The government of China is engaged in espionage overseas, thought to be directed primarily through the Ministry of State Security (MSS). It is suspected of employing a variety of tactics including cyber spying to gain access to sensitive information remotely and physical agents (HUMINT). China is believed to be engaged in industrial espionage aimed at gathering information to bolster its economy, as well as monitoring dissidents abroad such as supporters of the Tibetan independence movement and Falun Gong.
It is believed that Chinese espionage is aimed at the preservation of China's national security through gaining commercial, technological, and military secrets. It is generally believed that Chinese intelligence agencies operate differently from other espionage organizations by employing primarily academics or students who will be in their host country only a short time, rather than spending years cultivating a few high-level sources or double agents. Much information about the Chinese intelligence services comes from defectors, whom the PRC accuses of lying to promote an anti-PRC agenda. One known exception to this rule is the case of Katrina Leung, who was accused of starting an affair with an FBI agent to gain sensitive documents from him. A U.S. judge dismissed all charges against her due to prosecutorial misconduct.
The United States believes the Chinese military has been developing network technology in recent years in order to perform espionage on other nations. Several cases of computer intrusions suspected of Chinese involvement have been found in various countries including Australia, New Zealand, Canada, France, Germany, the Netherlands, the United Kingdom, India and the United States.
In 2009, Canadian researchers say they have found evidence that Chinese hackers had gained access to computers possessed by government and private organizations in 103 countries, although researchers say there is no conclusive evidence China's government was behind it. Beijing also denied involvement. The researchers said the computers penetrated include those of the Dalai Lama and Tibetan exiles.
In January 2018, Le Monde reported that the headquarters of the African Union, which had been constructed by the China State Construction Engineering Corporation, had had its computer systems compromised between 2012 and 2017, with data from AU servers being forwarded to Shanghai. The building's computer system was subsequently removed and the AU refused a Chinese offer to configure the replacement system. Le Monde alleged that the AU had then covered up the hack to protect Chinese interests in the continent.
China and the African Union have rejected the allegations. Ethiopian Prime Minister Hailemariam Desalegn rejected the French media report, saying that he doesn't believe it. Moussa Faki Mahamat, head of the African Union Commission, said the allegations in the Le Monde's report were false. "These are totally false allegations and I believe that we are completely disregarding them."
Since at least April 2017, TEMP.Periscope, an advanced persistent threat based in China, has been hacking Cambodian organizations related to the 2018 general election. Targets included the National Election Commission, the Ministry of Interior, the Ministry of Foreign Affairs and International Cooperation, the Senate of Cambodia, and the Ministry of Economy and Finance. The APT engaged in spear phishing against Monovithya Kem of the Cambodia National Rescue Party, sending messages which impersonated the Cambodian League for the Promotion and Defense of Human Rights.
According to Falun Gong media The Epoch Times and Pan-democracy political groups, China has been sending spies into Hong Kong harassing dissents and Falun Gong practitioners. In 2012, according to Oriental Daily, a Chinese security ministry official has been arrested in Hong Kong for suspicion of acting as a double agent for the United States.
India has quietly informed companies to avoid using Chinese-made telecommunications equipment, fearing that it may have spy capabilities embedded within it. Also, India's intelligence service, Research and Analysis Wing (RAW) believes that China is using dozens of study centers that it has set up in Nepal near the Indian border in part for the purposes of spying on India. In August 2011 a Chinese research vessel disguised as a fishing trawler was detected off the coast of Little Andaman, collecting data in a geostrategically sensitive region.
The "Luckycat" hacking campaign that targeted Japan and Tibet also targeted India. A Trojan horse was inserted into a Microsoft Word file ostensibly about India's ballistic missile defense program, allowing for the command and control servers to connect and extract information. The attacks were subsequently traced back to a Chinese graduate student from Sichuan and the Chinese government is suspected of planning the attacks.
Chinese hackers linked to the Third Technical Department of the People’s Liberation Army have launched extensive and sustained hacking campaigns against the Central Tibetan Administration, based in Dharamshala.
In March 2019, Indian intelligence agencies, told news services that China was trying to spy on Indian Naval bases, located in southern India and also on Integrated Test Range missile testing facility located at Abdul Kalam Island. China was doing this by establishing Chinese business around these areas.
According to a report by Trend Micro the "Luckycat" hacker group is engaged in cyber-espionage on targets in Japan, India and Tibet. During the 2011 Tōhoku earthquake and tsunami and nuclear meltdowns at Fukushima, the hackers inserted a Trojan virus into PDF attachments to emails being circulated containing information about radiation dosage measurements. Investigation into ownership of the command and control servers by Trend Micro and The New York Times linked the malware to Gu Kaiyuan, through QQ numbers and the alias "scuhkr". Mr. Gu is a former graduate student of the Information Security Institute of Sichuan University in Chengdu and wrote his master's thesis on computer hacking. James A. Lewis of the Center for Strategic and International Studies, believes the attacks were state-sponsored.
FireEye President Travis Reese has stated that the Chinese-sponsored Conference Crew, founded in 2016, has engaged in cyber-espionage against the Philippines, targeting diplomatic and national security information.
