How a fake persona laid the groundwork for a Hunter Biden conspiracy deluge
One month before a purported leak of files from Hunter Biden's laptop, a fake "intelligence" document about him went viral on the right-wing internet, asserting an elaborate conspiracy theory involving former Vice President Joe Biden's son and business in China.
The document, a 64-page composition that was later disseminated by close associates of President Donald Trump, appears to be the work of a fake "intelligence firm" called Typhoon Investigations, according to researchers and public documents.
More from NBC News:
Trump has signaled he won't accept an election loss. Many of his voters agree.
Inside the campaign to 'pizzagate' Hunter Biden
The economy is showing signs of recovery. Many Black Americans are not.
The author of the document, a self-identified Swiss security analyst named Martin Aspen, is a fabricated identity, according to analysis by disinformation researchers, who also concluded that Aspen's profile picture was created with an artificial intelligence face generator. The intelligence firm that Aspen lists as his previous employer said that no one by that name had ever worked for the company and that no one by that name lives in Switzerland, according to public records and social media searches.
One of the original posters of the document, a blogger and professor named Christopher Balding, took credit for writing parts of it when asked about it and said Aspen does not exist.
Despite the document's questionable authorship and anonymous sourcing, its claims that Hunter Biden has a problematic connection to the Communist Party of China have been used by people who oppose the Chinese government, as well as by far-right influencers, to baselessly accuse candidate Joe Biden of being beholden to the Chinese government.
The document and its spread have become part of a wider effort to smear Hunter Biden and weaken Joe Biden's presidential campaign, which moved from the fringes of the internet to more mainstream conservative news outlets.
An unverified leak of documents — including salacious pictures from what President Donald Trump's personal attorney Rudy Giuliani and a Delaware Apple repair store owner claimed to be Hunter Biden's hard drive — were published in the New York Post on Oct. 14. Associates close to Trump, including Giuliani and former White House chief strategist Steve Bannon, have promised more blockbuster leaks and secrets, which have yet to materialize.
The fake intelligence document, however, preceded the leak by months, and it helped lay the groundwork among right-wing media for what would become a failed October surprise: a viral pile-on of conspiracy theories about Hunter Biden.
Behind Typhoon
The Typhoon Investigations document was first posted in September to Intelligence Quarterly, an anonymous blog "dedicated to collecting important daily news," according to its "about" section. Historical domain records show the blog was registered to Albert Marko, a self-described political and economic adviser, who also lists the blog on his Twitter bio. When asked about the provenance of the document, Marko said he received it from Balding.
Balding, an associate professor at Fulbright University Vietnam who studies the Chinese economy and financial markets, posted the document on his blog on Oct. 22, seven weeks after it was initially published.
"I had really not wanted to do this but roughly 2 months ago I was handed a report about Biden activities in China the press has simply refused to cover. I want to strongly emphasize I did not write the report but I know who did," Balding said in an email.
Balding later claimed to NBC News that he wrote some of the document.
"I authored small parts of the report and was involved in report preparation and review. As a researcher, and due to the understandable worry about foreign disinformation, it was paramount that the report document activity from acknowledged and public sources," Balding said. "Great care was taken to document, cite, and retain information so that acknowledged facts could be placed in the public domain."
Balding said Aspen is "an entirely fictional individual created solely for the purpose of releasing this report." Balding did not name the document's main author, saying "the primary author of the report, due to personal and professional risks, requires anonymity."
Balding claimed that the document was commissioned by Apple Daily, a Hong Kong-based tabloid that is frequently critical of the Chinese government. Apple Daily did not respond to a request for comment.
In addition to posting the document to his blog, Balding also promoted it in far-right media, appearing on Bannon's podcast and on "China Unscripted," a podcast produced by The Epoch Times, a pro-Trump media outlet opposed to the Chinese government.
Balding, an American who taught economics at China's Peking University HSBC Business School until 2018, is often critical of the Chinese government. He made news this year as a source uncovering a global bulk data collection operation by the Chinese company Shenzhen Zhenhua Data Technology.
