agenda.

There are significant overlaps and similarities, and OT cybersecurity can learn much from IT cybersecurity. Probably 80% of the threats are the same as for IT systems, but it’s with the other 20% where the biggest challenges lie. Some of the key differences are as follows:

  • The risk calculus is different. A successful OT attack can cause major physical damage or even loss of life, which can make a significant difference to the risk appetite.
  • For OT systems, the availability of service is often more important than confidentiality, whereas in IT that priority is often reversed. Shutting down a system to stop an attack might not be an option for an OT system, and even applying updates to fix known vulnerabilities may not always be feasible. Integrity is also more important, given the potential safety-critical impact of changes to data.
  • The operational lifetime of OT systems is typically much longer than that of IT systems. Plant and machinery can last 20–50 years, whereas IT systems may be replaced every 3–5 years. Older systems might not be built to withstand modern threats, and support and security patches might not be available.
  • The threat and attack models are different. Typically, the design of firewalls and security monitoring tools is based on characteristic indicators of IT attacks, meaning that OT attacks could pass through undetected.

The risk and threat environment

A cyberattack on an OT system is not just theoretical—there have already been many publicly reported attacks. As long ago as 2001, a disgruntled subcontractor used remote radio access to release sewage into town water, parks and other areas in Australia.6

More recent examples include suspected nation-state-motivated attacks on Saudi Arabian industry. In 2012, Saudi Aramco, the Saudi national oil company, was hit by a major attack that disabled 35,000 computers, halting all its operations, even though OT systems were not directly attacked.7 In August 2017, attackers breached the safety control systems at a Saudi petrochemical plant, intending to sabotage them and cause an explosion. Fortunately, it appears that a coding error meant they were unsuccessful.8

Other energy companies have also been targeted. In December 2015, a Ukrainian electricity distribution company’s control systems were breached in an attack subsequently attributed to Russia.9 The operator had to switch to manual mode, and approximately 225,000 customers lost power in what was the first publicly acknowledged cyber incident to result in power outages.10

In March 2018, the US Government issued an alert that Russian Government actors were remotely targeting US Government energy, nuclear, water and other critical infrastructure sectors, carrying out reconnaissance as a potential precursor to targeted attacks.11 Interestingly, it appeared to be a multi-stage campaign in which the attackers first targeted small commercial facilities’ networks and then used those systems as a bridge to move into the networks of larger, more critical organisations— an example of exploiting the type of supply-chain connectivity mentioned above.

So far, reported attacks have affected the availability of services, which can still have major impacts on society, but through good design, good fortune, or both, major direct physical impacts have been avoided. However, if the aim of an adversary is to cause significant physical damage and potentially loss of life, it is conceivable that they could compromise the integrity of the systems not only by sabotaging control systems but by modifying monitoring systems to override fail-safe mechanisms and alarms. Fortunately, we haven’t seen any such incidents to date, at least from publicly available information, but the Saudi petrochemical company attack showed this intent, making it a very real possibility that policymakers need to address.

Another class of threat is the potential use of unsecured OT systems as an entry point for penetration of a connected IT system that may otherwise be well protected. Examples of exploitation of unsecured consumer IoT devices have recently been seen; for example, the Mirai botnet ‘weaponised’ devices such as CCTV cameras with default credentials to launch a massive distributed denial-of-service attack.12

The current state of maturity: survey results

At a high level, there’s clear awareness of the threat from IT–OT convergence. The Kaspersky study mentioned above showed that 77% of companies ranked cybersecurity as a major priority, 66% saw targeted attacks as a major concern, and 77% believed that they were likely to be the target of an OT cybersecurity incident.13 Two-thirds saw the advent of the IIoT as bringing even more significant OT security risks.

In all discussions with Australian providers for this report, cyber risks were recognised from board level all the way down through the organisation. While only one organisation of the 12 interviewed had a clear directive on its OT risk appetite, most providers were cautious, stating that their OT risk tolerance was lower than for IT systems, and an assessment of benefits versus risks was made before interconnecting systems. OT cyber risk is reported at least quarterly to the board in two-thirds of the organisations, although it’s normally combined with IT risk rather than reported as a stand-alone item.

