Archives for May 2021

RICHMOND, Va. (AP) — A Russian-speaking ransomware syndicate that stole data from the Washington, D.C., police department says negotiations over payment have broken down, with it rejecting a $100,000 payment, and it will release sensitive information that could put lives at risk if more money is not offered.

The extortion threat comes amid a separate ransomware attack on a major pipeline that’s affected part of the U.S.’s fuel supply, highlighting the power of internet-savvy criminal gangs to sow mayhem from a half a world away with impunity.

The Babuk group said on its website late Monday that it would release “all the data” it stole from the Washington police department if it did not “raise the price.”

“The negotiations reached a dead end, the amount we were offered does not suit us,” the group said.

The department did not immediately comment and has not said whether it’s negotiated any possible payment.

On Tuesday, the gang released screenshots that appear to be negotiations with the department. They show the gang asked for $4 million and received a counter-offer of $100,000. The authenticity of the screenshots could not be independently confirmed.

If true, it’s an example how complex the ransomware problem is when even police find themselves forced to consider making payments to criminal gangs.

Late last month, the group said it had hacked into the network of the city’s police department and threatened to leak the identities of confidential informants unless an unspecified ransom was paid. Experts said such a release could endanger the lives of the informants.

A day after the initial threat was posted, the gang tried to spur payment by leaking personal information of some police officers taken from background checks, including details of officers’ past drug use, finances and — in at least one incident — of past sexual abuse.

Babuk leaked similar background files on Monday with its threat to release more, said Brett Callow, a threat analyst and ransomware expert at the security firm Emsisoft.

“This is far worse than any hack of other police departments previously,” Callow said, adding that he’s never seen a law enforcement agency pay a ransom before.

Ransomware gangs have been leaking sensitive data from victims for well over a year, but experts said they’ve not seen such aggressive new tactics used before against police departments. The cybercriminal mafias mostly operate in foreign safe havens out of the reach of Western law enforcement.

The average ransom payments last year were $310,000, up 171% from 2019, according to Palo Alto Networks.

The Biden administration has said that curbing ransomware attacks are a top priority, saying they are a threat to national security.

Copyright © 2021 . All rights reserved. This website is not intended for users located within the European Economic Area.

BRUSSELS (AP) — China’s ruling Communist Party has opened a new front in its long, ambitious war to shape global public opinion: Western social media.

Liu Xiaoming, who recently stepped down as China’s ambassador to the United Kingdom, is one of the party’s most successful foot soldiers on this evolving online battlefield. He joined Twitter in October 2019, as scores of Chinese diplomats surged onto Twitter and Facebook, which are both banned in China.

Since then, Liu has deftly elevated his public profile, gaining a following of more than 119,000 as he transformed himself into an exemplar of China’s new sharp-edged “wolf warrior” diplomacy, a term borrowed from the title of a top-grossing Chinese action movie.

“As I see it, there are so-called ‘wolf warriors’ because there are ‘wolfs’ in the world and you need warriors to fight them,” Liu, who is now China’s Special Representative on Korean Peninsula Affairs, tweeted in February.

His stream of posts — principled and gutsy ripostes to Western anti-Chinese bias to his fans, aggressive bombast to his detractors — were retweeted more than 43,000 times from June through February alone.

But much of the popular support Liu and many of his colleagues seem to enjoy on Twitter has, in fact, been manufactured.

A seven-month investigation by the Associated Press and the Oxford Internet Institute, a department at Oxford University, found that China’s rise on Twitter has been powered by an army of fake accounts that have retweeted Chinese diplomats and state media tens of thousands of times, covertly amplifying propaganda that can reach hundreds of millions of people — often without disclosing the fact that the content is government-sponsored.

This type of analysis is possible because Twitter makes more of its data available to researchers than other social media platforms routinely do.

More than half the retweets Liu got from June through January came from accounts that Twitter has suspended for violating the platform’s rules, which prohibit manipulation. Overall, more than one in ten of the retweets 189 Chinese diplomats got in that time frame came from accounts that Twitter had suspended by Mar. 1.

