The accounts are fake. The coordination is real. The scale is what makes it work.
Thousands of Accounts, One Voice
In August 2023, Meta announced the largest takedown of a coordinated inauthentic behavior campaign in its history. The numbers were staggering: seven thousand seven hundred four Facebook accounts, nine hundred fifty four pages, fifteen groups, and fifteen Instagram accounts, all removed simultaneously after investigators traced them to a single operation. Over half a million people followed at least one of those pages before removal. But the real scope of the operation was orders of magnitude larger. Meta’s investigation revealed that the same coordinated network operated across more than fifty distinct platforms, from TikTok to YouTube to Reddit to VKontakte to dozens of smaller forums whose names would mean nothing to the average social media user. Google’s Threat Analysis Group reported separately that in a single quarter of 2024 alone, the company disrupted over ten thousand instances of activity from the same operation. The network has been tracked since 2019 under the name Spamouflage by researchers at Graphika, a social media analytics firm, and later renamed Dragonbridge by the intelligence community.
Astroturfing manufactures the appearance of grassroots consensus on a single platform. Spamouflage manufactures it across platforms simultaneously, creating the illusion of a dispersed, decentralized movement that, in reality, originates from a single source: Chinese law enforcement, operating from geographically dispersed locations within China but sharing centralized command, content direction, and internet infrastructure.
What makes spamouflage distinct from the astroturfing covered in Article 01 is precisely this scale, this distribution, and the technological sophistication required to maintain coordination across so many separate platforms without triggering their individual fraud detection systems. A successful astroturfing campaign needs to fool people about what they are seeing. Spamouflage needs to fool people about what they are seeing while simultaneously fooling platforms’ algorithms about what is happening.
Definition
Spamouflage, also known as Dragonbridge, is a large scale, persistent, coordinated inauthentic behavior operation in which multiple fake accounts, pages, and coordinated personas across numerous platforms and forums spread narratives designed to manipulate public perception, typically on behalf of a state actor or well resourced organization, while disguising the coordination and the state origin of the campaign.
The definition requires unpacking, because several components distinguish spamouflage from adjacent but distinct manipulation tactics. Coordinated inauthentic behavior, or CIB, is the umbrella category describing any operation in which groups of pages or people work together to mislead others about who they are or what they are doing, a term coined formally by Meta’s Nathaniel Gleicher and broadly adopted across platform research teams. Spamouflage is one specific, highly sophisticated type of CIB, distinguished by: scale across multiple platforms, the use of fake personas that claim authentic identities rather than simply amplifying existing ones, the targeting of divisive social issues to exploit existing fissures rather than create new consensus, and the involvement of state infrastructure, typically Chinese law enforcement, suggesting centralized command rather than decentralized coordination.
Astroturfing, by contrast, typically concentrates on a single platform or tightly integrated set of platforms, and often involves the amplification of existing grass roots or pseudo grassroots movements rather than the wholesale fabrication of coordinated personas. Spamouflage is what happens when astroturfing scales, distributes, and gains access to state resources.
The Scale and Architecture
The Meta takedown in 2023 removed nearly ten thousand accounts and pages in a single enforcement action. But this was not a single network that suddenly appeared. It was the consolidation of investigations dating back to 2019, when researchers first identified a pattern of coordinated fake accounts posting low quality content across multiple platforms. What Meta eventually discovered was that this pattern was not multiple separate operations, as they had previously assumed, but a single, unified operation that had been continuously active, evolving, and relocating to new platforms as older accounts were discovered and shut down.
The operation works through a specific architecture. Content is typically generated in multiple languages or often via machine translation with deliberate awkward phrasings that suggest AI involvement. That content is then posted to obscure platforms first, places with minimal moderation where the material can accumulate. From those smaller platforms, the same content is then amplified, cross posted, and shared to larger platforms where it has more visibility, a technique researchers describe as a pyramid structure and that clearly mimics a Russian operation called Secondary Infektion, suggesting spamouflage has deliberately adopted proven methods from other state backed campaigns.
