Chinese intelligence activity abroad

The Government of China is engaged in espionage overseas, directed through diverse methods via the Ministry of State Security (MSS), the Ministry of Public Security (MPS), the United Front Work Department (UFWD), People's Liberation Army (PLA); (vis-à-vis the Intelligence Bureau of the Joint Staff Department) and numerous front organizations and state-owned enterprises. It employs a variety of tactics including cyber espionage to gain access to sensitive information remotely, signals intelligence, human intelligence as well as the exertion of political influence via the UFWD through the co-optation of ethnic Chinese diaspora communities and associations. The Chinese government is also engaged in industrial espionage aimed at gathering information to bolster its economy, as well as transnational repression of dissidents abroad such as supporters of the Tibetan independence movement and Uyghurs as well as the Taiwan independence movement, the Hong Kong independence movement, Falun Gong, pro-democracy activists, and other critics of the Chinese Communist Party (CCP). The United States alleges that the degree of intelligence activity is unprecedented in its assertiveness and engagement in multiple host countries, particularly the United States, to which various US officials contend economic damages, prosperity and stolen innovations have resulted in $US320-445 billion annually since its inception and activities.

Modes of operation

It is believed that Chinese espionage is aimed at the preservation of China's national security through gaining commercial, technological, and military secrets. It is generally believed that Chinese intelligence agencies operate differently from other espionage organizations by employing primarily academics or students who will be in their host country only a short time, rather than spending years cultivating a few high-level sources or double agents. The use of non-traditional intelligence assets is codified in Chinese law. Article 14 of China's 2017 National Intelligence Law mandates that Chinese intelligence agencies "may ask relevant institutions, organizations and citizens to provide necessary support, assistance and cooperation." Honey trapping and kompromat are also common tools of Chinese intelligence services.

Much of the information available to the public about the Chinese intelligence services comes from defectors, whom the PRC accuses of lying to promote an anti-PRC agenda. One known exception to this rule is the case of Katrina Leung, who was accused of starting an affair with an FBI agent to gain sensitive documents from him. A U.S. judge dismissed all charges against her due to prosecutorial misconduct.

The United States believes the Chinese military has been developing network technology in recent years in order to perform espionage on other nations. Several cases of computer intrusions suspected of Chinese involvement have been found in various countries including Australia, New Zealand, Canada, France, Germany, the Netherlands, the United Kingdom, India and the United States.

In the aftermath of the Shadow Network computer espionage operation security experts claimed "targeting Tibetan activists is a strong indicator of official Chinese government involvement" since private Chinese hackers pursue economic information only. In 2009, Canadian researchers at the Munk Center for International Studies at the University of Toronto examined the computers at the personal office of the Dalai Lama. Evidence led to the discovery of GhostNet, a large cyber-spy network. Chinese hackers had gained access to computers possessed by government and private organizations in 103 countries, although researchers say there is no conclusive evidence China's government was behind it. Computers penetrated include those of the Dalai Lama, Tibetan exiles, organizations affiliated with the Dalai Lama in India, Brussels, London and New York, embassies, foreign ministries and other government offices, and focus was believed to be on the governments of South Asian and Southeast Asian countries. The same researchers discovered a second cyberspy network in 2010. They were able to see some of the stolen documents which included classified material about Indian missile systems, security in several Indian states, confidential embassy documents about India's relationships in West Africa, Russia and the Middle East, NATO forces travel in Afghanistan, and a years worth of the Dalai Lama's personal email. The "sophisticated" hackers were linked to universities in China. Beijing again denied involvement. In 2019 Chinese hackers posing as ''The New York Times'', Amnesty International and other organization's reporters targeted the private office of the Dalai Lama, Tibetan Parliament members, and Tibetan nongovernmental organizations, among others. Facebook and Twitter took down a large network of Chinese bots that was spreading disinformation about the 2019–20 Hong Kong protests and a months long attack on Hong Kong media companies was traced to Chinese hackers.

Facial recognition and surveillance artificial intelligence (AI) technology developed inside China to identify Uyghurs, a Muslim minority, is now used throughout China, and despite security concerns over Chinese involvement in 5G wireless networks, is manufactured and exported worldwide by state owned China National Electronics Import & Export and Huawei to many countries, including Ecuador, Zimbabwe, Uzbekistan, Pakistan, Kenya, the United Arab Emirates, Venezuela, Bolivia, Angola and Germany. American companies and universities such as MIT are partnering with, and Princeton, the Rockefeller Foundation and the California Public Employees' Retirement System are backing, Chinese surveillance and AI start-ups such as Hikvision, SenseTime and Megvii, which sell less expensive versions of Chinese state developed artificial intelligence surveillance systems, although this is being curtailed somewhat due to the companies being declared national security threats and human rights violators by the US, and US-China trade concerns. China invests in American AI startups and is starting to overtake the US in AI investment.

