At least 123 Chinese websites are disguised as local news outlets in 30 countries to disseminate pro-Beijing disinformation, according to a recent report from Citizen Lab, a digital watchdog at Canada’s University of Toronto.
“The campaign is an example of a sprawling influence operation serving both financial and political interests, and in alignment with Beijing’s political agenda,” Alberto Fittarelli, senior researcher at Citizen Lab, wrote in his Feb. 7 report.
He called the campaign “Paperwall,” which he defined as “a large, and fast growing, network of anonymous websites posing as local news outlets.” The United States, South Korea, Japan, Russia, the UK, France, Brazil, Turkey, and Italy were among the 30 countries allegedly targeted by the campaign.
To disguise themselves as legitimate local news outlets, Paperwall websites often used local references as part of their names, such as Eiffel Post and Provence Daily for two French-language websites. Other website names included British FT targeting the UK, Sendai Shimbum and Fujiyama Times for Japan, Daegu Journal and Busan Online for South Korea, and Roma Journal and Napoli Money for Italy.
The lone website targeting the U.S. audience was UpdateNews.Info, a domain name registered in July 2019 and the first Paperwall website to be registered, according to the report.
Citizen Lab researchers said the campaign’s effect has been “negligible so far,” given the “minimal traffic” toward the websites and the lack of social media amplification or visible mainstream media coverage.
However, the report warned that the campaign shouldn’t be considered harmless—it can “eventually pay enormous dividends once one of those fragments is eventually picked up and legitimized by mainstream press or political figures.”
Content
Paperwall websites also “regularly republish content, verbatim, from legitimate online sources in the target country” to make their sites appear legitimate, according to the report. For example, the report includes a screengrab of the Eiffel Post website republishing an article from the French daily newspaper Le Parisien.
These websites also featured verbatim reposts of content from China’s state-run media, such as China Global Television Network, the global arm of state broadcaster China Central Television, according to the report.
A significant portion of these websites’ content originated from Times Newswire, according to Mr. Fittarelli.
“We found evidence that Times Newswire regularly seeds pro-Beijing political content, including ad hominem attacks, by concealing it within large amounts of seemingly benign commercial content,” the report reads.
Times Newswire and another newswire service called World Newswire were found to be at the center of a China-linked influence operation called “HaiEnergy,” reported in 2023 by cybersecurity firm Mandiant. Using newswire services and paid-for influences, HaiEnergy distributed its content to subdomains of legitimate U.S.-based news outlets as “press releases,” effectively promoting pro-Chinese Communist Party (CCP) propaganda via U.S. media outlets.
“Similarly to what was stated by Mandiant for the HaiEnergy campaign, we cannot currently attribute Times Newswire to the same operators as PAPERWALL,” the report states.
However, according to the report, Citizen Lab looked into the hosting IP addresses of Times Newswire and Paperwall domains, and they led back to Tencent, a Chinese tech company based in China’s southern city of Shenzhen.
The report identified Hong Kong virologist Yan Limeng as an example of a victim who has faced targeted attacks originating from Paperwall websites.
“The attacks on her by PAPERWALL were unsubstantiated, aimed at her personal and professional reputation, and completely anonymous,” the report states.
Paperwall websites also promoted conspiracy theories, such as allegations that the United States conducted biological experiments on locals in Southeast Asian countries, according to the report.
PR Firm
The campaign was attributed to Shenzhen Haimaiyunxiang Media Co. Ltd., also known as Haimai, a public relations and marketing firm based in Shenzhen, China, according to the report. This attribution was based on the report’s analysis of digital infrastructure links between the company and Paperwall sites.
“This is therefore an incriminating finding, proving that both PAPERWALL domains had been set up by the same operators as the Haimai assets,” the report states.
Haimai advertises on its website the sale of promotional placement services in multiple countries and languages, according to the report.
“The role and prominence of private firms in creating and managing influence operations is hardly news,” the report states, adding that “China—previously exposed for having resorted to this proxy category in large influence operations, including the cited HaiEnergy—is now increasingly benefiting from this operating model, which maintains a thin veil of plausible deniability, while ensuring a broad dissemination of the political messaging.
“It is safe to assume that PAPERWALL will not be the last example of a partnership between private sector and government in the context of Chinese influence operations.”