FireEye claims that two hacker operations tied to the Chinese military, dubbed Tonto Team and Stone Panda/APT10, have attempted to hack the South Korean Ministry of Foreign Affairs and other targets related to the deployment of THAAD.
In Sri Lanka, Jayalalithaa Jayaram – head of the All India Anna Dravida Munnetra Kazhagam – stated that Chinese laborers working in parts of the country devastated by the Sri Lankan Civil War were infiltrated with Chinese spies on surveillance missions targeted at India.
Presidential aide Wang Jen-ping was found in 2009 to have sold nearly 100 confidential documents to China since 2007; Military intelligence officer Lo Chi-cheng was found to have been acting as a double agent in 2010 for China since 2007; Maj. Gen. Lo Hsien-che, electronic communications and information bureau chief during the administration of former President Chen Shui-bian, has been suspected of selling military secrets to Mainland China since 2004.
In 2007 the Ministry of Justice Investigation Bureau stated that 500 gigabyte Maxtor Basics Personal Storage 3200 hard drives produced by Seagate Technology and manufactured in Thailand may have been modified by a Chinese subcontractor and shipped with the Virus.Win32.AutoRun.ah virus. As many as 1,800 drives sold in the Netherlands and Taiwan after August 2007 were reportedly infected with the virus, which scanned for passwords for products such as World of Warcraft and QQ and uploading them to a website in Beijing.
Army Major General Hsieh Chia-kang, deputy commander of Matsu Defense Command, has been accused of providing intelligence to China, having been recruited by retired army colonel Hsin Peng-sheng.
Zhou Hongxu (周泓旭), a graduate of National Chengchi University's MBA program, has been accused of attempting to recruit an official from the Ministry of Foreign Affairs for the purposes of providing intelligence to China. Zhou was reportedly instructed by China's Taiwan Affairs Office to enroll in the university in order to make friends and develop a spy ring. Zhou reportedly solicited classified documents, offering trips to Japan and United States dollars in payment.
In January 2018, it was reported that the Taipei District Prosecutors’ Office is investigating if classified information regarding the Airborne Special Service Company was passed on to Zhou Hongxu (周泓旭), who was already convicted for violating the National Security Act. In March 2018, a retired colonel was charged with breaching the National Security Act by the Kaohsiung District Prosecutors’ Office, which alleged that the colonel shared classified personal information and planned to develop a spy ring in Taiwan. In April 2018, Hung Chin-hsi (洪金錫), a Macau-born businssman, was accused of developing a spy ring in the Ministry of Justice, on behalf of China. Captain Zhen Xiaojiang (鎮小江) was convicted in 2015 of recruiting Taiwanese military officers as part of a spy ring on behalf of China, including Army Major-General Hsu Nai-chuan (許乃權). Zhen sent intelligence regarding Taiwan's radar installations and Dassault Mirage 2000 fighters to China. He was deported to Hong Kong in July 2018.
The Wall Street Journal reported that Taiwan has been "ground zero" for economic espionage related to integrated circuit fabrication. In a review of ten prosecutions for technology-related thefts in Taiwan, WSJ found that nine of those cases involved technology transfer to China. An employee of Nanya Technology Corp. allegedly stole designs for dynamic random-access memory (DRAM) on behalf of Tsinghua Holdings. Hsu Chih-Peng, an engineer for Taiwan Semiconductor Manufacturing Co., allegedly stole microchip designs after being solicited by the Chinese government-owned Shanghai Huali Microelectronics Coration.
According to Taiwanese prosecutors, engineer Wang Yongming (on behalf of Fujian Jinhua Integrated Circuit) engaged in espionage to steal Micron Technology microchip designs via the Taiwanese company UMC. Micron alleges that UMC hired Micron's engineers, asking them to steal files on advanced memory chips. The files Wang allegedly stole were said to be production secrets, including testing procedures related to metallization, and the DR25nmS design protocol.
According to the security research firm FireEye, Chinese hackers are suspected of targeting Vietnamese government and corporate targets. The hacking group, designated Conimes, phished the targets and delivered malware via a pre-2012 version of Microsoft Word.
According to the cyber-security firm Area 1, hackers working for the People's Liberation Army Strategic Support Force compromised the COREU network used for communication by the European Union, allowing for the theft of thousands of low-classified documents and diplomatic cables.
Belgian Justice Minister Jo Vandeurzen accused the Chinese government of electronic espionage against the government of Belgium, while Foreign Minister Karel De Gucht informed the Belgian Federal Parliament that his ministry was hacked by Chinese agents. The espionage is possibly linked to Belgium hosting the headquarters of NATO and the European Union.
The Katholieke Universiteit Leuven in Leuven was also believed to be the center for a group of Chinese students in Europe conducting industrial espionage, operating under a front organization called the Chinese Students' and Scholars' Association of Leuven. In 2005 a leading figure of the Association defected to Belgium, providing information to the Sûreté de l’Etat on hundreds of spies engaged in economic espionage across Europe. The group had no obvious links to Chinese diplomats and was focused on getting moles into laboratories and universities in the Netherlands, Britain, Germany, France and Belgium. The People's Daily, an organ of the Central Committee of the Communist Party of China, dismissed the reports as fabrications triggered by fears of China's economic development.
There have been several incidents of suspected Chinese spies in France. This includes Shi Pei Pu, a Chinese opera singer from Beijing who convinced a French diplomat that he was a woman, and spied on France.
