OneSight Backstage Management System: Attributing a Chinese Marketing Firm’s Tools to Disinformation Campaigns

In Episode 9 of Know Your Adversary™, Nisos researcher Zeshan Aziz revealed that Chinese commercial marketing firm OneSight, developed a sophisticated social media management and monitoring system called OneSight Backstage Management System to propagate political disinformation against the Uyghur community. The research indicates the Chinese Communist Party (CCP) likely conducted the campaign.

Previous research into a breach of OneSight identified sophisticated social media surveillance tooling was used for widespread disinformation campaigns across many prominent Chinese and U.S. social media platforms. These campaigns targeted political topics, including Uyghur dissidents and anti-COVID19 messaging. While OneSight won legitimate contracts with the Chinese Communist Party to market Chinese state media, OneSight also used fake social media accounts to promote false narratives intended to create negative sentiment against U.S. policies.

Primary Nisos Process and Tools to Combat Disinformation:

1. Narrative: Identify the propagated primary messages.
2. Accounts and Content: Find the platform's activity and roll back the accounts.
3. Platforms and Outlets: Determine how widespread the messaging is on other platforms.
4. Attribution: Attribute the sponsor backing the disinformation campaign through technical signature analysis. 

Major Takeaways from the Investigation:

1. OneSight regularly advertises its Chinese commercial clients but does not disclose working directly with the CCP. However, research into the Chinese government procurement databases (the equivalent of the United States’ FedBizOps) indicates that OneSight regularly works with the CCP. 
   1. Besides anti-Uyghur messaging, other narratives favoring the Chinese state included positive messaging about Carrie Lam, a Hong Kong politician seen as a close ally to the CCP. 
2. CCP Unmasked claimed to have stolen internal documents from Knowlesys, a company based in Hong Kong and GuangDong, Yunrun Big Data Service, a company based in Guangzhou, and OneSight, based in Beijing. Nisos researchers reviewed the data from the OneSight compromise. In a YouTube video, they discovered a proprietary tool called OneSight Backstage Management System: a portal for storing and correlating persona accounts, the messaging used for those accounts, and the platform used for propagation. 
3. Violations of Foreign Agents Registration Act (FARA) have been an effective near-term way to combat individuals and organizations pedaling foreign disinformation. Its purpose is to allow the U.S. government and the general public to be informed of the identities of individuals representing the interests of foreign governments or entities.