Chinese Espionage Operations and Tactics – Part 2

Case of Edward Peng Xuehua

Edward Peng Xuehua’s case exposed one of the ways that Chinese intelligence officers work to collect classified information from the United States without having to step foot in this country.

Peng first came to the United States in 2001 on a business visa and stayed legally as a non-immigrant worker. He married and in 2006 became a permanent resident, and six years after that became a full citizen. He had a registered business, US Tour and Travel, which served visitors from China planning to study in the United States.

Peng handled dead drops of sensitive information on behalf of Beijing’s Ministry of State Security was sentenced on 17 March 2020 to four years in prison and $30,000 fine for spying for China.

Peng was arrested in Hayward, California, in September 2019 for arranging transfers of money and SD cards loaded with stolen data in different locations across the United States on behalf of China’s premier intelligence body. Peng pleaded guilty in federal district court in Oakland, California, to one charge of illegally acting as an unregistered agent of a foreign government.

Peng, 56, was exposed by what court filings said was a “double agent operation” targeting the MSS. The operation led them to Peng, who in 2015 was seen picking up an SD card with US secrets that the double agent, under instructions from her Chinese “handlers,” left inside a book at the front desk of a hotel in Newark, California.

Months later Peng was watched picking up another book dropped at the same hotel that also held a secrets-loaded memory card. He then flew to Beijing where, according to investigators, he contacted MSS agents and handed over the card.

The FBI watched on several other occasions between 2016 and 2018 when Peng either picked up the stolen US secrets or left money for the double agent in hotels in both the San Francisco area and Columbus, Georgia, at the direction of MSS agents.

Stephen Su’s Case

Chinese national Stephen Su aka Stephen Subin aka Su Bin, a businessman and entrepreneur residing in Canada, who specialized in aviation and aerospace products as the owner of a company named Lode-Tech, was arrested in Canada after an affidavit was put in by the FBI giving evidence that Su Bin and two others had broken into Boeing and other companies stealing data on the C-17 as well as F22 Raptor and JSF projects.

In August 2014, a Los Angeles grand jury indicted Su Bin for his involvement in a cyber-espionage scheme perpetrated by PLA hackers.

Su Bin managed to make close business contacts within the global defense industry community, and used those contacts to gain insight into protected technology and eventually unfettered entry into company files.

Between 2008 and 2014, Bin helped two People’s Liberation Army hackers steal more than 630,000 files from Boeing related to the C-17 cargo aircraft. The group also targeted data related to the F-22 and F-35 fighter aircraft. Su Bin instructed the hackers on which individuals, companies, and technologies to target, and helped translate the data they obtained from English to Chinese. Bin and his co-conspirators also drafted and distributed reports directly to a department in the PLA’s General Staff Headquarters. Such reports specifically identified what they obtained, how they obtained it and its value to their financial benefactors.

By 2014, the U.S. Dept of Justuce (DOJ) had enough evidence to convince the Canadian government to arrest the suspect and consider an extradition request. Su Bin waived his rights to the extradition process and agreed to return to the U.S. to face the charges.

Xiaoqing Zheng’s Case

Xiaoqing Zheng, 59, of Niskayuna, New York, was convicted of conspiracy to commit economic espionage and sentenced, on 31 March 2022, to 24 months in prison for conspiring to steal General Electric (GE) trade secrets, to benefit China.

Zheng was employed at GE Power in Schenectady, New York, as an engineer specializing in turbine sealing technology from 2008 until the summer of 2018. Zheng and others in China conspired to steal GE’s trade secrets surrounding GE’s ground-based and aviation-based turbine technologies.

He hid confidential files stolen from his employers in the binary code of a digital photograph of a sunset, which Zheng then mailed to himself. It was a technique called steganography, a means of hiding a data file within the code of another data file. Zheng utilised it on multiple occasions to take sensitive files from GE.

Xiaoqing Zheng was a Thousand Talents Program member and willingly stole proprietary technology and sent it back to China.

Xu Yanjun’s Case

On 10 October 2018, the FBI arrested Xu Yanjun, a Chinese intelligence agent who had been targeting an employee of GE Aviation to acquire trade secrets on the company’s jet engines. Xu was arrested when he met the target employee in Belgium in April 2018and was extradited to the United States in October and charged with economic espionage.