The targets are strategic and consistent. Taiwan is a recurring focus, with spamouflage operations launching coordinated campaigns during Taiwanese elections, flooding platforms with AI generated videos, fake news segments with deepfake anchors, and fabricated documents in the weeks before elections. The United States is targeted through divisive issue exploitation, with the same accounts amplifying contradictory narratives on opposite sides of heated social debates around Taiwan, Ukraine, China policy, Israel Hamas, Palestinian issues, immigration, and gun control, not to create consensus but to exacerbate existing divisions and undermine confidence in democratic systems generally. Australia, the United Kingdom, and Japan are secondary focus areas, along with global Chinese speaking communities, particularly diaspora communities and activists living outside mainland China who have criticized the Beijing government.
Despite the operation’s unprecedented size, the engagement rates tell a striking story: almost all of it fails to reach authentic audiences. Videos posted by spamouflage accounts to YouTube sometimes received more artificial engagement, likes, and comments from other spamouflage accounts than from real users, a pattern that platform researchers use to identify inauthentic behavior. The Taiwan 2024 election campaign flooded platforms with thousands of videos. None achieved meaningful traction. The divisive issue posts targeting American politics receive some engagement from real users, but analysts attribute this primarily to the engagement the accounts receive from bots and other inauthentic personas, not from organic interest. The operation’s ineffectuality is, in a perverse way, part of what makes it notable: here is a campaign with enormous resources, sophisticated coordination, and years of operational experience, producing outputs that consistently fail to achieve persuasion at scale, yet continuing unabated.
Perpetrator Typology: One Operation, Multiple Origins
This is where spamouflage’s structure differs meaningfully from astroturfing. In astroturfing, multiple separate organizations, campaigns, or coordinated groups may deploy identical tactics without any shared command. In spamouflage, all evidence points to a single, unified operation originating from China, specifically from individuals connected to Chinese law enforcement. Meta’s investigation revealed that operators of fake accounts were geographically dispersed across multiple locations in China, separated by hundreds of miles, yet shared centralized command structures, coordinated content direction, and, critically, shared internet proxy infrastructure despite their geographic separation. This level of coordination is not achievable through distributed ad hoc volunteer networks. It requires central provisioning, resource allocation, and command authority.
The DOJ indictment unsealed in August 2023 specifically charged individuals for their roles in spamouflage, naming persons with connections to Chinese law enforcement involved in the operation. Google and Microsoft have separately confirmed that the operation shows no evidence of coordination with Russian information operations or other state actors, meaning the unified origin is confirmed through multiple independent intelligence channels.
How It Works on the Target Side
For the target, spamouflage operates as a slow accumulation of environmental noise. A person interested in Taiwan politics notices that certain narratives about Taiwanese officials keep circulating in different forums. Someone following American political debates on social media sees contradictory narratives amplified by accounts that otherwise seem independent. A researcher tracking disinformation watches the same low quality videos posted to multiple platforms in the same week.
The psychological effect is distinct from astroturfing because it operates at scale and distributes across platforms simultaneously. With astroturfing, the target might assume they are seeing organic grassroots opposition on a single platform. With spamouflage, the sheer omnipresence of similar narratives across dozens of platforms creates an illusion of consensus, not on any single platform but across the information ecosystem itself. The target’s mind integrates messages from Twitter, TikTok, YouTube, Reddit, and smaller forums they barely recognize, and concludes that this particular narrative about Taiwan or Ukraine or American democracy must be more widespread than it actually is, simply because it keeps appearing everywhere.
This is compounded by the fact that spamouflage’s divisive issue strategy means it is not trying to convince people of a single position, but to make them distrust positions generally. By amplifying extreme arguments from both sides of contentious issues, the operation’s goal is not persuasion but corrosion. If enough Americans see outrage about immigration from multiple fake accounts across multiple platforms, they might not believe any particular message about immigration, but they will believe that American democracy is fractious and dysfunctional, which appears to be the genuine strategic goal of the campaign.