Blog posts highlighting the most salacious parts of the document, including articles from the Intelligence Quarterly Blog, Revolver News and Balding's blog, received 70,000 public interactions — which includes reactions, comments and shares — across Facebook, Twitter and Reddit, according to the social media analysis tool BuzzSumo.
Balding's blog was the primary driver of virality in conservative and conspiracy communities. The report itself was shared across Facebook and Twitter around 5,000 times, according to BuzzSumo, and more than 80 sites linked back to the blog, which was shared more than 25,000 times on Facebook and Twitter. Hyperpartisan and conspiracy sites like ZeroHedge and WorldNetDaily led the pack.
After the promise of a big reveal one day earlier, the document was also posted on the extremist forum 8kun by Q, the anonymous account behind the QAnon conspiracy theory movement.
On Twitter, the document was pushed by influencers in the QAnon community, as well as by Dinggang Wang, an anti-Chinese government YouTube personality who works for Guo Wengui, a billionaire who fled China amid accusations of bribery and other crimes. Republican Newt Gingrich, the former speaker of the House of Representatives, tweeted the document to his 2.3 million followers.
'Immediately suspicious'
The document gained attention from disinformation researchers in part because of the image of the document's author.
Elise Thomas, a researcher at the Australian Strategic Policy Institute, first spotted telltale signs of a fake photo when she went searching for Typhoon Investigations' Aspen on the web. Thomas found a Twitter account for Aspen named @TyphoonInvesti1, which had posted a link to Typhoon's WordPress page that contained the document on Aug. 15.
The profile picture for Aspen immediately showed signs of being a computer-generated image that can be created by computers and even some websites. Aspen's ears were asymmetrical, for one, but his left eye is what gave away that he did not really exist. Aspen's left iris juts out and appears to form a second pupil, a somewhat frequent error with computer-generated faces.
"The most obvious tell was the irregular shape of the irises," Thomas said. "The profile picture looks pretty convincing in the Twitter thumbnail, but when I popped it up into full view I was immediately suspicious."
Thomas then consulted with Ben Nimmo, director of investigations at the analytics company Graphika, who noted the other telltale sign of a computer-generated face.
"One of the things he and his team have figured out is that if you layer a lot of these images over the top of one another, the eyes align," Thomas said. "He did that with this image, and the eyes matched up."
Other parts of Aspen's identity were clearly stolen from disparate parts of the web. Aspen's Facebook page was created in August, and it featured only two pictures, both from his "new house," which were tracked back to reviews on the travel website Tripadvisor. The logo for Typhoon Investigations was lifted from the Taiwan Fact-Checking Center, a digital literacy nonprofit.
Aspen claimed on his LinkedIn profile to have worked for a company called Swiss Security Solutions from 2016 to 2020. Swiss Security Solutions denied having ever employed anyone named Aspen, and it said it had found fake accounts for two other people pretending to have worked for the company.
"Martin Aspen was never a freelancer or worker of the Swiss Security Solutions. We do not know this person. According to our Due Diligence Software, this person does not exist in Switzerland," Swiss Security Solutions Chairman Bojan Ilic said, adding that the company has reported the profile to LinkedIn.
Fake faces
Computer-generated faces have become a staple of large-scale disinformation operations in the run-up to the election. In December, Facebook took down a network of fake accounts using computer-created faces tied to The Epoch Times. Facebook removed over 600 accounts tied to the operation, which pushed pro-Trump messages and even served as moderators of some Facebook groups.
Last month, Facebook removed another batch of computer-generated profiles originating in China and the Philippines, some of which made anti-Trump posts.
Renee DiResta, a researcher at the Stanford Internet Observatory, said computer-created identities are becoming common for disinformation campaigns, in part because they are easy to create.
DiResta, who helped examine a ring of AI-generated faces tied to the conservative nonprofit Turning Point USA last month, said computer-generated profile pictures can be used to "build an army of fake people" to artificially support a cause or to make "disinformation operations harder to discover."
"One of the things that investigators look at to understand the narrative that is spreading is whether the accounts are authentic, whether they're real," DiResta said. "If they were to use a stock photo, it confirms something dishonest is likely happening. By using an AI-generated face, you're guaranteeing you won't find that person elsewhere on the internet."