The target was contacted from a Chinese university that expressed interest in the target’s work from an academic standpoint. The target was invited to travel to China to talk about his and his company’s work. While there, he was introduced to his case officer who was using a cover identity.

The case officer held out another invitation to him to visit China and instructed him on the means of packaging info and transmitting it.

Eventually the target was invited to a meeting in Belgium, and asked to bring his company computer and hand off more technical data.

Xu used the aliases and a cover identity as representative of a professional organization called the Jiangsu Science and Technology Promotion Association. In his work, Xu was also identified as interacting with the Nanjing University of Aeronautics and Astronautics.

Xu Yanjun was charged on 10 October 2018 with conspiring to steal trade secrets from major US aviation and aerospace companies. Xu was identified in the charges as an agent of China’s Ministry of State Security (MSS). 

The FBI was aware of Xu Yanjun having set up a meeting with the target engineer in Belgium that would involve the hand-off of more sensitive information.

Xu pleaded not guilty in federal court in Cincinnati on 12 October 2018. Xu was sentenced on 16 Nov 2022 to 20 years in prison for plotting to steal trade secrets from from US and French aviation and aerospace companies. Xu Yanjun was accused of a lead role in a five-year Chinese state-backed scheme to steal commercial secrets from GE Aviation and France’s Safran Group, which was working with GE on engine development.

Jun Wei Yeo’s Case

Yeo Jun Wei aka Dickson Yeo, a Singaporean and a Chinese agent pleaded guilty on 24 July 2020, at the US District Court, Columbia, of spying.

Yeo was first approached by Chinese agents while he was studying and made a presentation on Southeast Asia’s political situation at Beijing in 2015. He was offered a contract to work with the PLA. Yeo refused to sign the contract but he continued to assist and work for the intelligence service.

Between 2015 and 2019, Yeo had made frequent trips to China, meeting different operatives for at least 40 times. When Yeo was in United States, he was instructed not to communicate with the intelligence officers to avoid interception. Yeo was issued with a bank card to facilitate payments to his targets.

Yeo recruited Americans to provide information that he would pass back to his PRC handlers. He concealed his PRC affiliation from his recruits. He identified their vulnerabilities, like dissatisfaction with work or financial difficulties, and offered money in exchange for information and written reports.

Yeo began working with Chinese intelligence officers as early as 2015, initially targeting other Asian countries, but then focusing on the United States.  In response to taskings from his Chinese handlers, Yeo worked to spot and assess Americans with access to valuable non-public information, including U.S. military and government employees with high-level security clearances.  After Yeo identified American targets, he solicited them for non-public information and paid them to write reports.  Yeo told these American targets that the reports were for clients in Asia, without revealing that they were in fact destined for the Chinese government.

In 2018, Yeo created a fake consulting company that used the same name as a prominent U.S. consulting firm that conducts public and government relations, and Yeo posted job advertisements under that company name. Ninety percent of the resumes Yeo received in response were from U.S. military and government personnel with security clearances, and he passed resumes of interest to one of the Chinese intelligence operatives. Yeo also used a professional networking website that is focused on career and employment information to carry out the taskings he received from Chinese intelligence officials. 

In 2015, through LinkedIn, Yeo spotted and contacted a civilian who was working with United States Air Force on the F-35B military aircraft programme. The civilian held high-level security clearance, and was having financial trouble.

Sometime later, when Yeo had enrolled an Army officer to write a report for money, one of the Chinese intelligence officers instructed Yeo to recruit him to provide classified information. Yeo returned to United States in November 2019 with plans to ask the Army officer to provide classified information, and reveal who he was actually working for. However, upon arrival at the airport, Yeo was stopped by law enforcement, questioned, and eventually arrested. No further contact with the Army officer could be made by Yeo.

Yeo was sentenced to 14 months’ imprisonment on 9 October 2020.  After release by USA on 30 December 2020 and upon return to Singapore, he was detained before being released on 14 December 2021 conditionally after they ascertained he no longer posed a threat to the intelligence of Singapore.

READ ALSO: Chinese Espionage Operations and Tactics – Part 1

The post Proven Cases of Espionage in the US appeared first on IMR.

