He is a member of the French intelligence services and a veteran of several wars and terrorist attacks. And given that the coronavirus crisis is now impinging on his domain, he is not letting his guard drop. “We should all be pulling in the same direction to hold back this epidemic,” he said. “But instead some are putting sticks in the wheels of everyone else to further their own petty interests. Put like that, it's tantamount to treason!”
So who or what is this French agent talking about; a failure of state services to coordinate properly, or the people flooding social networks with fake news? No, this spy has reserved his anger for the propaganda machines and trolls farms bankrolled by foreign governments.
Enlargement : Illustration 1
In recent days several sources have spoken to Mediapart of their anger at the operations carried out by different states who have been cynically exploiting the prevalence of conspiracy theories and plots over the origins of the virus. These states have run disinformation campaigns, manipulated public opinion and criticised the actions of other governments, who have been labelled as incompetent in contrast with the claimed efficacy of their own authoritarian regimes.
According to one security service memo sent to the highest echelons of the French state, the main problems have been the “deliberate actions of the propaganda machines of the Russians, Chinese and Iranians, who are seeking to deflect media attention from their own responsibilities”.
Russia was singled out in a vitriolic internal European Union report that was revealed in the Financial Times last week. According to the newspaper this nine-page report, dated March 16th 2020 , describes a “large range” of attempts on a global scale to exploit the Covid-19 pandemic by spreading what the paper calls “implausible narratives”. The analysis from the European External Action Service’s strategic communications division states: “The overarching aim of Kremlin disinformation is to aggravate the public health crisis in western countries, specifically by undermining public trust in national healthcare systems - thus preventing an effective response to the outbreak.”
The Financial Times stated that since January 22nd the EU has recorded in its database almost 80 cases of Covid-19-related disinformation efforts. And that “Russian state-linked false personas and accounts” that have previously posted on subjects including Syria and the French 'yellow vest' protests had switched to “pushing disinformation about the coronavirus in English, Spanish, Italian, German and French online”. According to the newspaper the EU report said Pro-Russian content sometimes promoted the notion that coronavirus was “a human creation, weaponised by the West”.
Mediapart's investigations show that the pro-Kremlin propaganda in France has focussed on extolling the “exceptional” way that Russia has handled the pandemic so far. One message reads: “RUSSIA: ZERO DEATHS AND JUST 20 INFECTIONS. Thanks to having protected the borders from the first minute and having put tourists in quarantine.” The accompanying unsubtle image shows Russian leader Vladimir Putin relaxing in the sunshine while an accompanying map shows how the whole of Europe has been invaded by the virus – except Mother Russia. This meme has gone viral in recent days.
Casting their net wide on social networks – targeting groups who support the forces of law and order in France as well as the 'yellow vest' protestors – some false profiles, using poor French, have been passing on articles which play on the fears of the French people, for example the need to close the borders and so on.
In a 2018 report on the “manipulation of information” (*see bottom of page for full reference), researchers from the ministries of defence and foreign affairs in France pointed out that 'dezinformatzia' – Russian disinformation – is above all reactive. “The Kremlin doesn't so much create crises as exploit existing vulnerabilities, the divisions, the political or inter-communal tensions, and fan the flames,” it noted.
According to the French memo mentioned earlier, Chinese propaganda has recently been much more proactive in a bid to clear the country's name over where the virus originated. And in a bid, too, to respond to the violent provocations from President Donald Trump who has often referred to the “Chinese virus”. In his entourage others speak of the “Wuhan virus”, a reference to the province of China where the outbreak started. As the website Media Matters has pointed out, these terms have been picked up by many conservative or far-right websites and media.
Enlargement : Illustration 2
China's one-party state is conducting a propaganda offensive which is aimed both at its own citizens and people in other countries. The campaign contains all the classic elements of a strategy that has been put in place since Xi Jinping, the country's president, came to power at the end of 2012: demonstrating that the dictatorial Chinese model is just as legitimate and even more effective than the Western democracies, who are in turn accused of wanting to block China's emergence as a great power. The campaign's messages also aim to show that there is a “China solution” amid the challenges posed by globalisation. Xi Jinping used this expression for the first time in July 2016 to mark the 95th anniversary of the Chinese Communist Party. He said: “The Chinese Communist Party and the Chinese people are fully confident that they can provide a China Solution to humanity’s search for better social institutions.”