It was encouraging that in seven out of 12 cases there was at least one director at board level with some expertise in the area. Over 80% of respondents said they had participated at least occasionally in the sharing of lessons learned and best practice for both IT and OT security across their sector, which perhaps reflects the active engagement of the TISN and other organisations.

However, many organisations clearly felt there was scope to do better. Half said there was room for improvement in their understanding of the degree of convergence in their systems and in ensuring that they had a comprehensive view of the risks and vulnerabilities. Less than half were able to confirm that vulnerability testing of their OT systems was carried out at least annually. Although 11 out of 12 had an approved incident response plan that had been tested within the past 12 months, in a third of cases the OT security incident response plan was considered to be the same as the IT security incident response plan. The different approaches for isolating and recovering from OT attacks, and the focus on availability in OT, mean that recycling the IT response plan for this sort of incident is unlikely to be effective. This probably explains why two-thirds of organisations felt they were only partially prepared or underprepared to respond to a real incident.

An approach for managing the risks—and some of the challenges in doing so

Research for this report suggests several approaches to improve security as a result of IT–OT convergence.

Setting expectations

Effective security starts with leadership. Boards need to provide strong awareness and sponsorship, setting and communicating their risk appetite in a way that drives their approach to IT–OT convergence. Given the lack of board members with specific expertise, the key will be to encourage and enable boards to be more inquisitive—creating a culture in which they can ask questions and explore issues in an open and transparent manner. This shift in board understanding and engagement is what has occurred in recent years with ‘traditional’ cybersecurity.

Critical infrastructure providers have to deal with conflicting pressures, such as maintaining service quality, reducing costs, regulating prices and more. It’s important that government recognises the threats and mandates that providers face to ensure the security of their systems. For government organisations, the recent NSW cyber strategy is a good example that sets a clear mandate for all government agencies to ensure that there are ‘no gaps in cyber security’ related to physical systems.14

A different approach may be needed for commercial providers—not all of them recognise the commercial risk of a security incident and act accordingly, and hence some compulsion and enforcement are probably required. For regulated industries, licence conditions are often used to place clear obligations on providers, although as this is typically done at the state or local level there may be variability across the nation. The telecommunications sector security reform regulations place more specific obligations on telecommunications providers, such as reporting planned changes and potential direction powers; the operation and applicability of this framework should be reviewed to see whether a modified approach would be appropriate for other sectors.

Of course, just mandating or setting a vision is not sufficient; action is needed to see it realised. The right tools need to be made available to enable providers to embed a culture of security throughout the organisation, and the right governance to ensure that this is happening.

Risk identification and management

No single control will eliminate the risk of a cyberattack; hence, given the potentially catastrophic impacts if an incident occurs, providers need to be very clear about their risk appetite as they potentially converge IT and OT. They must build a clear understanding of the various systems—physical systems, networks, software, computers and other devices—and their interdependencies and connectivity. This should allow analysis of potential threat vectors and allow a risk register to be developed and maintained.

Idaho National Lab has proposed a step-by-step approach for mission-critical systems, called ‘consequence-driven, cyber-informed engineering’, to identify the functions whose failure could have catastrophic consequences.15 It proposes that for the ‘crown jewels’ the approach should be to minimise any internet connectivity, and put in analogue monitoring and fail-safes to protect against the risk of failure or sabotage of digital systems. This has already been implemented as a year-long pilot at Florida Power & Light, one of the largest electric utilities in the US. The case for such an approach might not be proven in all cases, but discussion using this sort of framework may help to drive a better definition of risk appetite.

Where the decision is made to converge systems, a ‘defence-in-depth’ approach should be used to reduce the risks. This could include appropriate network segregation, physical security measures, gateways, system and device configurations, user access controls and so on. These need to be backed up by regular monitoring of systems and networks to identify anomalous patterns of behaviour and to investigate them in real time. The costs of defence in depth will clearly need to be factored into decision-making about the efficiency and benefits of specific IT–OT convergence plans.

