Today’s tactics and techniques assessment examines the article “Facebook uncovers Chinese network behind fake expert” published 02 Dec 2021 by BBC News.
Facebook owner Meta Platforms has removed more than 500 accounts linked to an online disinformation network primarily based in China. The accounts had promoted the claims of a fake Swiss biologist called “Wilson Edwards”, who alleged the US was meddling in efforts to find the origins of Covid-19. Edwards’ comments had been widely carried by Chinese state media outlets. However, the Swiss embassy said that it was unlikely this person existed.
Tactic: Establish Legitimacy (TA16)
Technique: Create fake experts (T0009)
Threat Actors Establish Legitimacy during the Prepare phase of an Influence Operation. One Technique they can use to achieve this Tactical goal is Creating Fake Experts.
When someone doesn’t know much about a topic (but wants to learn more), they need to defer to experts who’ve spent lots of time learning about it. A threat actor pretending to be an expert can say untrue things which help progress their objectives, while benefiting from victims
Earlier in July, an account posing as a Swiss biologist called Wilson Edwards had made statements on Facebook and Twitter that the United States was applying pressure on the World Health Organization scientists who were studying the origins of Covid-19 in an attempt to blame the virus on China […] However, the Swiss embassy said in August that the person likely did not exist
Tactic: Establish Social Assets (TA15)
Technique: Create Inauthentic Accounts (T0090)
Sub-Technique: Create Shelf Accounts
Sub-Technique: Use AI-Generated Profile Picture
Inauthentic Social Media accounts are categorised as Shell Accounts when little to no effort has been made to appear legitimate (e.g. no friends, followers, photos, innocuous posts, etc.). A Shelf Account has had more effort made to fabricate a user history (1).
The Facebook account [of the fake expert] was opened only two weeks prior to its first post and only had three friends. […] It added that the operation used Virtual Personal Network (VPN) infrastructure to conceal its origin, and to give Edwards a more rounded personality. It also said that his profile photo also appeared to have been generated using machine-learning capabilities.
Technique: Uncritically Repeat False Narrative
Media reporting on statements created by a fake expert help amplify the inauthentic message. Users exposed to the fake expert’s statements in this way are less able to audit the expert’s ‘credibility’. Media reporting can amplify false messages intentionally (disinformation; they knew the expert was fake, but reported it as true regardless) or unintentionally (misinformation; they did not know the expert was fake).
Earlier in July, an account posing as a Swiss biologist called Wilson Edwards had made statements on Facebook and Twitter that the United States was applying pressure on the World Health Organization scientists who were studying the origins of Covid-19 in an attempt to blame the virus on China.
State media outlets, including CGTN, Shanghai Daily and Global Times, had cited the so-called biologist based on his Facebook profile.
Platforms: Twitter, Facebook, State Media
Narrative Theme: Coronavirus
1. Online Information Laundering: The Role of Social Media by Kirill Meleshevich and Bret Schafer on 09 Jan 2018
The intention of this series is to make it easier to understand why the article has been tagged with particular tactics or techniques. Associating reporting of real-world attacks with DISARM tactics and techniques helps us get a better understanding of how they have practically been used, who’s used them, and who they’ve been used against. To do this a relevant quote from the article will be provided under the title of the associated technique. If the technique exists in DISARM, then its identifier will be included too.