French media also portrayed Li Li Whuang (李李), a 22-year-old Chinese intern at car parts maker Valeo, as an industrial spy. Both the French prosecution and Valeo refuted media claims of spying and the case was later considered to be a psychosis. Li Li was ultimately convicted of violating the confidentiality clause of her contract and served two months in prison, but was allowed to continue her doctoral studies at the University of Technology of Compiègne.
Two French intelligence operatives, identified only as Henri M and Pierre-Marie H, were accused of communicating classified information to China. Henri M was reportedly the Beijing station chief for the Directorate-General for External Security.
According to reporting by Le Figaro, the General Directorate for Internal Security and Directorate-General for External Security believe that Chinese spies have used LinkedIn to target thousands of business and government officials as potential sources of information.
Between August and September 2007 Chinese hackers were suspected of using Trojan horse spyware on various government computers, including those of the Chancellory, the Ministry of Economics and Technology, and the Ministry of Education and Research. Germans officials believe Trojan viruses were inserted in Microsoft Word and PowerPoint files, and approximately 160 gigabytes of data were siphoned to Canton, Lanzhou and Beijing via South Korea, on instructions from the People's Liberation Army.
The Federal Ministry of the Interior estimates that Chinese economic espionage could be costing Germany between 20 and 50 billion euros annually. Spies are reportedly targeting mid- and small-scale companies that do not have as strong security regimens as larger corporations. Berthold Stoppelkamp, head of the Working Group for Economic Security (ASW), stated that German companies had a poor security culture making espionage easier, exacerbated by the absence of a "strong, centralized" police command. Walter Opfermann, a counter-intelligence expert for the state of Baden-Württemberg, claimed that China is using extremely sophisticated electronic attacks capable of endangering portions of critical German infrastructure, having gathered sensitive information through techniques such as phone hacking and Trojan emails. In November 2018, German prosecutors in Cologne charged a former employee of Lanxess for engaging in industrial espionage on behalf of a Chinese copycat company.
Germany suspects China of spying both on German corporations and on Uyghur expatriates living in the country. In 2011, a 64-year-old German man was charged with spying on Uighurs in Munich between April 2008 and October 2009. Munich is a center for expatriate Uyghurs, and in November 2009 members of the Federal Criminal Police Office arrested four Chinese nationals on charges of spying on Uyghurs. In 2007 Chinese diplomat Ji Wumin left Germany after being observed meeting with individuals engaged in surveillance of Munich Uyghurs, and German investigators suspect China is coordinating espionage activities out of its Munich consulate in the Neuhausen district.
In 2017, the Federal Office for the Protection of the Constitution (BfV) published information alleging that Chinese intelligence services had created fake social media profiles on sites such as LinkedIn, using them to gather information on German politicians and government officials. The Verfassungsschutz had previously warned that Chinese intelligence officers are making use of social networking sites such as LinkedIn and XING to recruit informants. Lu Kang of the Ministry of Foreign Affais denied the allegations.
Lithuanian intelligence agencies have claimed that China is engaged in an "increasingly aggressive" campaign of espionage, which includes "attempts to recruit Lithuanian citizens". Darius Jauniskis, Director of the State Security Department of Lithuania, has cautioned against a potential threat posed by Huawei telecommunications equipment.
Hackers working as part of APT 10, on behalf of the Chinese government, hacked Norwegian business software provider Visma, reportedly to gain access to the information on the company's customers. Beginning on August 30, 2018, APT10 used a malware program dubbed Trochilus and accessed a backdoor, and then proceeded to use WinRAR and cURL to exfiltrate data from Visma to a Dropbox account.
In May 2009, Stefan Zielonka, a Polish cipher officer working for the Military Information Services, disappeared. He is suspected of providing the Chinese or Russian governments with Polish and NATO cryptography information. Zielonka's body was later retrieved from the Vistula river, although investigators remain uncertain as to whether Zielonka was attempting to defect or committed suicide, or whether the body retrieved actually was Zielonka's.
In January 2019, the Huawei sales director for Poland, identified as Weijing Wang (a.k.a "Stanislaw Wang") was arrested, along with a former senior agent of the Agencja Bezpieczeństwa Wewnętrznego, on suspicion of espionage.
In December 2007, Igor Reshetin, the Chief Executive of Tsniimash-Export, and three researchers were sentenced to prison for passing on dual-purpose technology to the Chinese. Analysts speculated that the leaked technology could help China develop improved missiles and accelerate the Chinese space program. In September 2010, the Russian Federal Security Service detained two scientists working at the Baltic State Technical University in Saint Petersburg. The two are charged with passing on classified information to China, possibly through the Harbin Engineering University.
Babur Maihesuti, a Chinese Uighur who became a Swedish citizen was arrested for spying on the Uighur refugee communities in Sweden, Norway, Germany and the United States, and ultimately sentenced for illegal espionage activity. In April 2018 Sweden charged Dorjee Gyantsan, a 49-year old Tibetan refugee, with spying on Tibetan dissidents and refugees in Sweden between July 2015 and February 2017. Gyantsan is accused of collecting information on Tibetan refugees in Sweden, and then pass that information on to Chinese officials in Finland and Poland. Gyantsan was arrested upon returning from Warsaw, carrying $6,000 in cash.