Given the differences between IT and OT security, the right tools need to be chosen: an IT firewall might not protect an OT network from malicious traffic, and a standard IT security monitoring solution might not detect OT attacks, as the characteristics of hostile activity will be different. Critical infrastructure providers have commented on the lack of mature commercially available solutions to assist with this, although other industry experts consulted suggested the problem may in some areas be overlapping, competing solutions along with unrealistic marketing claims. An appropriate framework would help to assess these claims and identify any gaps in the market where government intervention may be appropriate, whether this is investment to help accelerate development or certifications for products to help buyers assess their efficacy for solving their problems.

Standards and guidance

Standards are always an emotive subject, especially when it comes to security. The right standards can work well in setting a baseline, provided they’re implemented as part of an overall strategy and not as a blind tick-the-box exercise. However, inappropriate standards will at best give a misleading picture and at worst may drive insecure behaviours.

The limited survey conducted for this report asked about some common standards and found that, while the information security standard ISO27001 and the risk management standard ISO31000 were used by 58% and 33% of respondents, respectively, the business continuity standard ISO22301 and the US Department of Energy’s Cybersecurity Capability Maturity Model (ES-C2M2) cyber maturity framework hardly seem to be used at all. However, over 80% were either actively using or considering other OT-specific security standards.

While the research for this report was underway, the Australian Energy Market Operator published the inaugural report into the cyber maturity of energy operators. This was based on self-assessments against a framework developed specifically for this purpose but drawing on a number of international standards as well as Australian Signals Directorate guidance and Australian legislation. The companies voluntarily completed 67 self-assessments, the details of which have not been released, but the conclusion of the report was that the responses ‘identified opportunities to improve cyber security maturity across the sector’.16

Standards should be reviewed on a sector-by-sector basis—for example, using a guiding council of experts in a given sector—in order to identify which standards should be recommended as suitable for organisations to adopt and regularly audit against. 

Education

The general shortage of cybersecurity skills in the workforce has been well documented and discussed,17 but a recurring theme from interviews for this report was an even more acute challenge involving the availability of suitably skilled OT security professionals.

Education will be the key to addressing this gap. This should start with broad user education, as part of building the right culture across an organisation, supplemented by the right policies and processes. This can help avoid some of the most common weaknesses. For example, it’s thought that some of the attacks described above were facilitated by a well-meaning employee inserting an unknown USB stick into a computer to check who it belonged to, and a study by Honeywell18 found that 44% of USB devices present at surveyed industrial facilities had a security issue. Common resources should be created for use in general user education and executive awareness.

The Academic Centres of Cyber Security Excellence program19 should include specific provision for OT security courses to be created, either as stand-alone courses or as part of broader curriculums.

Courses should be available both for those entering the workforce and as ongoing education and professional development for those in the industry. Formal education can be supplemented by other approaches, such as a program of secondments between IT and OT security teams. In any case, while an OT security team needs to be specialised and focused on this area, it will need to work closely with IT security professionals to share expertise and also to identify and stop threats that cross the domains.

Sharing threat information

In cybersecurity, we’re stronger together, and OT security is no exception. Given the relative lack of maturity and the potential risks, it’s vital that there are effective mechanisms for sharing threat information and lessons learned. There seems to be a divide in the availability of sector-specific OT threat intelligence—two-thirds of organisations surveyed for this report received it regularly, but one-third said they received it rarely or not at all. The sharing of OT security information seems to be noticeably less common than for IT security; the reasons cited included resources, contact details and security clearances being focused on IT security.

Several organisations within government can help with building cross-sector threat intelligence information and disseminating it, including the TISN, the Australian Cyber Security Centre and the Business and Government Liaison Unit in the Australian Security Intelligence Organisation. However, there need to be clear leadership and ownership to make this happen, not just by top-down information flow from government but by facilitating sharing between peers in each sector.

This should also be accessible to a broad range of geographically dispersed stakeholders—tier 1 major companies can attend summits in Canberra, but local councils running transport or water companies won’t have the resources for extensive travel. It’s possible that the Critical Infrastructure Centre’s TISN could take on this leadership role, but it would require a significant boost in resources and a change in its operating model to be able to do so.