But Twitter’s suspensions did not stop the pro-China amplification machine. An additional cluster of fake accounts, many of them impersonating U.K. citizens, continued to push Chinese government content, racking up over 16,000 retweets and replies before Twitter kicked them off late last month and early this month, in response to the AP and Oxford Internet Institute’s investigation.

This fiction of popularity can boost the status of China’s messengers, creating a mirage of broad support. It can also distort platform algorithms, which are designed to boost the distribution of popular posts, potentially exposing more genuine users to Chinese government propaganda. While individual fake accounts may not seem impactful on their own, over time and at scale, such networks can distort the information environment, deepening the reach and authenticity of China’s messaging.

“You have a seismic, slow but large continental shift in narratives,” said Timothy Graham, a senior lecturer at Queensland University of Technology who studies social networks. “Steer it just a little bit over time, it can have massive impact.”

Twitter, and others, have identified inauthentic pro-China networks before. But the AP and Oxford Internet Institute investigation shows for the first time that large-scale inauthentic amplification has broadly driven engagement across official government and state media accounts, adding to evidence that Beijing’s appetite for guiding public opinion — covertly, if necessary — extends beyond its borders and beyond core strategic interests, like Taiwan, Hong Kong and Xinjiang.

Twitter’s takedowns often came only after weeks or months of activity. All told, AP and the Oxford Internet Institute identified 26,879 accounts that managed to retweet Chinese diplomats or state media nearly 200,000 times before getting suspended. They accounted for a significant share — sometimes more than half — of the total retweets many diplomatic accounts got on Twitter.

It was not possible to determine whether the accounts were sponsored by the Chinese government.

Twitter told AP that many of the accounts had been sanctioned for manipulation, but declined to offer details on what other platform violations may have been at play. Twitter said it was investigating whether the activity was a state-affiliated information operation.

“We will continue to investigate and action accounts that violate our platform manipulation policy, including accounts associated with these networks,” a Twitter spokesperson said in a statement. “If we have clear evidence of state-affiliated information operations, our first priority is to enforce our rules and remove accounts engaging in this behavior. When our investigations are complete, we disclose all accounts and content in our public archive.”

China’s Ministry of Foreign Affairs said that it does not employ trickery on social media. “There is no so-called misleading propaganda, nor exporting a model of online public opinion guidance,” the ministry said in a statement to AP. “We hope that the relevant parties will abandon their discriminatory attitude, take off their tinted glasses, and take a peaceful, objective, and rational approach in the spirit of openness and inclusiveness.”

IDEOLOGICAL BATTLEFIELD

Twitter and Facebook function as formidable — and one-sided — global megaphones for China’s ruling Communist Party, helping to amplify messaging broadly set by central authorities.

Today, at least 270 Chinese diplomats in 126 countries are active on Twitter and Facebook. Together with Chinese state media, they control 449 accounts on Twitter and Facebook, which posted nearly 950,000 times between June and February. These messages were liked over 350 million times and replied to and shared more than 27 million times, according to the Oxford Internet Institute and AP’s analysis. Three-quarters of Chinese diplomats on Twitter joined within the last two years.

The move onto Western social media comes as China wages a war for influence — both at home and abroad — on the internet, which President Xi Jinping has called “the main battlefield” for public opinion.

“On the battlefield of the Internet, whether we can withstand and win is directly related to our country’s ideological security and political security,” he said in 2013, not long after taking power. In September 2019, as Chinese diplomats flocked to Twitter, Xi gave another speech, urging party cadres to strengthen their “fighting spirit.”

Xi has reconfigured China’s internet governance, tightening controls, and bound Chinese media ever more tightly to the party, to ensure, as he said in a 2016 speech, that the media loves, protects and serves the party.

That intimacy was formalized in 2018, when the party consolidated administrative control of major print, radio, film and television outlets under an entity it manages, the Central Propaganda Department.

Like other nations, China has recognized the value of social media for amplifying its messaging and reinforcing its hold on power. But unfettered access to Western social media has given Beijing a unilateral advantage in the global fight for influence.

