AMITT/incidents/I00034.md

# Incident I00034: DibaFacebookExpedition

* **Summary:** In the Expedition, Diba engaged in a highly organized cyber-attack of a Taiwanese political leader. On January 20, 2016 (the day of President Tsai Ing-wen’s inauguration) featuring the posting of an overwhelming number of social media comments in support of a PRC-sanctioned message. Netizens from one of the largest discussion forums in China, known as Diba, coordinated to overcome China’s Great Firewall to flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message, a cyberattack referred to as the “Diba Expedition to Facebook.” 

Unique for taking place outside of the Chinese Internet system, both transgressing technical and political norms while exposing their actions to an international audience. In spite of the transgressive nature of the action, “Diba Expedition” was highly praised by Chinese official media, in contrast to comparable activities in the past that lacked its explicit pro-government ideology. Yet—reflecting the complexity of Diba’s relationship with the PRC government—the Expedition was shut down after a few days.

* **incident type**: incident

* **Year started:** 2016

* **Countries:** China , Taiwan

* **Found via:** OII

* **Date added:** 2019-02-24
 

| Technique | Description given for this incident |
| --------- | ------------------------- |
| [T0002 Facilitate State Propaganda](../techniques/T0002.md) | I00034T001 Netizens from one of the largest discussion forums in China, known as Diba, coordinated to overcome China’s Great Firewall |
| [T0049 Flooding](../techniques/T0049.md) | I00034T002 flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message |
| [T0049 Flooding](../techniques/T0049.md) | I00034T003 Democratic Progressive Party (DPP), attracted nearly 40,000 Facebook comments in just eight hours. |


DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW

Actor: China

Timeframe: 72 hours?

Date: January 20th, 2016

Presumed goals: 

* The trolls planned their attack for 7pm, China time, on January 20. Members of Di Ba—one of the largest message boards on the internet—would organize into groups, leap over the Great Firewall to reach Facebook, and flood it with the message that Taiwan is part of China. The anti-independence and pro-China posts started to take over the Facebook page of Tsai Ing-wen, Taiwan’s newly elected president

Method: 

* Tsai’s latest Facebook post, about a meeting she had with leaders from her Democratic Progressive Party (DPP), attracted nearly 40,000 Facebook comments in just eight hours.
* News of the attack spread far and wide, with a number of posts making their way around social network WeChat. * For most of the day “Di Ba’s Facebook battle” has been at the top of the list of searched terms on Weibo, a Chinese microblog site similar to Twitter. News outlets in Taiwan covered the story (link in Chinese).
* Information also spread suggesting that Di Ba’s battle was organized and well-prepared. Screenshots showed that attackers were separated into six “columns,” in the military sense: information gathering; posting; writing opinions and creating images; translation; miscellaneous Facebook tasks such as liking posts; and a vanguard to head things up.
* The majority of the 26K comments consisted of lines copied and pasted from the officially designated messages
*  more than 42,000 people had made comments on a single post of Ms Tsai's Facebook page, demanding her self-ruled island be brought under Chinese control.
* Beginning at 7 pm on January 20, 2016 CST (China Standard Time), tens of thousands of
comments against Taiwan independence appeared in posts of Taiwan President-elect Ms. Tsai Ing-Wen’s Facebook page as well as news media’s such as Sanli News and Apple Daily. While the organizers claim to taking further steps on issues against Taiwan independence, the event lasted for less than two days due to Chinese government’s intervention, leaving tens of thousands of comments either deleted or unattended.
* Within this most active group, every username posted 6 comments at least and 12 comments
on average. The most productive one posted 192 comments during this period. Two interesting
findings come from the discrepant mapping result of Facebook usernames and IDs, which imply
participants’ strategy. First, users might share account. We found five IDs, each of which is
associated with different usernames. According to one internal document downloaded from the
QQ group, some participants would register Facebook accounts in advance, and then give them to those responsible for attack. Since Facebook allows users to change their usernames anytime, we speculate whether this may be due to the sharing of accounts but changing the name to differentiate the identity.
* Second, users shared some usernames to maintain the consistency of their identities. The total
number of IDs is more than the number of unique usernames. Many usernames are shared by
different IDs, which account for 2.82% of all 16,891 IDs. One possible reason for this practice is
that during the attack, reporting and blocking accounts is a prevalent tactic used by both sides as defense. Once the account is “dead”, the user has to register for a new account to keep fighting. One commenter said that he/she was blocked over 3 times, but kept registering new accounts to fight. It is thus not surprising to see a small percentage of users who have more than one ID while maintaining the same username.
* More notable is the case where one username is shared by more than 10 IDs. One possible
explanation is that someone dedicates himself/herself to this event and intends to increase their
visibility. However, for those usernames associated with over 30 IDs, we argue that it might be a
unique strategy for attacking or trolling, because it is difficult to log into multiple accounts and
post comments by a single user.

Counters: 

Related incidents: 

References:

* https://www.ideals.illinois.edu/handle/2142/96746
* https://qz.com/598812/an-army-of-chinese-trolls-has-jumped-the-great-firewall-to-attack-taiwanese-independence-on-facebook/
* https://www.abc.net.au/news/2016-01-21/chinese-facebook-users-flooding-taiwan-president-elect-account/7105228
* https://www.businessinsider.com/chinese-people-are-flooding-the-internet-with-a-campaign-against-taiwan-2016-1