UK officials, including experts at its MI5 intelligence agency, are fearful that China could shut down businesses in the nation with Chinese cyber attacks and spy equipment embedded in computer and telecommunications equipment. MI5 has reportedly monitored Chinese espionage against Rio Tinto Group computers.
According to Robert Hannigan, former Director of the Government Communications Headquarters, Chinese hackers have engaged in economic espionage against British universities and engineering companies, on behalf of the Chinese government.
Newspapers have estimated that China may have up to 1,000 spies in Canada. The head of the Canadian Security Intelligence Service Richard Fadden in a television interview was assumed to have implied that various Canadian politicians at provincial and municipal levels had ties to Chinese intelligence. In an interview, he claimed that some politicians were under the influence of a foreign government, but he withdrew the statement a few days later. It was assumed by Chinese groups in Canada, and others, that he was referring to China because in the same interview he stressed the high level of Chinese spying in Canada, however Fadden did not say specifically which country these politicians were under the influence of. His statement was withdrawn a few days later.
In 2005, Canadian businessman Joe Wang stated his belief that threatening letters he received after broadcasting programs about alleged human rights abuses in China were from the Chinese consulate; one of the envelopes contained boric acid.
In 2012 Mark Bourrie, an Ottawa-based freelance journalist, stated that the State Council-run Xinhua News Agency asked him to collect information on the Dalai Lama through their Ottawa bureau chief, Dacheng Zhang, by exploiting his journalistic access to the Parliament of Canada. Bourrie stated that he was asked to write for Xinhua in 2009 and sought advice from the Canadian Security Intelligence Service (CSIS), but was ignored. Bourrie was asked to collect information on the Sixth World Parliamentarians' Convention on Tibet at the Ottawa Convention Centre, although Xinhua had no intention of writing a story on the proceedings. Bourrie stated that at that point "We were there under false pretenses, pretending to be journalists but acting as government agents." Xinhua collects extensive information on Tibetan and Falun Gong dissidents in Canada, and is accused of being engaged in espionage by Chinese defector Chen Yonglin and Reporters Without Borders.
On December 1, 2013, Lloyd's Register employee Qing Quentin Huang was arrested and charged with violating the Security of Information Act, for allegedly communicating classified information on the federal shipbuilding strategy to China. Huang reportedly contacted the Chinese Embassy in Ottawa in an attempt to pass on secrets, which was detected by the Canadian Security Intelligence Service, who in turn alerted the Royal Canadian Mounted Police.
China is suspected of having a long history of espionage in the United States against military and industrial secrets, often resorting to direct espionage, exploitation of commercial entities, and a network of scientific, academic, and business contacts. Several U.S. citizens have been convicted for spying for China. Naturalized citizen Dongfan Chung, an engineer working with Boeing, was the first person convicted under the Economic Espionage Act of 1996. Chung is suspected of having passed on classified information on designs including the Delta IV rocket, F-15 Eagle, B-52 Stratofortress and the CH-46 and CH-47 helicopters.
The U.S. Department of Justice investigation into the fund-raising activities had uncovered evidence that Chinese agents sought to direct contributions from foreign sources to the Democratic National Committee (DNC) before the 1996 presidential campaign. The Chinese embassy in Washington, D.C. was used for coordinating contributions to the DNC.
China's espionage and cyber attacks against the US government and business organizations are a major concern, according to the seventh annual report (issued September 2009) to the US Congress of the U.S.-China Economic and Security Review Commission. "Although attribution is a problem in cyber attacks, the scale and coordination of the attacks strongly indicates Chinese state involvement," said commission vice chairman Larry Wortzel. "In addition to harming U.S. interests, Chinese human and cyber espionage activities provide China with a method for leaping forward in economic, technological, and military development." The report cited that the number of cyber attacks from China against the US Department of Defense computer systems had grown from 43,880 in 2007 to 54,640 in 2008, a nearly 20 percent increase. Reuters reported that the Commission found that the Chinese government has placed many of its computer network responsibilities under the direction of the People's Liberation Army, and was using the data mostly for military purposes. In response, China slammed the report as "full of prejudice," and warning it could damage China-US relations. "We advise this so-called commission not to always view China through tinted glasses," Foreign Ministry spokesman Qin Gang said.
In 2008 the Chinese government was accused of secretly copying information from the laptop of Commerce Secretary Carlos Gutierrez during a trade mission to Beijing in order to gain information on American corporations. The allegations were subsequently dismissed by Qin Gang, a spokesman for the Ministry of Foreign Affairs of the People's Republic of China.
In November 2005 the United States arrested four people in Los Angeles on suspicion of being involved in a Chinese spy ring.
Taiwanese-American scientist Wen Ho Lee (born in Nantou, Taiwan 21 December 1939) was accused and investigated on the grounds of espionage in 1999 but was acquitted of all charges except for mishandling classified data.
In response to these and other reports of cyberattacks by China against the United States, Amitai Etzioni of the Institute for Communitarian Policy Studies has suggested that the United States and China should agree to a policy of mutually assured restraint with respect to cyberspace. This would involve allowing both states to take the measures they deem necessary for their self-defense while simultaneously agreeing to refrain from taking offensive steps; it would also entail vetting these commitments.