In July 2020, in its annual report, Germany's domestic intelligence agency, the BfV, warned consumers that personal data they provide to Chinese payment companies or other tech firms such as Tencent, Alibaba and others, could end up in the hands of China's government. In September 2020, a Chinese company, Shenzhen Zhenhua Data Technology came under the scanner worldwide for its big data and data mining and integration capacities and intentions related to its use. According to the information from the National Enterprise Credit Information Publicity System, which is run by State Administration for Market Regulation in China, the shareholders of Zhenhua Data Information Technology Co., Ltd. are two natural persons and one general partnership enterprise whose partners are natural persons. Wang Xuefeng, who is the chief executive and the shareholder of Zhenhua Data, has publicly boasted that he supports "hybrid warfare" through manipulation of public opinion and "psychological warfare".

Relationship with the United Front

In 1939, Zhou Enlai espoused "nestling intelligence within the united front" while also "using the united front to push forth intelligence." According to Australian analyst Alex Joske, "the united front system provides networks, cover and institutions that intelligence agencies use for their own purposes." Joske added that "united front networks are a golden opportunity for Party's spies because they represent groups of Party-aligned individuals who are relatively receptive to clandestine recruitment."

Intelligence activity worldwide

Africa

Ethiopia

In January 2018, ''Le Monde'' reported that the headquarters of the African Union, which had been constructed by the China State Construction Engineering Corporation, had had its computer systems compromised between 2012 and 2017, with data from AU servers being forwarded to Shanghai.

The building's computer system was subsequently removed and the AU refused a Chinese offer to configure the replacement system. ''Le Monde'' alleged that the AU had then covered up the hack to protect Chinese interests in the continent.

China and the African Union have rejected the allegations. Ethiopian Prime Minister Hailemariam Desalegn rejected the French media report, saying that he doesn't believe it. Moussa Faki Mahamat, head of the African Union Commission, said the allegations in the ''Le Monde'' report were false. "These are totally false allegations and I believe that we are completely disregarding them."

In 2020, Japan's Computer Emergency Response Team (CERT) reported that a suspected Chinese hacking organization dubbed "Bronze President" had hacked and extracted footage from the AU Headquarters' security cameras.

Asia

Cambodia

Since at least April 2017, TEMP.Periscope, an advanced persistent threat based in China, has been hacking Cambodian organizations related to the 2018 general election.

Targets included the National Election Commission, the Ministry of Interior, the Ministry of Foreign Affairs and International Cooperation, the Senate of Cambodia, and the Ministry of Economy and Finance. The APT engaged in spear phishing against Monovithya Kem of the Cambodia National Rescue Party, sending messages which impersonated the Cambodian League for the Promotion and Defense of Human Rights.

Hong Kong

According to Pan-democracy political groups, China has been sending spies into Hong Kong harassing dissents and Falun Gong practitioners. In 2012, according to Oriental Daily, a Chinese security ministry official has been arrested in Hong Kong for suspicion of acting as a double agent for the United States.

In October and December 2015, five book sellers of Causeway Bay Books disappeared as part of the Causeway Bay Books disappearances. The five men: Gui Minhai, Lee Bo, Lui Bo, Cheung Jiping and Lam Wing-kee were allegedly kidnapped by Chinese public security bureau officials from mainland China extrajudicially in breach of Hong Kong judicial independence as a result of publishing and distributing books containing corruption and scandals related to the senior leadership of the Chinese Communist Party.

India

Research and Analysis Wing (R&AW) believes that China is using dozens of study centers it has set up in Nepal near the Indian border in part for the purposes of spying on India.

In August 2011 a Chinese research vessel disguised as a fishing trawler was detected off the coast of Little Andaman, collecting data in a geostrategically sensitive region.

The "Luckycat" hacking campaign that targeted Japan and Tibet also targeted India. A Trojan horse was inserted into a Microsoft Word file ostensibly about India's ballistic missile defense program, allowing for the command and control servers to connect and extract information. The attacks were subsequently traced back to a Chinese graduate student from Sichuan and the Chinese government is suspected of planning the attacks.