Incident response readiness

Organisations need to ensure that they have clear response and recovery plans for attacks. The plans need to go beyond theoretical documents that are dusted off and read only when something goes wrong. As noted, there’s room for improvement in testing incident response plans, but organisations need to go one step further with active war-gaming exercises that bring together boards, executives and business continuity teams to work through scenarios, and technical red-team testing that simulates the potential activity of an attacker to test detection and response capabilities.

The Australian Cyber Security Centre runs a national program for the owners and operators of Australia’s critical infrastructure that uses exercises and other readiness activities that target strategic decision-making, operational and technical capabilities, strategic engagement and communications. Additional resources could be provided to ensure that this is extended to cover OT security incident scenarios and is accessible across the spectrum of critical infrastructure providers.

Conclusions and recommendations

Given the potential impact to society and our national security from the accelerating convergence of IT and OT systems, it’s important that this issue is prioritised and managed effectively. Research for this report has shown a general lack of focus, mature understanding and effective solutions. Some of the measures outlined above are already being implemented, but may still need accelerating or boosting, and some are more critical than others. The top three recommendations are as follows:

  1. Boards of critical infrastructure providers need to explicitly set their OT cyber risk tolerance and monitor their organisation’s performance against it. This requires a combination of regulatory mandate and enforcement (building on existing regulatory models, learning from the experience in implementing the telecommunications sector security regulations, and enabling boards to manage risk); for example, through recommended standards and approaches tailored to each sector. Considering ‘worst-case’ outcomes may lead to a list of critical assets that by default should not be connected to external systems unless there are a compelling benefit and robust measures to manage the security risks arising from the connection. The Critical Infrastructure Centre would appear to be best placed to coordinate and drive this across Australia to ensure a common best-practice approach.
  2. Better education and information are needed at all levels to improve the understanding and management of risks, from both a business and a technical point of view. Key areas for action are:
  • General awareness and training. Specialised skills will be in short supply, but boards can be enabled to be curious to ask the right questions to understand and measure the risks and build the right culture, and all users should be educated in threat awareness and basic ‘hygiene’ to remove some of the easy targets for attackers.
  • Specialist courses. The creation and delivery of specific OT security courses should be included in plans for university, TAFE and other institutional programs. 
  • Better threat information sharing. Clarity should be provided on the current range of government agencies that can help with threat intelligence sharing, providing clear leadership and ownership of this responsibility for the critical infrastructure sector.
  • Technical information sharing. There appears to be a perception that there’s a lack of appropriate commercial solutions for protecting OT systems, but globally the market can appear crowded. The maturity of commercial solutions specifically to address OT security requirements should be reviewed. This information could be shared with providers and also used to identify whether there’s a gap that may merit government investment to help accelerate the development of the capabilities needed.

The Australian Cyber Security Centre could lead this activity, aligned with its existing programs of work.

  1. Resources need to be prioritised to ensure that the appropriate organisations are able to implement all of the required actions at the required pace. The longer that action is delayed, the more of a head start malicious actors will have, the more convergence will have taken place without security being at the core, and the greater will be the threat.

Address by author Rajiv Shah at launch event.


Acknowledgements

The author would like to thank Aakriti Bachhawat for her assistance in running the survey, and all those who took the time to respond. Thanks also to those respondents and other government and industry experts who made themselves available for discussions that provided valuable input to this paper.

What is ASPI?

The Australian Strategic Policy Institute was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally.

ASPI International Cyber Policy Centre

The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society. It seeks to improve debate, policy and understanding on cyber issues by:

  1. conducting applied, original empirical research
  2. linking government, business and civil society
  3. leading debates and influencing policy in Australia and the Asia–Pacific.

The work of ICPC would be impossible without the financial support of our partners and sponsors across government, industry and civil society. This research was made possible thanks to the generous support of Thales.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional.