In June 2015, the United States Office of Personnel Management (OPM) announced that it had been the target of a data breach targeting the records of as many as four million people. Later, FBI Director James Comey put the number at 18 million. The Washington Post has reported that the attack originated in China, citing unnamed government officials. James Comey said: "It is a very big deal from a national security perspective and from a counterintelligence perspective. It's a treasure trove of information about everybody who has worked for, tried to work for, or works for the United States government."
Defence Secretary Dennis Richardson has stated that China is engaged in extensive espionage against Australia, and included surveillance of Chinese Australian communities. Australia believes that the Chinese government have been spying on Australian businesses. A male Chinese student from Fujian was granted a protection visa by the Refugee Review Tribunal of Australia after revealing that he had been instructed to spy on Australian targets in exchange for an overseas scholarship, reporting to the Ministry of State Security. Reported targets included Chinese students with anti-Communist sentiments and Falun Gong practitioners.
Nicola Roxon, the Attorney-General of Australia, blocked the Shenzhen-based corporation Huawei from seeking a supply contract for the National Broadband Network, on the advice of the Australian Security Intelligence Organisation. The Australian government feared Huawei would provide backdoor access for Chinese cyber espionage.
The Chinese government is suspected of orchestrating an attack on the email network used by the Parliament of Australia, allowing unauthorized access to thousands of emails and compromising the computers of several senior Australian politicians including Prime Minister Julia Gillard, Foreign Minister Kevin Rudd, and Minister of Defense Stephen Smith.
Sheri Yan and Roger Uren were investigated by ASIO on suspicion of spying for China. Oren, former Assistant Secretary responsible for the Asia section of the Office of National Assessments, was found to have removed documents pertaining to Chinese intelligence operations in Australia, and kept them in his apartment. Yan was suspected of undertaking influence operations on behalf of the Chinese Communist Party, and introducing Colonel Liu Chaoying, a military intelligence officer, to Australian contacts.
Hackers either working for or on behalf of the government of China are suspected as being responsible for a cyber-espionage attack against an Australian defense company. Designated APT Alf by the Australian Signals Directorate, the hackers stole approximately 30 gigabytes of data on projects including the F-35 Joint Strike Fighter, the P-8 Poseidon, the C-130 Hercules and the Joint Direct Attack Munition. APT Alf used a remote access tool dubbed "China Chopper".
In 2017, Chinese hackers infiltrated the computers of Australian National University, potentially compromising national security research conducted at the university. In 2015, Chinese hackers infiltrated the Bureau of Meteorology.
Jian Yang, a member of the New Zealand House of Representatives, was investigated by the New Zealand Security Intelligence Service as a possibly spy due to his links to Chinese military and intelligence schools. Yang reportedly failed to declare that he had taught at the Air Force Engineering University or the Luoyang People's Liberation Army University of Foreign Languages, which are commonly used as training grounds for Chinese intelligence officers. Yang has denied the allegations that he is a spy.
The computer security firm ESET reported that tens of thousands of blueprints were stolen from Peruvian corporations through malware, which were traced to Chinese e-mail accounts. This was done through an AutoCAD worm called ACAD/Medre.A, written in AutoLISP, which located AutoCAD files, at which point they were sent to QQ and 163.com email accounts in China. ESET researcher Righard Zwienenberg claimed this was Chinese industrial espionage. The virus was mostly localized to Peru but spread to a few neighboring countries before being contained.
China and the African Union dismissed on Monday a report that Beijing had bugged the regional bloc’s headquarters, which it built and paid for in the Ethiopian capital.
He cited as an example the Conference Crew, which was founded in 2016 and has since expanded its operations early this year against critics of public and private institutions in seven countries, including the Philippines, where it collected important and strategic information that it will use for the interest and advantage of China. Boland said the Conference Crew sponsored by the Chinese government has increased its attacks on the defense and banking industries, financial services, telecommunications, consulting and media. The Conference Crew attack on the government is “predominantly [focused]on national security and diplomacy.”
A prominent Chinese-born academic has lost an appeal against Singapore’s decision to expel him for allegedly being an “agent of influence” for a foreign government, the interior ministry said on Wednesday.
On August 4, Singapore announced it was expelling a China-born American professor for trying to influence the city state’s foreign policy on behalf of an unnamed foreign government
Without naming names, Singapore's government said state actors were behind the attack that saw thieves take information such as names, identification numbers, and outpatient prescription details. Experts are pointing fingers at China.
FireEye claims to have found evidence that the attacks were staged by two groups connected to the Chinese military. One, dubbed Tonto Team by FireEye, operates from the same region of China as previous North Korean hacking operations. The other is known among threat researchers as APT10, or "Stone Panda"—the same group believed to be behind recent espionage efforts against US companies lobbying the Trump administration on global trade. These groups have also been joined in attacks by two "patriotic hacking" groups not directly tied to the Chinese government, Hultquist told the Journal—including one calling itself "Denounce Lotte Group" targeting the South Korean conglomerate Lotte. Lotte made the THAAD deployment possible through a land swap with the South Korean government.