Twitter and Facebook are blocked within China, and Beijing controls the conversation on domestic alternatives like WeChat and Weibo, effectively cutting off unmediated access to the Chinese public.

“It’s creating a significant challenge for Western democracies. We don’t have the same capacity to influence international audiences given that China has walled off its internet,” said Jacob Wallis, a senior analyst at the Australian Strategic Policy Institute’s International Cyber Policy Centre. “That creates a significant asymmetric advantage.”

Despite the high levels of Chinese government activity, Twitter and Facebook have failed to label state content consistently. In an effort to provide users with more context, Twitter last year began labelling accounts belonging to “key government officials” and state-affiliated media. But Twitter had labeled just 14% of Chinese diplomatic accounts on the platform, as of March 1, failing even to flag dozens of verified profiles.

Twitter said that in keeping with its policy of labelling senior officials and institutions that speak for a country abroad, not all diplomatic accounts will be flagged. It offered no further details on how those decisions are made and declined to provide a list of Chinese accounts that have been labeled.

Facebook also began putting transparency labels on state-controlled media accounts last year. But disclosure is especially weak in languages other than English, despite the fact that Chinese state content has strong distribution in Spanish, French, and Arabic, among other languages.

Facebook had labeled two-thirds of a sample of 95 Chinese state media accounts in English, as of Mar. 1, but less than a quarter of accounts in other languages. Unlike Twitter, Facebook does not flag diplomatic accounts, the majority of which are official embassy and consulate accounts.

Facebook labeled an additional 41 Chinese state media outlets AP and the Oxford Internet Institute brought to their attention, bringing the overall portion of labeled accounts from less than half to nearly 90%. The company said it was looking into the rest.

“We apply the label on a rolling basis and will continue to label more publishers and pages over time,” a company spokesperson said in a statement to AP. The company declined to provide a full list of which Chinese state media accounts it has flagged.

The China Media Project, a Hong Kong research group, found that transparency labels make a difference: Twitter users liked and shared fewer tweets by Chinese news outlets after August 2020, when the platform started flagging them as state-affiliated media and stopped amplifying and recommending their content.

“We need the labels,” said China Media Project director David Bandurski, though he cautioned that they risk painting all Chinese media with the same broad brush, including outlets like Caixin that have managed to maintain a degree of independence. “This is all about co-opting the narrative. Telling China’s story means we the party get to tell China’s story and no one else. That’s happening in Portuguese and Spanish and French. It really is a global plan.”

The outspoken editor-in-chief of China’s Global Times, Hu Xijin, noticed the impact immediately. On Aug. 14, he tweeted his dismay at the “China state-affiliated media” label that had been added to his profile, saying his follower growth had plummeted. “It seems Twitter will eventually choke my account,” he wrote.

COUNTERFEITING CONSENSUS

In early February, China’s state news agency Xinhua published a “fact check” of 24 “lies” it said anti-China forces in the West had been spreading about Xinjiang, where China stands accused of genocide for its brutal, systematic repression of minority Uighur Muslims.

According to Xinhua, the real problem in Xinjiang is not human rights, but Uighur terrorism. Beijing has brought stability and economic development to its restive western region, and information suggesting otherwise has been fabricated by U.S. intelligence agencies, a racist scholar, and lying witnesses, Xinhua said.

The story was picked up by other Chinese state media outlets, amplified by China’s foreign ministry at a press conference, and blasted across Twitter by the foreign ministry and Chinese diplomats in the United States, India, Djibouti, Canada, Hungary, Austria, Tanzania, Kazakhstan, Jordan, Liberia, Grenada, Nigeria, Lebanon, Trinidad and Tobago, Qatar and the United Kingdom.

From there, it was further amplified by devoted but mysterious fans — like gyagyagya10, whose account pushed out an identical quote-tweet and reply, within seconds, to a message about Xinjiang posted by China’s Embassy in London, writing, “Ethnic groups in China are well protected, no matter in economic aspect or in cultural aspect.”