Chinese hackers linked to the Third Technical Department of the People's Liberation Army have launched extensive and sustained hacking campaigns against the Central Tibetan Administration, based in Dharamshala.

In 2018, PLA Navy deployed a Type 815G ELINT ship in waters off Andaman and Nicobar islands for two weeks, according to a report by Indian intelligence agencies.

In March 2019, Indian intelligence agencies, told news services that China was trying to spy on Indian Navy bases, located in southern India and Integrated Test Range missile testing facility located at Abdul Kalam Island. It was doing this by establishing Chinese business around these areas.

In September 2020, Delhi Police arrested a journalist and accomplices under the Official Secrets Act for allegedly passing sensitive information to Chinese intelligence officers.

On 3 March 2021, the Chinese hackers attacked the Covaxin and Covishield units In India. It is also being claimed that the hackers tried to create a national blackout in the country by breaching the electricity units.

Indonesia

In January 2021, Indonesian fishermen reported findings of underwater drones or gliders. This finding is thought to be related to a glider belonging to China that was previously found by fishermen around the waters of Selayar Island. Foreign media have highlighted these findings. Most of them call this incident a secret Chinese mission in Indonesian waters. ''The Guardian'', in its Espionage rubric, details previously that a Chinese-made glider was also found by fishermen in Tanjung Pinang in March 2019. Furthermore, the finding occurred in Masalembo in January 2020.

In September 2021, Chinese hackers have breached the internal networks of at least ten Indonesian government ministries and agencies, including computers from Indonesia’s primary intelligence service, Indonesian State Intelligence Agency (BIN). The intrusion, discovered by Insikt Group, the threat research division of Recorded Future, has been linked to Mustang Panda, a Chinese threat actor known for its cyber-espionage campaigns targeting the Southeast Asian region. But spokesman of the Indonesia intelligence agency denies China hacker hack their computer.

In July 2022, the Indonesian navy arrested six people, including three foreigner, two from Malaysia and one from China on suspicion of being involved in espionage activities in North Sebatik after they were found in possession of sensitive naval base photos at the shared island, according to Indonesian media reports.

Japan

According to a report by Trend Micro the "Luckycat" hacker group is engaged in cyber-espionage on targets in Japan, India and Tibet. During the 2011 Tōhoku earthquake and tsunami and nuclear meltdowns at Fukushima, the hackers inserted a Trojan virus into PDF attachments to emails being circulated containing information about radiation dosage measurements. Investigation into ownership of the command and control servers by Trend Micro and ''The New York Times'' linked the malware to Gu Kaiyuan, through QQ numbers and the alias "scuhkr". Mr. Gu is a former graduate student of the Information Security Institute of Sichuan University in Chengdu and wrote his master's thesis on computer hacking. James A. Lewis of the Center for Strategic and International Studies, believes the attacks were state-sponsored.

Kazakhstan

On 19 February 2019, Kazakh counterintelligence officers arrested Konstantin Syroyezhkin, a former KGB agent, in Almaty, on charges of passing classified documents to Chinese spies. China linked hackers have also targeted entities in Kazakhstan.

Malaysia

In 2020 Chinese hackers were implicated in the hacking of a Malaysian government official. The attacks were attributed to APT40.

The Philippines

FireEye President Travis Reese has stated that the Chinese-sponsored Conference Crew, founded in 2016, has engaged in cyber-espionage against the Philippines, targeting diplomatic and national security information.

In 2020 Facebook took down a network which was part of a Chinese disinformation campaign against the Philippines. The campaign used false profiles to influence public opinion, particularly related to politics.

Following a murder in Makati City in which two Chinese PLA IDs were recovered, Philippines Senator Panfilo Lacson claimed he had received information that between 2,000 and 3,000 Chinese PLAN (People's Liberation Army Navy) members were in the Philippines. Replying on Twitter, the Chinese Embassy in Manila said the Senator was "testing the intelligence of the Philippine people", to which Lacson responded saying his information is still worth looking into, while the Armed Forces of the Philippines said it is validating the information as a "matter of serious concern."

Singapore

Huang Jing (黄靖), an academic at the Lee Kuan Yew School of Public Policy, was expelled from Singapore in 2017, reportedly for working as an agent of influence for Chinese intelligence services.

SingHealth medical data was hacked by suspected Chinese hackers around July 2018.

South Korea

FireEye claims that two hacker operations tied to the Chinese military, dubbed Tonto Team and Stone Panda/APT10, have attempted to hack the South Korean Ministry of Foreign Affairs and other targets related to the deployment of THAAD.

