China’s New Intelligence War Against the United States

July 22, 2015

After they hacked the OPM and stole the personal data of millions of cleared Americans, China's Ministry of State Security can target the United States more effectively than ever before.

For special access to experts and other members of the national security community, check out the new War on the Rocks membership.

The Chinese intelligence threat is set to change dramatically as hackers believed to be linked to China’s civilian intelligence agency, the Ministry of State Security (MSS), acquired millions of personal records from the U.S. Office of Personnel Management (OPM). Although the full extent of the damage remains unknown, fears have emerged about the compromise of data gathered during security clearance background checks, including foreign national contacts. Security experts are right to suggest this information is a treasure trove for an intelligence service trying to penetrate the U.S. national security community. Such treasure is only as valuable as the motivation to use it and, for the MSS, such information would provide the foundation for a new espionage campaign against the United States and demonstrate its value to Chinese policymakers who have had good reason to be skeptical about what the MSS brings to the table. The OPM data offers a way for Chinese intelligence to focus on Americans that matter rather than relying on the creativity of individual agents to find ways to bridge China’s domestic intelligence base with national security professionals abroad.

The Misadventures of the MSS

To the unschooled observer, China might seem like a master of intelligence operations targeting the United States. This is only partially true. Since the arrest in 2005 of Chi Mak, a San Diego-based engineer with defense contractor Power Paragon, the FBI has arrested several dozen individuals for espionage on behalf of China — most recently in May. Meanwhile, Chinese collectors in cyberspace have made headlines every month as governments and companies admitted gaping breaches of information. The MSS, however, could claim little of the glory. China’s successes predominantly belonged to the People’s Liberation Army’s (PLA) intelligence departments. Hackers reportedly working for the PLA’s signals intelligence department, such as those indicted by the FBI, stole terabytes of corporate and government data, and human intelligence collectors from the General Staff Department’s Second Department (2PLA) penetrated the Pentagon and sensitive programs related to the Virginia-class submarine and the Aegis Combat System.

However, to the extent that it can be gauged, the record of the MSS is far from enviable.

Of recent Chinese human intelligence cases in the United States, the MSS probably was responsible for only one: Glenn Duffie Shriver. And that can hardly be called a success. In 2010, U.S. counterintelligence caught Shriver during his background and security check while applying to work for the CIA. He had already failed twice to join the State Department’s diplomatic corps. The MSS paid him $70,000, but failed to gather a single piece of intelligence. The money may not seem like much; however, multiply those costs by even a few attempts and such failed efforts become costly.

In the last three years, the MSS has lost three senior vice ministers to scandal. The first, Lu Zhongwei, fell in 2012 owing to reports that one of his personal aides spied for the United States since the 1980s. The next, Qiu Jin, fell in 2014 because he and a protégé at the Beijing State Security Bureau politicized MSS investigations to support the agenda of disgraced former security chief Zhou Yongkang. Politicization may be a feature of a communist system’s security apparatus, but Deng Xiaoping created the MSS in 1983 to move Chinese intelligence away from internal party politics and refocus it on legitimate counterespionage and intelligence-gathering abroad. Earlier this year, another vice minister, Ma Jian, became mixed up in a corruption investigation involving crooked real estate dealings and was removed from office. The MSS might weather such a storm if its intelligence operations bore more fruit, but, as is, the Chinese leadership may be wondering whether the MSS continues to be effective.

The Shortcomings of Chinese Intelligence Collection

Most Chinese intelligence operations are launched from within China, even those targeting foreign governments and militaries. In contrast to the more familiar scenario of intelligence personnel posing as diplomats working the cocktail scene in foreign capitals, Chinese intelligence officers regularly approach their targets inside China, in many different guises — from municipal office workers to think tank scholars to businesspeople — sometimes without even a fig leaf to hide their intelligence affiliation. Reviewing the history of Chinese espionage cases, only two cases we know of (and now a possible third in Taiwan) have involved recruitment of foreign agents outside China.

Having so many agents recruited inside China necessarily leaves blind spots, and the skills required for this approach are very different than working the diplomatic cocktail circuit. The most obvious implication is that Chinese sources must travel to China. Although the number of people traveling to China for any reason has expanded dramatically, those who do so regularly, especially foreign government officials, tend to have China or Asia portfolios. The MSS, then, is more likely to do well on issues that are directly related to China than on, say, U.S. or European policy in the Middle East. Finding potential agents inside China also means sifting through these visiting foreigners and expatriates — a task made easier by the ability to download and sort a person’s electronic data when they leave their personal devices unattended.

The MSS, like its other ministerial counterparts, is really a system with a central ministry supported by provincial departments and municipal bureaus that perform most of the system’s day-to-day operations. The capabilities and performance of the different sub-national elements vary widely as each is responsible for recruiting its own personnel. The Beijing and Shanghai state security bureaus, for example, can readily pull from the best pool of Chinese university graduates, whereas the Shaanxi and Gansu state security departments may only get similar talent if recent graduates are forced back to their original homes because of China’s internal migration controls. There may also be other differences that affect the quality of MSS elements, such as access to technology or those skilled in its use, as well as foreign language capability. The responsibilities for state security undoubtedly vary across locations. Though Beijing may be well suited for operations against foreign countries, the huge number of foreign officials and businesspeople living in and transiting the city probably keep the focus on counterintelligence.