A cybersecurity firm in the United States believes state-sponsored Chinese hackers were trying to infiltrate an organization with connections to a US-built missile system in South Korea that Beijing firmly opposes. [...] When asked if the group could be North Koreans posing as Chinese hackers, Hultquist said his team has gathered plenty of evidence to prove the group's origins, including their use of the Chinese language.
Chinese companies are suspected of stealing the intellectual property of Samsung Electronics and SK hynix to obtain advanced technological knowhow from them, sources familiar with the matter said Wednesday.
The company is warning users today that a small percentage of Maxtor Basics Personal Storage 3200 hard drives purchased after August 2007 were shipped with a virus called "virus.win32.autorun.ah."
A retired military police officer who was on the security detail of former vice president Annette Lu (呂秀蓮) was yesterday indicted for spying for China, the Taoyuan District Prosecutors’ Office said. The office said it had charged Major Wang Hung-ju (王鴻儒), 46, with violating the National Security Act (國家安全法) after he was found to be involved in espionage.
Army Major General Hsieh Chia-kang (謝嘉康), who is being investigated over allegations he leaked classified information on Taiwan’s missile defense systems to China, was released late on Tuesday after posting bail, prosecutors said.
"A man named Zhou Hongxu has been detained," Liao Chien-yu, a judge and spokesman for the Taipei District Court, told Reuters. Liao said the named suspect was the same individual being cited in local media reports. Prosecutors asked that Zhou be taken into custody on suspicion of violating national security laws and the request was approved by the court, Liao said, adding that Zhou could be held for at least two months.
Zhou Hongxu (周泓旭), 29, from Liaoning Province in China, was enrolled in an MBA program at National Chengchi University in Taipei 2012-2016 [...] Investigators said that Zhou allegedly was in contact with a Ministry of Foreign Affairs official, whom he had met while studying in Taiwan, and was trying to persuade the contact to hand over classified information in exchange for free trips abroad.
The Taipei District Prosecutors’ Office is looking into allegations that New Party Youth Corps member Lin Ming-cheng (林明正) passed on personal information and contact details of soldiers in the Army Aviation and Special Forces Command’s secretive Airborne Special Service Company (高空特種勤務中隊), also known as the “Liang Shan Special Operations Company” (涼山特勤隊) to former Chinese student Zhou Hongxu (周泓旭), who has been convicted of doing intelligence work for China, the newspaper said yesterday.
Investigators said that documents show Lan passed on the personal information of six colonels and lieutenant colonels, as well as other university officers and military unit members, to China. Lan allegedly also passed on other classified military materials provided by his former colleagues, and that he had agreed to develop a spy network in Taiwan to conduct espionage for China.
Both the lures, as well as others Read said his team has seen, contain malware exploits of Microsoft Word, a common tactic against computers that either run pirated versions of Microsoft Office or versions that haven’t been updated.
According to media reports, Justice Minister Jo Vandeurzen has claimed that hacking attacks against the Belgian Federal Government have originated in China, and are likely to have been at the bequest of the Beijing government. Separately, Belgian minister of foreign affairs Karel De Gucht has told parliament that his ministry was the subject of cyberespionage by Chinese agents several weeks ago. [...] There has been speculation that China may be interested in spying on Belgium because NATO and the European Union have headquarters in the country. It has also been suggested that China may be interested in exploring Belgium's historical connections with Central Africa.
Some European countries deliberately sensationalized the so-called "Chinese espionage" in the past half a month. At the end of April, France set off a new upsurge of "Chinese girl student as industrial espionage"; on May 9, various leading media in Sweden followed suit by creating the Karolinska "Chinese scholar espionage"; on May 11, L'Agence France-Presse and a Belgian news website concocted a "Chinese economic espionage website" at Katholieke Universiteit Leuven. For a second, the "Chinese espionage" incidents had spread like wildfire in the European continent. [...] When asked the reason for these false reports, Sun Ling, Counselor for Education of Chinese Embassy in Sweden, noted that the fast development of China's economy made a few people who hold biased attitude towards China feel ill at ease. They think that China's rapid development was achieved through illegal means such as grabbing advanced techniques from the Western countries. If we have a look at the latest development of such incidents, the truth will be clear that such moves are a vicious undercurrent discriminating and demonizing China.
The attacks on Finnish internet-connected devices originating from ChinaNet, China’s largest internet backbone, began spiking July 12, just four days before Mr. Trump and Mr. Putin met in Helsinki, claimed the analysis by the Seattle-based cybersecurity firm F5.
Germany’s intelligence service has published the details of social network profiles which it says are fronts faked by Chinese intelligence to gather personal information about German officials and politicians [...] Among the faked profiles whose details were published were that of “Rachel Li”, identified as a “headhunter” at “RiseHR”, and an “Alex Li”, a “Project Manager at Center for Sino-Europe Development Studies”.
Hans-Georg Maassen said his agency, known by its German acronym BfV, believes more than 10,000 Germans have been targeted by Chinese intelligence agents posing as consultants, headhunters or researchers, primarily on the social networking site LinkedIn.
Germany’s domestic intelligence service, the Federal Office for the Protection of the Constitution, is warning of increasing Chinese espionage all the way up to the German chancellery, according to an intelligence report obtained by weekly business magazine WirtschaftsWoche, a sister publication of Handelsblatt Global. The report states that Chinese spies are increasingly utilizing social networks such as Facebook or the business networking site Xing to recruit informants.