China is reportedly engaged in economic espionage against South Korean technology companies, including Samsung Electronics and SK Hynix.

Sri Lanka

In 2010, Jayalalithaa Jayaram – head of the All India Anna Dravida Munnetra Kazhagam – stated that Chinese workers, working in parts of the country devastated by the Sri Lankan Civil War were infiltrated with Chinese spies on surveillance missions targeted at India.

In May 2019, Sri Lankan authorities caught former chief of Military intelligence, for allegedly acting as a Chinese mole and trying to obstruct a probe by Indian and American agencies into the Easter bombings.

Taiwan

Taiwan and China regularly accuse each other of spying.

Presidential aide Wang Jen-ping was found in 2009 to have sold nearly 100 confidential documents to China since 2007; Military intelligence officer Lo Chi-cheng was found to have been acting as a double agent in 2010 for China since 2007; Maj. Gen. Lo Hsien-che, electronic communications and information bureau chief during the administration of former President Chen Shui-bian, has been suspected of selling military secrets to mainland China since 2004.

In 2007 the Ministry of Justice Investigation Bureau stated that 500 gigabyte Maxtor Basics Personal Storage 3200 hard drives produced by Seagate Technology and manufactured in Thailand may have been modified by a Chinese subcontractor and shipped with the Virus.Win32.AutoRun.ah virus. As many as 1,800 drives sold in the Netherlands and Taiwan after August 2007 were reportedly infected with the virus, which scanned for passwords for products such as ''World of Warcraft'' and QQ and uploading them to a website in Beijing.

Zhou Hongxu (周泓旭), a graduate of National Chengchi University's MBA program, has been accused of attempting to recruit an official from the Ministry of Foreign Affairs for the purposes of providing intelligence to China.

Zhou was reportedly instructed by China's Taiwan Affairs Office to enroll in the university in order to make friends and develop a spy ring. Zhou reportedly solicited classified documents, offering trips to Japan and United States dollars in payment.

In October 2020 it was revealed that Chinese hackers had compromised the largest job bank in Taiwan, hacking the information of over five million people.

On 11 December 2020, the Ministry of Justice Investigation Bureau (MJIB) caught three Taiwanese who worked for Chinese intelligence. They were spreading propaganda about how Taiwan and the US were trying to overthrow the Thailand monarchy supporting the democracy protesters. The case is important because firstly it is Taiwan's first Internet-related national security case the bureau investigated. And secondly it is the first time Taiwan has documented that China has successfully recruited Taiwanese to work as paid online agents of its cyber army. This disinformation operation also tried to falsely portray the Milk Tea Alliance as a color revolution style American government plot.

= Military espionage

=
In May 2017, Major Wang Hung-ju, a retired military police officer assigned to the National Security Bureau, was indicted on charges of spying for the People's Republic of China.

Army Major General Hsieh Chia-kang, deputy commander of Matsu Defense Command, has been accused of providing intelligence to China, having been recruited by retired army colonel Hsin Peng-sheng.

In January 2018, it was reported that the Taipei District Prosecutors' Office is investigating if classified information regarding the Airborne Special Service Company was passed on to Zhou Hongxu (周泓旭), who was already convicted for violating the National Security Act. In March 2018, a retired colonel was charged with breaching the National Security Act by the Kaohsiung District Prosecutors' Office, which alleged that the colonel shared classified personal information and planned to develop a spy ring in Taiwan. In April 2018, Hung Chin-hsi (洪金錫), a Macau-born businessman, was accused of developing a spy ring in the Ministry of Justice, on behalf of China. Captain Zhen Xiaojiang (鎮小江) was convicted in 2015 of recruiting Taiwanese military officers as part of a spy ring on behalf of China, including Army Major-General Hsu Nai-chuan (許乃權).

Zhen sent intelligence regarding Taiwan's radar installations and Dassault Mirage 2000 fighters to China. He was deported to Hong Kong in July 2018.

In 2022, Taipei District Prosecutors Office charged retired major general Chien and retired lieutenant colonel Wei for developing a spy network for China. They were accused of working for a Hong Konger named Tse, who would visit Taiwan to recruit retired officers and reach out to those on active duty. Chien and Wei tried unsuccessfully to recruit Chang Che-ping, who was a deputy minister at the ROC Ministry of National Defense before serving as a strategic adviser to President Tsai Ing-wen. Chang was probed as a defendant last year but later renamed as a witness.