The unevenness of MSS capabilities means that, without a central database of dossiers, the ability of state security elements to identify and research persons of interest is limited. Identifying a person and why they are potentially valuable, however, is only the first step toward recruitment. Personal relationships must be developed; vulnerabilities must be identified or manufactured. Finally, an intelligence officer has to make the recruitment pitch, which, in the words of former British intelligence chief Sir Richard Dearlove, must be “asked in the right way, by the right person, at the right time.” For many of the backwoods state security departments, completing all of these tasks — even identifying potentially useful individuals — might be beyond their capabilities without operational leads and support from MSS headquarters.

With China developing more and more foreign interests, the MSS almost certainly faces an imperative to expand its operations overseas. A few small operations, such as the MSS handling in Sweden of a Uighur arrested in late 2010, suggest the ministry is becoming more aggressive in pursuit of intelligence abroad. The ministry, however, must overcome a legacy of inaction on overseas clandestine operations. Back in 1985, Deng Xiaoping placed draconian restrictions on MSS operations from Chinese embassies and other official platforms. The Ministry of Foreign Affairs reportedly persuaded Deng that MSS officers getting caught running clandestine operations from official facilities could derail the international aspects of his revolutionary Reform and Opening policy of market-based reforms. Building up a robust, foreign-based collection effort takes time, and intelligence services need practical training based on experience. The ability to do dead drops, covert communications, and the other hallmarks of clandestine tradecraft are important because a spy service is asking agents to place their lives and freedom in the service’s hands.

The Practical Application of OPM Data for Chinese Intelligence

The theft of the OPM files on current and former U.S. government employees with security clearances, along with their foreign contacts — including Chinese contacts — will give the MSS (or other parts of the Chinese intelligence apparatus) an incredible resource for building an intelligence program targeting the United States. As I mentioned above, marginal cases like that of Glenn Duffie Shriver indicate the MSS so far has struggled to mount a serious and sustained program that is producing results for Beijing. That could now change.

One of the keys to success in China’s spying against Taiwan appears to be China’s substantial knowledge of the island’s government, military, and intelligence officials, as well as their families and their retired colleagues. In almost every case — including the 33 Taiwanese convicted of espionage-related crimes in the last five years recently highlighted by Taiwan’s National Security Bureau (NSB) director — Chinese intelligence has identified and recruited former officials traveling through or working in the mainland and then used them to draw out their colleagues still in government. Instead of having to evaluate the thousands of Taiwanese traveling in and out China, the MSS just needs to check whether a particular person is one who should be approached. In 2000, the then-personnel director at the NSB retired into a job based in China, and, even if he did not betray personnel lists, numerous others in intelligence and counter-espionage have provided the names and backgrounds of their undercover colleagues to Chinese intelligence.

The information on former U.S. officials with past security clearances may be even more valuable than information on current employees. First, former officials do not face the same travel restrictions or requirements to report foreign contacts or meetings with foreign intelligence services. Second, because they can travel more freely, they can be debriefed in a more leisurely fashion, allowing for questions without immediate operational relevance and time to confirm their responses and thereby further validate the sources themselves. Third, former officials almost certainly will function better than the agents most recently used by Chinese intelligence to gain access to U.S. secrets. Sources like Louisiana furniture salesman Kuo Tai-shen may be able to move and shake their way into access — Kuo did get two U.S defense officials to betray their confidences — but they do not necessarily have a natural set of trusted relationships within national security circles. They have the ability to elicit information without raising alarm bells and evaluate the potential of their former colleagues to a recruitment pitch.

The information on Chinese contacts of cleared U.S. government officials raises the danger of the lost OPM data in MSS or other Chinese intelligence services’ hands. Beijing’s security agents may be willing to detain U.S. officials and citizens at the airport for a few hours, but anything beyond catch-and-release is unlikely. Beijing, however, treats all ethnically Chinese people as PRC citizens, subjecting them to far harsher punishments than those of purely foreign stock, which endangers Chinese family members and contacts named in the stolen OPM data. As a pressure point, being placed in an uncomfortable position or detained for a few hours is one thing; knowing your friend or family member could be detained indefinitely is something completely different. In case this sounds fanciful, it did occur in 2012 to the wife of a Taiwanese intelligence official who visited a friend in Shanghai. Chinese authorities detained her and forced her to write a letter to her husband pleading for him to come to the city. The official stayed in Taiwan, but his wife remains in prison despite Taipei’s efforts to release her. There is little reason to think that an MSS desperate to prove its value to policymakers with intelligence on Washington will hold back from such aggressive efforts to collect intelligence, especially if Beijing is accepting greater risk in its intelligence operations.

Conclusion

The MSS’s possible acquisition of OPM data does not guarantee Chinese success in penetrating the U.S. government; however, it does improve the beleaguered ministry’s chances. Its disparate components can focus on real targets rather than trying to identify, research, and approach every American passing through their jurisdictions. In baseball terms, the OPM data is like a team beginning every inning with runners on base. Each success could be just a bit better than the past.

 

Peter Mattis is a Fellow in the China Program at The Jamestown Foundation and the author of the recently-published Analyzing the Chinese Military: A Review Essay and Resource Guide on the People’s Liberation Army.

 

Photo credit: Max Braun (adapted by WOTR)

We have retired our comments section, but if you want to talk to other members of the natsec community about War on the Rocks articles, the War Hall is the place for you. Check out our membership at warontherocks.com/subscribe!