© The Australian Strategic Policy Institute Limited 2019

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

  1. Gartner, Inc., ‘Operational technology (OT)’, IT glossary, no date, online. ↩︎
  2. Australian Government, Critical Infrastructure Resilience Strategy, 2010, online. ↩︎
  3. Wolfgang Schwab, Mathieu Poujal, The state of industrial cybersecurity 2018, CXP Group, June 2018, online. ↩︎
  4. Christy Petty, ‘When IT and operational technology converge’, Smarter with Gartner, 13 January 2017, online. ↩︎
  5. Gemalto, The state of IoT security, 2018, online. ↩︎
  6. Michael Crawford, ‘Utility attack led to security overhaul’, Computerworld Australia, 16 February 2006, online. ↩︎
  7. Jose Pagliery, ‘The inside story of the biggest hack in history’, CNN Money, 5 August 2015, online. ↩︎
  8. Nicole Perlroth, Clifford Krauss, ‘A cyberattack in Saudi Arabia had a deadly goal. Experts fear another try’, New York Times, 15 March 2018, online. ↩︎
  9. John Hultquist, ‘Threat research: Sandworm team and the Ukrainian power company attacks’, FireEye, 7 January 2016, online. ↩︎
  10. Electricity Information Sharing and Analysis Center, Analysis of the cyber attack on the Ukrainian power grid: defense use case, 18 March 2016, online. ↩︎
  11. US Department of Homeland Security, ‘Alert (TA18‑074A): Russian Government cyber activity targeting energy and other critical infrastructure sectors’, US Government, 16 March 2018, online. ↩︎
  12. Josh Fruhlinger, ‘The Mirai botnet explained: how teen scammers and CCTV cameras almost brought down the internet’, CSO, 9 March 2018, online. ↩︎
  13. Schwab & Poujal, The state of industrial cybersecurity 2018. ↩︎
  14. Digital NSW, NSW Government policy: cyber security policy, NSW Government, February 2019, online. ↩︎
  15. Office of Scientific and Technical Information, Consequence-driven cyber-informed engineering (CCE), US Department of Energy, 18 October 2018, online. ↩︎
  16. Australian Energy Market Operator, 2018 summary report into the cyber security preparedness of the national and WA wholesale electricity markets, December 2018, online. ↩︎
  17. AustCyber, Australia’s cyber security sector competitiveness plan, Australian Cyber Security Growth Network, 2018, online. ↩︎
  18. Honeywell, Honeywell industrial USB threat report: universal serial bus (USB) threat vector trends and implications for industrial operators, 2019, online. ↩︎
  19. Department of Education and Training, ACCSE program guidelines, Australian Government, 13 February 2017, online. ↩︎

Foreign Territory: Women in International Relations

Danielle Cave was a lead author in a three-year study by the Lowy Institute for International Policy ‘Foreign territory: Women in international relations’ that revealed severe gender imbalances in Australia’s international relations sector – including Australia’s diplomatic, national security and intelligence community, despite the existence of some prominent trailblazers.

“Australia’s international relations sector — the departments and organisations that are responsible for conducting Australia’s international relations — has a severe gender imbalance in its workforce. While there have been notable trailblazers, the pace of change has been slow and uneven across the sector. Few of the most important diplomatic postings have ever been held by a woman. Women do not appear in the sector’s key policy-shaping activities. Significantly fewer women are rising to senior positions in the sector compared with the Australian public sector as a whole, international peers, and the corporate sector. The gender imbalance in the Australian Intelligence Community is particularly pronounced. It is important for the sector to address this imbalance. A more diverse workforce will not only better reflect Australian society, but make full use of the available talent pool. There is substantial evidence from the private sector that gender-balanced workforces are more effective, efficient, and innovative. Until the sector better represents Australian society it fails to use the best available talent to navigate Australia’s place in an increasingly complex world.

The analysis, which was based on a lengthy and complicated process of collecting data from a 20-year period, took place from 2016–2018 and found three stark divides:

  1. A vertical divide: men and women in the international relations sector experience different pathways to seniority, particularly in the intelligence community
  2. A horizontal divide: women are more common in the ‘people’, corporate or ‘softer’ policy side of the house. We were repeatedly told in interviews that senior women are less likely to be running high-profile policy, operational or intelligence-focused branches and divisions
  3. A sharp ‘international’ divide between the sexes. Spending time overseas is an integral part of the career path for many in the international sector, but there is a disconnect between the gender balances in government agencies in Canberra and in their overseas workforces.

Read media coverage of the report in The Sydney Morning HeraldThe Australian Financial ReviewThe Guardian and on ABC The World.