This is the ruling Communist Party’s global propaganda machine in action: Messages set by key state media outlets and the Ministry of Foreign Affairs get picked up by Chinese diplomats around the world, who repackage the content on Twitter, where it is amplified by networks of fake and suspicious accounts working covertly to shape public discourse for the benefit of China’s ruling Communist Party.

Gyagyagya10, who had a single follower, was part of a network of 62 accounts dedicated to amplifying Chinese diplomats in the U.K. that Marcel Schliebs, the Oxford Internet Institute’s lead researcher on the project, found exhibited multiple patterns suggesting coordination and inauthenticity.

Little can be gleaned about gyagyagya10 from the image of abstract art posted as a profile photo and the lack of any sort of personal description. Indeed, none of the accounts in the network had fleshed-out profiles with recognizable names and authentic profile photos.

Gyagyagya10’s account came to life in mid-August at the same time as more than a dozen other accounts that also devoted themselves exclusively to promoting tweets by the Chinese Embassy in London and Ambassador Liu. Then, after Liu left his post at the end of Jan., they went quiet.

The 62 accounts in the network retweeted and replied to posts by Chinese diplomats in London nearly 30,000 times between June and the end of January, the Oxford Internet Institute found. They exhibited unique patterns in the ways they amplified content.

Like gyagyagya10, they often simultaneously posted identical quote-tweets and replies, and they repeatedly used identical phrases like “Xinjiang is beautiful” and “shared future for mankind” in their comments. Other users who engaged with the two diplomatic accounts did neither.

They were also slavish in their devotion, sometimes replying to more than three-quarters of all the ambassador’s tweets. Most weeks, the fake accounts generated at least 30 to 50% of all retweets of Ambassador Liu and the Chinese Embassy in London.

By Mar. 1, Twitter had suspended 31 of the accounts in the pro-China U.K. network and two had been deleted. The remaining 29 — including gyagyagya10 — continued to operate, churning out more than 10,000 retweets and nearly 6,000 replies in support of China’s U.K. diplomats before Twitter permanently suspended them for platform manipulation at the end of April and beginning of May in response to this investigation.

“We are also aware of concerns about some of the Twitter rules,” China’s Embassy in the U.K. said in a statement to AP. “If it is against the rules of social media to retweet the Chinese Embassy’s tweets, then shouldn’t these rules be more applicable to retweets of malicious rumors, smears, and false information against China? We hope relevant companies will not adopt double standards.”

China’s Ministry of Foreign Affairs says China uses social media the same way other nations do, with the goal of deepening friendly ties and facilitating fact-based communication.

In practice, China’s network on Twitter amplifies messaging set by central authorities, both for domestic and global consumption, as diplomats translate, repackage and amplify content from the Ministry of Foreign Affairs and key state media outlets, network analysis and academic research show.

Zhao Alexandre Huang, a visiting assistant professor at Gustave Eiffel University, in Paris, analyzed social media messaging at key points in the U.S.-China trade dispute and found that content first published on the Weibo account of China’s Ministry of Foreign Affairs was repackaged and broadcast around the world by Chinese diplomats on Twitter.

“The Ministry of Foreign Affairs uses Weibo like a central kitchen of information,” Huang said. “It’s an illusion of polyphony.”

Within China’s state network on Twitter, the most referenced accounts belonged to China’s Ministry of Foreign Affairs and its spokespeople, as well as People’s Daily, CGTN, China Daily, and Xinhua, and the most active amplifiers were diplomats, AP network analysis showed.

The party’s efforts on Twitter have been helped by a core of hyperactive super-fans. Some 151,000 users retweeted posts by Chinese diplomats from June through January. But nearly half of all retweets came from just one percent of those accounts, which together blasted out nearly 360,000 retweets, often in bursts of activity separated by just seconds.

Among the biggest beneficiaries of this concentrated bulk engagement — which is not necessarily inauthentic — were Chinese diplomatic accounts in Poland, Pakistan, India, and South Africa, as well as China’s foreign ministry and its spokespeople.