In Beijing on Monday, Lu Kang, a spokesman for the Ministry of Foreign Affairs, called the investigation “complete hearsay and groundless.” He urged German officials to “speak and act more responsibly.”
Mateusz P., who was once an MP for Poland’s Samoobrona (Self-Defence) party and headed the Zmiana (Change) grouping, has been charged with working for the Russian and Chinese intelligence services and against Poland’s national interests, broadcaster RMF FM reported, citing a bill of indictment that it said prosecutors had submitted against the suspect.
The Chinese executive is a sales director for Huawei in Poland and his full name is Weijing Wang, the person said. Mr Wang also uses the first name Stanislaw. According to his LinkedIn page, Mr Wang worked in the Chinese consulate in Gdansk for more than four years as the assistant to the general consul before working for Huawei.
The article claims that profiles with anodyne names such as Lily Hu or Rachel Li contact university staff or researchers in Switzerland and Europe, then encourage them to transfer know-how to China.
Geheimdienste werben Informanten im Internet an: Der Bund warnt vor einschlägigen Kontakten auf Linkedin.
The indictment accuses Mr Gyantsan of having spied on Tibetan community members in Sweden for "cash benefits" and says he met "a representative of the Chinese state repeatedly in Poland, in connection with this activity". The espionage allegedly took place in 2015-2017. When he was arrested, on returning from Warsaw, he was found to be carrying $6,000 (£4,200) in cash.
Swedish prosecutor Mats Ljungqvist told Swedish broadcaster SVT that he man had been in contact with Chinese officials in Poland and Finland, and was paid 50,000 kronor ($6,000) on at least one occasion.
A naval engineer accused of trying to spy for Beijing is asking a federal judge for full access to information about Canadian Security Intelligence Service wiretaps of the Chinese Embassy. [...] Huang, 53 at the time, worked for Lloyd's Register, a subcontractor to Irving Shipbuilding Inc. He was charged under the Security of Information Act with attempting to communicate secret information to a foreign power. Police said the information related to elements of the federal shipbuilding strategy, which includes patrol ships, frigates, naval auxiliary vessels, science research vessels and icebreakers.
"It is no secret that China is very active in intelligence activities directed against us. It is more than cyber," Dennis Richardson, secretary of the Defense Department, said in a speech in Canberra. [...] "The Chinese government keeps a watchful eye inside Australian Chinese communities and effectively controls some Chinese-language media in Australia," said Richardson.
Fairfax Media has confirmed one of Yan's contacts was a Chinese military intelligence operative and reputed arms broker, Colonel Liu Chaoying. Yan introduced Colonel Liu to her Australian network, including a wealthy Australian businessman who took Colonel Liu on several dinner dates.
A Fairfax Media and Four Corners investigation reports the raid targeted Sheri Yan and former Australian diplomat Roger Uren, over allegations she was involved in operations for the Chinese Communist Party.
The ABC has been told the Australian National University (ANU) system was first compromised last year.
They say Mr Yang, who was elected in 2011, was investigated for the decade he spent in China, where he received military and intelligence training at so-called "spy schools".
A National MP who taught English to Chinese spies didn't declare the names of the military institutions where that happened to New Zealand authorities. Jian Yang told the Herald he didn't name the Air Force Engineering University or Luoyang People's Liberation Army University of Foreign Languages when making the applications that led to New Zealand citizenship, which he was granted in 2004.
Goodfellow said he could not recall if the party knew Yang had spent a decade at the People's Liberation Army-Air Force Engineering School and the Luoyang Foreign Languages Institute but it did know about him studying there. Told the two venues were commonly training grounds for Chinese intelligence officers, and the language institute was specialised in preparing spies linguistically, Goodfellow said "He is a very good linguist."
A Chinese-born member of New Zealand’s parliament denied being a spy for China at a press conference on Wednesday, although he acknowledged having taught students English for the purpose of information gathering at one of China’s leading military academies [...] He also said the reports about his background were a “smear campaign” and suggested that anti-Chinese racism was the motive.
The debate over political influence within New Zealand intensified last year with revelations that Jian Yang, a legislator in New Zealand's then-ruling center-right National Party, had taught English to Chinese spies before leaving China in the 1990s and becoming a New Zealand citizen in 2004. Yang denied having spied for China and remains in Parliament.
An advanced persistent threat (APT) is a stealthy computer network attack in which a person or group gains unauthorized access to a network and remains undetected for an extended period. The term's definition was traditionally associated with state sponsorship, but over the last few years there have been multiple examples of non-state sponsored groups conducting large-scale targeted intrusions for specific goals.An APT may have either business or political motives. APT processes require a high degree of covertness over a long period of time. The "advanced" process signifies sophisticated techniques using malware to exploit vulnerabilities in systems. The "persistent" process suggests that an external command and control system is continuously monitoring and extracting data from a specific target. The "threat" process indicates human involvement in orchestrating the attack.APT usually refers to a group, such as a government, with both the capability and the intent to target, persistently and effectively, a specific entity. The term is commonly used to refer to cyber threats, in particular that of Internet-enabled espionage using a variety of intelligence gathering techniques to access sensitive information, but applies equally to other threats such as that of traditional espionage or attacks. Other recognized attack vectors include infected media, supply chain compromise, and human intelligence and deception. The purpose of these attacks is to place custom malicious code on one or multiple computers for specific tasks and to remain undetected for the longest possible period. Knowing the attacker artifacts, such as file names, can help a professional make a network-wide search to gather all affected systems.