To spread this message - of how to manage an epidemic which has been contained in China despite the initial delay in reacting to its outbreak – one first has to deploy all the know-how of the powerful machinery of propaganda. According to Antoine Bondaz of the France-based Foundation for Strategic Research (FRS), in 2013 Xi set out the parameters of external propaganda, setting it the task of “better describing China's history and making China's voice heard”. Bondaz wrote recently on the FRS's website that “although the Chinese authorities are trying to keep a low profile over their responsibilities and to minimise their mistakes in the initial handling of the Covid-19 epidemic, they are now seeking to profit from the pandemic by promoting the country's health diplomacy in order to achieve political, diplomatic and economic objectives”.
That is indeed what Beijing is now trying to do, using all the means at its disposal – including increased censorship of the media and social networks inside its borders (see the FRS article here) – to promote what some have dubbed “mask diplomacy”, emphasising the provision of equipment to virus-hit countries in Europe and Africa. Questioned by German news organisation Deutsche Welle, Maria Repnikova, an expert in Chinese political communication at Georgia State University in the United States, said that by doing this China had managed to move away from being seen as a “troublemaker” and instead has been hailed as a “global leader” and an “example” on the management of the crisis.
What is relatively new, and what is growing at the moment, is the massive use of Western networks such as Twitter to promote these messages. Even Chinese ambassadors have started to use this American platform, which is blocked in China itself. One of the first to have done so was Zhao Lijian who signed up when he was based at the Chinese embassy in Washington between 2009 and 2013. In July 2019, when he was number two in his country's embassy in Pakistan, Zhao Lijian caused a row when – in response to claims about China's repression of its Muslim Uygur population in Xinjiang province – he wrote a Tweet attacking state racism in the United States.
Some thought that when he was subsequently recalled to Beijing, Zhao Lijian had been punished. But far from it. In fact he was promoted and is now one of the official spokespeople for China's Foreign Ministry who give daily press conferences.
From his new Beijing position the Chinese official has not shied away from passing on conspiracy theories suggesting that the current epidemic may have been brought to China by American soldiers who visited the country in October 2019 to take part in the Military World Games held in Wuhan in October 2019. Zhao Lijian belongs to the new generation – he was born in 1972, the year of President Richard Nixon's historic visit to Beijing – who are happy to take the gloves off when responding to the Americans. The old guard, meanwhile, who are still attached to certain old school principles from the past, is represented by figures such as Cui Tiankai, 67, the current Chinese ambassador in the US, who described the conspiracy theories passed on by Zhao as “crazy”.
Not to be outdone, the Chinese embassy in France has also discussed such conspiracy theories and 'liked' rather undiplomatic Tweets in which some sections of the media are described as “fascists carrying out white supremacist propaganda”. Further proof of this new Chinese propaganda being used on Twitter are the French-based accounts 'Consulat général de Chine à Strasbourg', set up in the north-eastern city in February, and 'Consulat Général de Chine à Lyon' established in the eastern French city this month. Both accounts have so far just handled content about the coronavirus outbreak and the aid coming from China.
'One of the biggest cyber-espionage campaigns in recent years'
What is also new is the use by the Chinese of rhetoric and methods which until now had been the sole province of the Russians. This includes the use of false or hacked accounts to spread messages favourable to the Chinese communist regime. This change of approach was highlighted in a major study by the website ProPublica, based on an analysis from April 2019 of thousands of Twitter accounts. Some private Chinese agencies were called in to help, and they even offered to pay leading figures Tweeting in Chinese - and who had more than 10,000 followers - to pass on pro-Beijing messages. Ironically, it was because one of these agencies contacted a Chinese-Australian artist known for his criticism of the Chinese regime that these details emerged; he was offered 240 dollars per published Tweet to send out a 15-second propaganda video.
On Sunday March 29th France's European affairs minister, Amélie de Montchalin, criticised such propaganda stunts. “It's sometimes simpler to use propaganda, with beautiful images, and to exploit what's going on,” she said. “I'm speaking about China and Russia who stage manage some things” she added, noting however that “you can't manipulate solidarity”.