The pro-China accounts that Twitter later suspended were active in a host of languages, with profile descriptions in English, Mandarin, Spanish, Arabic, Hindi, Italian, French, Russian, Korean, Urdu, Portuguese, Thai, Swedish, Japanese, Turkish, German and Tamil. Some worked cross-network to amplify a range of government accounts, while others appeared to function as smaller cells, dedicated to amplifying diplomats in a specific location.

This manufactured chorus accounted for a significant portion of all the engagement many Chinese diplomats got on Twitter. More than 60% of all retweets for the Chinese embassies in Angola and Greece from June 2020 through January 2021 came from accounts that have been suspended. China’s hawkish foreign ministry spokespeople Hua Chunying and Zhao Lijian racked up more than 20,000 retweets from accounts that have been sanctioned by Twitter.

INTERNET COMMENTING SYSTEMS

Within China, manipulation of online discourse has been effectively institutionalized. It remains to be seen how aggressive — and how successful — China will be in implementing its model of public opinion guidance on Western social media, which was founded on very different civic values, like transparency, authenticity, and the free exchange of ideas.

The party’s systems for shaping public opinion online go far beyond censorship. Budget documents for Chinese propaganda and cyberspace departments include references to cyber armies, teams of trained online commentators tasked with keeping conversation online aligned with the ruling party’s interests. Universities in China openly post announcements about their teams of “online commentators” and “youth internet civilization volunteers,” composed exclusively of recruits who “love the motherland” and work to guide public opinion by eliminating negative influences and spreading positive energy online.

For-profit companies also contract with government agencies to run coordinated networks of social media accounts, both human and automated, to help “guide public opinion,” according to Mareike Ohlberg, a senior fellow at the German Marshall Fund’s Asia Program, and Jessica Batke, a senior editor at ChinaFile, an online magazine published by the Asia Society. They poured through thousands of Chinese government procurement notices to identify tenders for such services.

While the majority were for opinion management on domestic platforms, Ohlberg told AP that since 2017 a growing number have also targeted Twitter, Facebook and YouTube. One public security bureau in a relatively small city in northeastern China, for example, wanted to buy a “smart Internet-commenting system,” capable of commenting on Twitter, Facebook and YouTube from thousands of different accounts and IP addresses.

“This is just a natural extension of what the party has been doing at home for a very long time,” Ohlberg said. “Why would they change that model once they go abroad?

China’s advance on Western social media is one part of a much broader infrastructure of influence that has shaped how Hollywood makes movies, what Western publishers print and what overseas Chinese-language media outlets communicate to China’s vast diaspora.

Anne-Marie Brady, a professor at the University of Canterbury in New Zealand and an expert in Chinese propaganda, said people may not even realize that information they receive has been, in part, framed by China’s ruling Communist Party.

“The propaganda system is vast, and it has incorporated Western social media,” she said. “It has helped to reshape perceptions of China. It may not uniquely create a positive image of China, but it creates hopelessness that anything can be done about what China is doing to our democracies.”

____

Associated Press researcher Chen Si in Shanghai contributed to this report.

____

Follow Associated Press reporter Erika Kinetz on Twitter at http://twitter.com/ekinetz

____

Contact AP’s global investigative team at Investigative@ap.org or https://www.ap.org/tips/

Copyright © 2021 . All rights reserved. This website is not intended for users located within the European Economic Area.

CHAMBLEE, Ga. (AP) — More than 1,000 gas stations in the Southeast reported running out of fuel, primarily because of what analysts say is unwarranted panic-buying among drivers, as the shutdown of a major pipeline by a gang of hackers entered its fifth day Tuesday.

Government officials acted swiftly to waive safety and environmental rules to speed the delivery of fuel by truck, ship or rail to motorists and airports, even as they sought to assure the public that there was no cause for alarm.

The Colonial Pipeline, the biggest fuel pipeline in the U.S., delivering about 45% of what is consumed on the East Coast, was hit on Friday with a cyberattack by hackers who lock up computer systems and demand a ransom to release them. The attack raised concerns, once again, about the vulnerability of the nation’s critical infrastructure.