Platform Detection and Failure
Spamouflage’s persistence despite being identified and partially disrupted multiple times illustrates something critical about platform enforcement: detection and removal are not equivalent to prevention, and the gap between the two is where most of the damage occurs.
Facebook’s detection systems caught spamouflage activity and disabled many accounts automatically, according to Meta’s own reporting. But for every account disabled automatically, the research suggests others remained active on Facebook and, crucially, the operation simply shifted to smaller platforms when larger ones increased enforcement. The pattern is cyclical: platforms detect, remove, the operation relocates, platforms detect again, and so on. The disruption is episodic. The operation is continuous.
Google disrupted over ten thousand instances of activity in Q1 2024 alone. This is an impressive enforcement number. It is also a number that suggests the operation was producing content at a volume that allowed detection systems to catch only a fraction of what was being produced. If ten thousand instances were disrupted in one quarter on Google’s platforms, how many similar instances occurred on platforms where enforcement is less comprehensive? How many were never detected?
The platform complicity here is not intentional in the way complicity operates in other articles of this series. Platforms are not deliberately allowing spamouflage to operate. What they are demonstrating is architectural vulnerability. An operation that targets more than fifty platforms simultaneously will inevitably find some platforms with weaker detection, slower enforcement, or both. The operation succeeds not through any one platform’s choice to allow it, but through the ecosystem’s inability to maintain consistent detection and enforcement across all surfaces simultaneously.
Legal Accountability and Its Limits
The August 2023 DOJ indictment against individuals connected to spamouflage marked a significant but limited victory. Criminal charges against foreign nationals operating from within China are effective as a signal of U.S. law enforcement capacity and willingness to pursue such cases. They are less effective as a deterrent, since the indicted individuals remain in China and subject to Chinese law, not U.S. law.
Platform enforcement remains the only mechanism with real teeth. Meta’s removal of nine thousand accounts and pages, Google’s disruption of tens of thousands of instances, and OpenAI’s removal of accounts used by spamouflage for AI assisted content generation all matter operationally. They do not permanently defeat the operation, they do degrade its capacity for a period, they do force it to relocate and rebuild, and they do create friction that, accumulated across platforms and enforcement actions, changes the operation’s calculus about where to deploy its resources.
There is no legal recourse for the person targeted by spamouflage. The operation does not libel individuals in ways that produce actionable defamation claims, it does not violate privacy laws in ways that permit private litigation, and it operates from beyond the reach of domestic law enforcement. What remains is the forensic work of identification, the platform enforcement against accounts and pages, and the public awareness of how the operation functions, which makes it easier to recognize and less persuasive when encountered.
Recognition and Defense
Spamouflage is harder to recognize than astroturfing because the inauthentic coordination is distributed across platforms rather than concentrated on one. The signals of coordinated inauthenticity are the same at a micro level, but require stepping back to a macro perspective to see: similar language in different forums, identical videos posted to multiple platforms in the same week, accounts with nearly identical profiles cross posting nearly identical content to dozens of locations within days of each other.
The strongest defense is platform aware thinking. Narratives that appear on a single platform may be astroturfing. Narratives that appear simultaneously across multiple platforms, particularly narratives that are low quality or feature obvious AI generation or machine translation artifacts, are candidates for spamouflage. The presence of coordinated engagement from accounts that otherwise have minimal followers or low interaction rates is another signal worth noting: coordinated inauthenticity often involves accounts using other inauthentic accounts to amplify engagement rather than relying on real users.
Checking the source is also protective. Who is posting this? Does the account have a coherent history or does it consist of links and reposts? Are there other nearly identical accounts posting identical content? Does the account have followers? Are the followers real or do they consist of other obviously fake accounts? These questions, asked about accounts across multiple platforms where a narrative is circulating, can reveal whether what appears to be grassroots is actually coordinated inauthenticity.