Individuals, such as an individual adversary, are not usually referred to as an APT, as they rarely have the resources to be both advanced and persistent even if they are intent on gaining access to, or attacking, a specific target.China–United States trade war
China and the United States are engaged in a trade war as each country continues to dispute tariffs placed on goods traded between them. US President Donald Trump had declared in his campaign to fix China's "longtime abuse of the broken international system and unfair practices". In April 2018, the United States filed a request for consultation to the World Trade Organization in regard to concerns that China was violating intellectual property rights.In adding various tariffs, the U.S. administration is relying partly on Section 301 of the Trade Act of 1974 to prevent what it calls unfair trade practices and theft of intellectual property. This gives the president the authority to unilaterally impose fines or other penalties on a trading partner if it is deemed to be unfairly harming U.S. business interests, especially if it violated international trade agreements. As a rebuttal against United States trade pressure; on September 24, 2018, China issued a white paper on the facts of Sino-U.S. economic and trade friction and China's position. On December 14, China's State Council Tariff Tax Committee decided to suspend the imposition of tariffs on automobiles and parts originating in the United States for three months from January 1, 2019, involving 211 tax items.
The result is that the U.S. claims Chinese laws undermine intellectual property rights by forcing foreign companies to engage in joint ventures with Chinese companies, which then gives the Chinese companies access and permission to use, improve, copy or steal their technologies. However, China explains it has strengthened IPR protections and that the U.S. has ignored this; that the U.S. has ignored WTO rules and ignored the calls of its own industries to reduce tariffs. China firmly opposes these U.S. trade practices, believing they represent "unilateralism" and "protectionism".Chinese espionage in the United States
China is alleged to have begun a widespread effort to acquire U.S. military technology and classified information and the trade secrets of U.S. companies. The Chinese government is accused of stealing trade secrets and technology, often from companies in the United States, to help support its long-term military and commercial development. China has been accused of using a number of methods to obtain U.S. technology (using U.S. law to avoid prosecution), including espionage, exploitation of commercial entities and a network of scientific, academic and business contacts. Although it uses a network of contacts to collect information used to benefit Chinese businesses, each bit of information does not invite scrutiny or prosecution by the U.S. government. Espionage cases include Larry Wu-Tai Chin, Katrina Leung, Gwo-Bao Min, Chi Mak and Peter Lee.In addition to traditional espionage, China partners civilian Chinese companies with American businesses to acquire technology and economic data and uses cyber spying to penetrate the computer networks of U.S. businesses and government agencies; an example is the December 2009 Operation Aurora. U.S. law enforcement officials have identified China as the most active foreign power involved in the illegal acquisition of American technology that China wants. On May 19, 2014, the United States Department of Justice announced that a Federal grand jury had indicted five People's Liberation Army officers for stealing confidential business information and intellectual property from U.S. commercial firms and planting malware on their computers.Cyberwarfare by China
China is both the world's second-largest economy and a nuclear weapons state with the world's second-largest defense budget. Chinese Information Operations and Information Warfare includes the concept of “network warfare”, roughly analogous to the United States concept of cyber-warfare. Foreign Policy magazine puts the size of China's "hacker army" at anywhere from 50,000 to 100,000 individuals.Western countries have long accused China of aggressive espionage, and while investigations have traced various attacks on corporate and infrastructure computer systems in their countries to have originated in China, "it is nearly impossible to know whether or not an attack is government-sponsored because of the difficulty in tracking true identities in cyberspace." China has denied these accusations of cyber-warfare and has, in turn, accused the United States of engaging in cyber-warfare against China - a claim the US government denies.Ministry of State Security (China)
The Ministry of State Security (MSS) is the intelligence and security agency of the People's Republic of China (non-military area of interests), responsible for counter-intelligence, foreign intelligence and political security. It is headquartered in Beijing.
Article 4 of the Criminal Procedure Law gives the MSS the same authority to arrest or detain people as regular police for crimes involving state security with identical supervision by the procuratorates and the courts.The National Intelligence Law of 2017 grants the MSS broad powers to conduct many types of espionage both domestically and abroad, it also gives the MSS the power to administratively detain those who impede or divulge information on intelligence work for up to 15 days.The network of state security bureaus and the Ministry of State Security should not be confused with the separate but parallel network of public security bureaus, administered by the Ministry of Public Security.
A document from the U.S. Department of Justice described the agency as being like a combination of the U.S. CIA and FBI.Science and technology in China
Science and technology in China have developed rapidly during the 1990s to 2010s. The Chinese government has placed emphasis through funding, reform, and societal status on science and technology as a fundamental part of the socio-economic development of the country as well as for national prestige. China has made rapid advances in areas such as education, infrastructure, high-tech manufacturing, academic publishing, patents, and commercial applications and is now in some areas and by some measures a world leader. China is now increasingly targeting indigenous innovation and aims to reform remaining weaknesses.