=Economic espionage

=

''The Wall Street Journal'' reported that Taiwan has been "ground zero" for economic espionage related to its integrated circuit fabrication industry. In a review of ten prosecutions for technology-related thefts in Taiwan, ''WSJ'' found that nine of those cases involved technology transfer to China. An employee of Nanya Technology Corp. allegedly stole designs for dynamic random-access memory (DRAM) on behalf of Tsinghua Holdings. Hsu Chih-Peng, an engineer for Taiwan Semiconductor Manufacturing Co., allegedly stole microchip designs after being solicited by the Chinese government-owned Shanghai Huali Microelectronics Corporation.

According to Taiwanese prosecutors, engineer Wang Yongming (on behalf of Fujian Jinhua Integrated Circuit) engaged in espionage to steal Micron Technology microchip designs via the Taiwanese company UMC.

Micron alleges that UMC hired Micron's engineers, asking them to steal files on advanced memory chips. The files Wang allegedly stole were said to be production secrets, including testing procedures related to metallization, and the DR25nmS design protocol.

Vietnam

According to the security research firm FireEye, Chinese hackers are suspected of targeting Vietnamese government and corporate targets.

The hacking group, designated Conimes, phished the targets and delivered malware via a pre-2012 version of Microsoft Word.

Europe

According to the cyber-security firm Area 1, hackers working for the People's Liberation Army Strategic Support Force compromised the COREU network used for communication by the European Union, allowing for the theft of thousands of low-classified documents and diplomatic cables.

According to a 2019 report released by the European External Action Service, there were an estimated 250 MSS spies operating in the EU capital.

In a July 2021 joint statement with NATO, the individual core Anglosphere/Five Eyes nations, and Japan, the EU accused the Ministry of State Security, along with MSS-contracted criminal hackers, of perpetrating several cyberattacks, most notably the 2021 Microsoft Exchange Server data breach. While some attacks were for-profit ransomware incidents by contracted hacker gangs, top EU diplomat Josep Borrell said the hacking was "for the purpose of intellectual property theft and espionage."

Belgium

In 2008, Belgian Justice Minister Jo Vandeurzen accused the Chinese government of electronic espionage against the government of Belgium, while Foreign Minister Karel De Gucht informed the Belgian Federal Parliament that his ministry was hacked by Chinese agents. The espionage is possibly linked to Belgium hosting the headquarters of NATO and the European Union.

The Katholieke Universiteit Leuven in Leuven was also believed to be the center for a group of Chinese students in Europe conducting industrial espionage, operating under a front organization called the Chinese Students' and Scholars' Association of Leuven. In 2005 a leading figure of the Association defected to Belgium, providing information to the Sûreté de l'Etat on hundreds of spies engaged in economic espionage across Europe. The group had no obvious links to Chinese diplomats and was focused on getting moles into laboratories and universities in the Netherlands, Britain, Germany, France and Belgium. The ''People's Daily'', an organ of the Central Committee of the Chinese Communist Party, dismissed the reports as fabrications triggered by fears of China's economic development.

In February 2019, a report was released by European External Action Service which estimated that there were 250 Chinese MSS spies operating in Brussels, the capital of the European Union.

Estonia

In March 2021, Estonian scientist Tarmo Kõuts was convicted of spying for China. According to the Estonian Internal Security Service, Kõuts was recruited in 2018 by China's Intelligence Bureau of the Joint Staff Department of the Central Military Commission, and was arrested on 9 September 2020. Kõuts was paid approximately €17,000 by his handlers. Kõuts worked for the Maritime Institute of Tallinn Technical University, and was also a member of the Scientific Committee of the Estonian Ministry of Defence and the NATO Undersea Research Center.

Finland

According to the security research firm F5, Chinese hackers launched widespread attacks against Finnish Internet of things computers prior to the 2018 Russia–United States summit in Helsinki.

In March 2021, the Finnish government implicated the China-linked hacking group APT31 in a hack of the Finnish Parliament. In July that same year, as part of a joint EU/NATO/ US/ UK statement on Chinese-backed hacking campaigns (see 2021 Microsoft Exchange Server data breach), the British National Cyber Security Centre joined in accusing China-linked hacking groups of being behind the Finnish Parliament hack.

France

There have been several incidents of suspected Chinese spies in France. This includes Shi Pei Pu

HOME


Content is Copyleft
Website design, code, and AI is Copyrighted (c) 2014-2017 by Stephen Payne


Consider donating to Wikimedia



As an Amazon Associate I earn from qualifying purchases