Spamouflage succeeds not because it persuades. It succeeds because it makes authentic discourse harder to find.
Next in the Series: Romance Scams and the Manufactured Relationship
The next article in Digital Manipulation examines a different kind of coordination, one that does not aim to change your mind about politics or policy but to change your mind about who you are falling in love with. Where spamouflage manufactures consensus, romance scams manufacture intimacy. Where spamouflage targets public discourse, romance scams target the individual. The mechanics are related; the intent is entirely different.
FAQ
A: No. Astroturfing manufactures fake grassroots on a single platform or tightly integrated set of platforms. Spamouflage distributes coordinated inauthentic accounts across dozens of platforms, often involving state resources and intentionally divisive messaging rather than consensus building.
A: The low quality may be deliberate. By flooding platforms with high volume, low engagement content, the operation tests detection systems, learns where weaknesses are, and identifies which smaller platforms have minimal moderation. The unsuccessful posts serve a reconnaissance function even if they fail persuasion.
A: Influence operations are evaluated over years, not by immediate returns. Spamouflage may fail at persuasion in 2023 or 2024, but each campaign provides data on platform vulnerabilities, effective messaging, and audiences. The long term goal appears to be capability building for future operations, not immediate success.
A: Platforms can disrupt it episodically and force relocation, but stopping it entirely would require either universal, consistent detection and enforcement across all fifty plus platforms simultaneously, or coordination between those platforms, neither of which currently exists.
A: Report the account to the platform where you encountered it. Check whether the account has engagement primarily from other obvious fake accounts rather than real users. If tracking disinformation publicly, document the coordination pattern and share findings with researchers.
A: Spamouflage specifically refers to the Chinese operation. Similar coordinated inauthentic behavior is deployed by other state actors, including Russian operations, but those are tracked separately and have their own distinct architectures and names.
A: Because the platforms and researchers studying it benefit from public acknowledgment of their enforcement efforts. The published failures demonstrate capability, deter some level of future activity through the signal of detection, and contribute to public literacy about how these operations function.
Appendix
Key Terms
Spamouflage: A large scale, persistent, coordinated inauthentic behavior operation, linked to Chinese law enforcement, that distributes fake accounts and coordinated personas across dozens of platforms to manipulate public perception, typically by exploiting divisive social issues.
Dragonbridge: An alternative name for Spamouflage used by Google’s Threat Analysis Group and other intelligence organizations.
Coordinated Inauthentic Behavior (CIB): A manipulation tactic in which groups of pages or people work together to mislead others about who they are or what they are doing, often using fake accounts and coordinated messaging across platforms.
Astroturfing: The manufacture of apparently grassroots political support or consensus on a single platform, typically using fake accounts but concentrated on one service rather than distributed across dozens.
Platform cascade: The technique of posting content first to obscure platforms with minimal moderation, then amplifying it across larger platforms once it has accumulated, exploiting platform differences in enforcement speed.
Inauthentic metrics: Statistical indicators of fake engagement, such as more likes than views, engagement from accounts with minimal followers, or posting patterns inconsistent with real human activity.
Further Reading
Meta. Q2 Adversarial Threat Report. August 2023.
Google Threat Analysis Group. “Google disrupted over 10,000 instances of DRAGONBRIDGE activity in Q1 2024.” March 2024.
Graphika. “Spamouflage Dragon” research reports. 2019 onwards.
Stanford Internet Observatory. Coordinated Inauthentic Behavior research.
U.S. Department of Justice. Indictment against persons associated with Spamouflage operation. August 2023.
Digital Manipulation is a space for people who are learning to see what was designed to be invisible. You are not helpless. Coordination can be recognized. Manufactured consensus can be distinguished from authentic belief. You decide what you think.
gorgeousdiaries.com
Leave a Reply