A large part of the pipeline resumed operations manually late Monday, and Colonial anticipates restarting most of its operations by the end of the week, U.S. Energy Secretary Jennifer Granholm said.

Motorists may still feel a crunch because it takes a few days to ramp up operations, but she said there is no reason to hoard gasoline.

“We know that we have gasoline; we just have to get it to the right places,” she said.

S&P’s Oil Price Information Service put the number of gas stations encountering shortages at more than 1,000.

“A lot of that is because they’re selling three or four times as much gasoline that they normally sell in a given day, because people do panic,” said Tom Kloza, an analyst with S&P. “It becomes a self-fulfilling prophecy.”

The pipeline runs from the Texas Gulf Coast to the New York metropolitan area. The states most dependent on the pipeline include Alabama, Georgia, Tennessee and the Carolinas, Kloza said.

In Virginia, 7.7% of the state’s nearly 3,900 gas stations reported running out of fuel Tuesday, according to Gasbuddy.com, which tracks supply. In North Carolina, 8.5% of almost 5,400 stations were out, the company said.

There were scattered reports of higher gasoline prices, but prices were rising even before the pipeline incident heading into the busy summer driving season. Nevertheless, Granholm warned gas station owners, “We will have no tolerance for price gouging.”

To ease brief shortages, the White House is considering temporarily waiving a law that says ships delivering products between U.S. ports must be built and manned by Americans.

The Transportation Department also is relaxing some workforce requirements and enlisting railroads to deliver fuel inland. And the Environmental Protection Agency lifted some fuel quality requirements on an emergency basis.

“We’re looking at every option we have across the federal government and all of the federal agencies,” Granholm said.

In Georgia, Gov. Brian Kemp suspended state taxes on motor fuels through Saturday. Georgia collects a gasoline tax of 28.7 cents per gallon and a diesel tax of 32.2 cents per gallon.

“It will probably help level the price at the pump off for a little while,” Kemp said.

However, he urged people not to hoard gasoline, saying he expects the situation to be resolved soon.

“You don’t need to go out and fill up every 5-gallon can you’ve got,” the governor said.

Scattered gas stations in metro Atlanta were out of fuel Monday and Tuesday. In Georgia, nearly 6% of about 6,400 stations had run out of fuel, Gasbuddy.com said.

In Florida, drivers in some areas faced long lines, and 3% of gas stations had run out.

The state’s governor, Ron DeSantis, declared a state of emergency Tuesday evening in response to the gasoline. The move activates the Florida National Guard, as needed, and directs state emergency management officials to work with federal and local officials.

Virginia Gov. Ralph Northam also declared a state of emergency.

Dave Gussak drove from one station to the next in Tallahassee, Florida, in search of gas, seeing a line nearly a mile long at the pumps outside a Costco. He eventually passed a station with gas on the way to Florida State University where he works.

“This is insane,” he said.

Irena Yanava’s tank was about half full, but she wasn’t about to take chances as she sat in her car at the same Tallahassee gas station.

“I know that I’ll be needing it soon, so why not?” she said.

Citgo’s Fairfax, Virginia, terminal ran out of premium reformulated gasoline, and its Richmond, Virginia, terminal was out of unleaded regular, according to the American Automobile Association, citing a shipper bulletin.

The Colonial Pipeline carries jet fuel as well. American Airlines rerouted two long-haul flights from Charlotte, North Carolina, because of possible shortages. Passengers flying to Honolulu will have to change planes in Dallas, and those heading to London will stop in Boston to refuel.

Southwest and United flights carried extra fuel on flights to Nashville, Tennessee, Baltimore and some other airports in case jet fuel was unavailable at those airports. Normally airlines load only enough fuel for a single flight, because topping off adds to the plane’s weight and hurts mileage. Most planes can carry enough fuel for a round trip, but the extra fuel burn costs money.

___

Bussewitz reported from New York and Caina Calvan reported from Tallahassee. Associated writers Aamer Madhani in Washington, Michelle Chapman in New Jersey and David Koenig in Dallas contributed to this report.

Copyright © 2021 . All rights reserved. This website is not intended for users located within the European Economic Area.