China’s main espionage activities in the United States are the illegal export of military and dual use technology. Of the 260 cases documented or in courts, 80 per cent occurred in the US. 43.7 per cent of these cases related to (in the US) IEEPA, EAR, and ITAR violations.

Known intelligence operations conducted by the Chinese have thrown up a basic question. What is the percentage of cases which have come to light? Is it 10 per cent or 90 per cent of Chinese operations. Quite likely the former. So, how many people are spying worldwide on behalf of the Chinese government? No one knows the answer. Yet some conclusions can be drawn.

Key Findings

There are over 600 documented cases of China’s worldwide intelligence collection efforts. Some of the major findings are:

•  There has been a phenomenal expansion of its espionage efforts over the last  20 years.

•  Many Chinese government agencies, People’s Liberation Army, State Owned Enterprises, private companies, individuals, and several universities are involved in conducting espionage.

•  A major effort is directed towards military and space technologies.

•  Predominantly (over 90 per cent) of espionage activities involve Chinese ethnic people, of whom 80 per cent are males.

•  Social media is used by the Ministry of State Security (MSS) to target foreigners with access to sensitive information.

•  Visa and border control system is used by the MSS to identify potential recruitments and manage clandestine assets.

•  Almost half of China’s traditional espionage efforts are targeted against Taiwan (political and military secrets).

•  Priority technologies have been identified in government strategic planning documents

•  Made in China 2025, Space Science and Technology in China, and A Road- map to 2050, the National Key Technologies R&D Program, and the 13th Five Year Plan – for foreign science and technology collection efforts.

•  China follows a ‘whole of society’ approach to espionage, which negatively affects America’s economy, diplomatic influence, and military capabilities.

•  China uses espionage  and coercion against government entities and business decision making to threaten European national and economic security

Legal Framework for Espionage

The CCP uses all elements of society, ie, universities, think tanks, foreign affairs departments, government sponsored overseas educational programs, military liaison programs, friendship and student associations, etc, – and through them, foreign government officials, scientists, academics, and students – to support its global espionage efforts. All Chinese government departments are required to support Ministry of State Security (MSS) intelligence operations.

China’s legal system has been moulded to ensure the intelligence apparatus can exploit private industry to gain access to foreign individuals, secrets, and technology. In 2014, 2015, and 2017, the National People’s Congress and State Council made public the requirements that all Chinese citizens and companies (operating in China or Chinese companies abroad) must collaborate in gathering intelligence.

Article 22 of the 2014 Counter-Espionage Law states that during a counter-espionage investigation, ‘relevant organizations and individuals’ must ‘truthfully provide’ information and ‘must not refuse’.

Article 7 of China’s National Intelligence Law of 2017 states that “Any organization or citizen shall support, assist and cooperate with the state intelligence work in accordance with the law, and keep the secrets of the national intelligence work known to the public. The state protects individuals and organizations that support, assist and cooperate with national intelligence work.”

Article 14 provides intelligence agencies authority to compel any entity to provide this support: “The state intelligence work organization shall carry out intelligence work according to law, and may require relevant organs, organizations and citizens to provide necessary support, assistance and cooperation.”

The National Intelligence Law Implementing Regulations, was published in November 2017, which explained that “When state security organs carry out the tasks of counter-espionage work in accordance with the law, and citizens and organizations that are obliged to provide facilities or other assistance according to the law refuse to do so, this constitutes an intention to obstruct the state security organs from carrying out the tasks of counter-espionage work according to law.”

Companies and citizens face severe punishments for noncompliance.

Chinese Organizations Conducting Espionage

Espionage activities correlated to their sponsoring organization (the “customer” receiving the information or technology) showed five distinct clusters of organizations engaging in espionage. The governing CCP uses government, quasi-government, academic, and commercial entities as mechanisms to conduct all forms espionage abroad. Most interesting of these are China’s ‘non-traditional collectors’ which include State Owned Enterprises, universities, and private companies. The employment of such a broad set of entities for intelligence collection indicates China’s ‘whole of society’ approach to espionage.

China’s Ministry of State Security or Ministry of State Security (MSS) was formed in June 1983.

Central Military Commission (CMC) Joint Staff Department, Intelligence Bureau (formerly 2 PLA) is responsible for collecting and analyzing foreign military intelligence including technology.