“Lots of researchers used to say that China didn't do the same as Russia, and the latter was described as a 'hurricane' while the former was seen as 'a change in the climate' [editor's note, when it comes to foreign propaganda],” said the FRS's Anoine Bondaz. “But today China is using the same tools as Russia. This aggressive strategy was only used for Taiwan. Now it does it everywhere, even in Europe.”
One French intelligence source has a different take from other sources. “In my view it's not interference as we understand it in our service,” he said. “There are no advancing agents wearing masks. Even the trolls on the social networks have been known about for a long time. Things are relatively clear, everyone is working in their usual corner. This is more about diplomacy.”
However, the current spate of cyber attacks are undoubtedly a form of modern espionage. In a note published on March 26th, researchers at American cybersecurity firm FireEye highlighted the actions of a group called APT41, Chinese hackers who have been used by the People's Republic. It was “one of the broadest campaigns by a Chinese cyber espionage actor we have observed in recent years”, said FireEye.
The American firm said that between January 20th and March 11th, it observed the Chinese hackers trying to exploit vulnerabilities in the IT systems of at least 75 companies spread over around 20 countries, including the United States, the United Kingdom, Italy and France. Among the victims were banks and defence sector companies but also pharmaceutical and health firms. The experts at FireEye said there was a lull in APT41 activity between January 23rd and February 1st, which was “likely related to the Chinese Lunar New Year holidays”.
Looking at the results published by FireEye, the French website O1net, which specialises in new technologies, said it believed that the coronavirus crisis was “probably not the trigger for this campaign, which clearly started before the health situation got worse in Western countries”. It continued: “But it is certain that the organisational chaos crated by Covid-19 can only make the Chinese hackers' work easier. With activity at a halt, staff off sick and people working from home, it becomes difficult to maintain a good level of security. And it's probable that groups of hackers from other countries are also looking to take advantage of this situation.”
On Monday March 23rd the news agency Reuters revealed that “elite hackers” tried to break into the IT systems of the World Health Organisation (WHO) as it was battling to manage the Covid-19 outbreak. Sources said that the attacks may have been the work of DarkHotel, a group affiliated to North Korea. Reuters reported that the hackers had been trying to break into the WHO's internal email system.
On March 15th, meanwhile, the US Health and Human Services Department had also been targeted in a similar way. According to the news agency Bloomberg, the US federal authorities have started an investigation, and though a foreign state is suspected of being behind the attempt to destabilise the health system, officials had not yet established which country it was.
A few days earlier staff at the university hospital in Brno in the Czech Republic had to shut down all their computers because of a cyber attack that hit them in the early hours of the morning. The hospital runs one of the 18 laboratories the Czech Republic uses for testing for Covid-19 and reports said that as a result of the attack some test results were delayed.
In France L'Express news weekly has revealed that the Paris-based hospital group Assistance Publique-Hôpitaux de Paris (AP-HP) was subject to a cyber attack on March 22nd. Though the attack only lasted an hour, internet access to some services had to be cut. It was what is known as a distributed denial-of-service (DDoS) attack in which data is used to flood a system's server with requests and take it offline. Two different sources have told Mediapart that it was not a very sophisticated attack. A team from France's domestic intelligence service, the DGSI, is now investigating to see who wanted to cause a partial paralysis of the AP-HP IT system.
Though the results of this investigation are not yet in, little credence is being given to the idea that it was a deliberate attack by French cyber activists. They have let it be known since the start of the coronavirus crisis that they would not be hampering the battle against the virus. However, it is possible that the attack was accidental. It could be that hackers looking for vulnerabilities came across the AP-HP weaknesses by chance. This could explain the fact that, having discovered they were in a hospital system, the hackers did not go any further.
Meanwhile the French government website Cybermalveillance.gouv.fr has published several articles (see here and here in French) telling people working from home in the crisis how to boost their online and IT security.
-------------------------
If you have information of public interest you would like to pass on to Mediapart for investigation you can contact us at this email address: enquete@mediapart.fr. If you wish to send us documents for our scrutiny via our highly secure platform please go to https://www.frenchleaks.fr/ which is presented in both English and French.
-------------------------
- The French version of this article can be found here.
English version by Michael Streeter