Post

1/ In Feb 2026, OpenAI reported on a doxxing website, which since 2023 had been exposing Chinese activists and dissidents. Unsurprisingly, the company attributed that activity to Chinese law enforcement. We @citizenlab.ca had been looking at it for a while and have some extra details. 🧵

2/ The domain revealscum[.]com was registered in 2023 and became active almost immediately. It followed a playbook we have already described that same year in our report on HKLEAKS. Exposing as much private information as possible, framing it in the most damaging way for the target.

3/ OpenAI identified it as part of a much larger effort to target dissidents (and the Japanese PM), revealing the enormity of its scale in terms of human and technological resources deployed by the actors.

4/ "Reveal Scum", the contents of which I won't show, followed the HKLEAKS playbook almost to the letter. Completely anonymous, with good operational security. A couple of generic Wordpress usernames ("Autumn" and the Chinese equivalent for "admin"). Anonymous hosting on US and Canada-based infra.

5/ But like for HKLEAKS, they made mistakes. For about a month and a half in 2023, the website resolved to the same IP address as just 1 domain. Gem Herald [WARNING: open with caution] claims to offer Australian audiences "Real Aussie news. No fluff." It's also flagged for malware by Maltrail:

6/ A closer look reveals another familiar playbook: that of PAPERWALL. A "local news" site in fact channeling anti-dissident harassment and pro-PRC, unsourced "op-eds", mixed with the unattributed lifting of real articles from actual international media to lend credibility to the whole thing.

7/ On Gem Herald, "Archie Watson" is the sole author of articles that, when not stolen elsewhere, are labeled as 100% AI-made by verification tools like @pangram.com . The articles often push familiar narratives.

8/ It's then obvious that a much broader ecosystem of PRC operations exists out there that awaits to be discovered. Most will have zero impact. But it depends on how we calculate impact: is it polluting the web and its AI crawlers? Is it pushing dissidents to silence? Or burning through gov budget?