People’s Liberation Army (PLA) collection capabilities include military attaches conducting overt and clandestine collection, students, and other collectors under government and commercial covers.

There are 150,000 State Owned Enterprises (SOE) of which 50,000 are owned by the central government and include aerospace and defense companies, subordinate research institutes, and technology transfer organizations. In 2018, Xi Jinping directed all SOEs to amend their bylaws to ensure the concepts of service to the CCP keeping national and economic security above  profit.

Some private companies and individuals indulge in illegal exports or trade secrets for commercial benefit. University are often  involved in establishing shadow labs to copy foreign research and commercial production facilities to replicate foreign material and technology.

Other PRC government elements like PLA Political Department Liaison Office, United Front Work Department (UFWD) and many universities under  the State Administration for Science, Technology, and Industry for National Defense (SASTIND) work for espionage.

SASTIND

SASTIND assigns research projects to ministries with military production responsibilities and manages military acquisition requirements for the CMC’s Equipment Department. SASTIND has two departments (Comprehensive Planning Department and the International Cooperation Department) responsible for developing and tasking technology related intelligence requirements, and for collecting intelligence related to them. MSS and PLA Joint Intelligence Bureau are also involved.

SASTIND also has direct supervision over seven universities as well as                       contracts for defense research with 55 additional universities. As many as 35 institutes and universities are on the US Department of Commerce Entities List for their  research in support of Chinese defense entities involved in the theft  of technologies.

There is a near equal distribution of espionage activities between the four major organizational clusters (MSS, SOE, PLA, Private Companies).

Aerospace & Aeronautical Equipment

China strongly focuses on collection of foreign aerospace and aeronautical equipment. The primary collectors are the PLA Joint Intelligence Bureau and private  companies conducting export violations, and individuals (Insider Threats) working in foreign aerospace companies.

Key technologies stolen or attempted are: Cryogenic pumps for space vehicles, valves, transfer lines, refrigeration equipment, space qualified radiation hardened circuits, components for the storage and use of liquid hydrogen, cryogenic coolers, Ka-band space communications, satellite/missile insulation blankets – germanium coated polyimide film, and multi octave travelling wave tubes used as amplifiers in satellite transponders. Major systems include the Space Shuttle, Delta IV Rocket, F-15 Fighter, C-17 transport, F-22 Fighter, F-35 Fighter, B-1 Bomber, Ch 46/47 Chinook, C-130 training equipment and much more.

Information Technology

Information technology is a high priority target with strong  emphasis on advanced semiconductors and manufacturing technology. The US restricted semiconductor sales to the Chinese company ZTE for evading sanctions on Iran and North Korea and repeatedly lying to Department of Commerce officials and lifted the ban after the company paid a $1 billion fine and agreed to reprimand its Board. Chinese company Huawei faces charges of espionage in the United States, Germany, and Poland.

Key information technology objectives include microelectronics, microwave integrated circuits, microprocessors, circuit boards, crypto key devices, data and voice transmission systems, semiconductors, and trade secrets such as laser manufacturing techniques.

Analysis of Espionage Cases

China’s dominant espionage activities overseas are economic espionage, and export control violations. Half of them are related to ITAR, EAR, IEEPA, covert action, research violations in high-tech sectors.

Next is economic espionage. Traditional espionage comprises one-fourth of all espionage activity.

‘Silicon Valley’ in northern California is the number one spot for China’s illegal technology collection efforts.

Information technology, aerospace and aeronautical equipment takes priority over automated machine tools and robotics.

Research universities are also primary targets for collection efforts most often accomplished through talent programs (i.e. Thousand Talents Program, Hundred Talents Program, etc.). In numerous cases, professors, graduate students, and PLA researchers have also been arrested stealing research from overseas universities for use in China.

Chinese spies have used public and commercial encryption, hosting meetings in China  to avoid detection, dead drops, covert communications) and use of third countries for meetings.

Surprisingly a number of cases have been detected where the Ministry of State Security demonstrated no discernible tradecraft in agent recruitment, tasking, communications, and data transfer with no significant attempt to hide the activity.

READ ALSO: Chinese Espionage Operations and Tactics – Part 2

The post Chinese Espionage Operations and Tactics – Part 1 appeared first on IMR.