Tuesday, February 16, 2016

Special Series: Espionage with Chinese Characteristics

Special Series: Espionage with Chinese Characteristics



Editor's Note: This is the first installment in an ongoing series on major state intelligence organizations.
The January hubbub over Google's operations in China, which has led to the search engine reevaluating its presence in the market, was sparked by an alleged hacking attempt by the Chinese government. The incident has become part of an ongoing political and economic spat between China and the United States, but it is also a reminder of how foreign businesses and governments must be vigilant about China's pervasive intelligence apparatus. China's covert intelligence capability seems vast mainly because of the country's huge population and the historic Chinese diaspora that has spread worldwide. Traditionally focused inward, China as an emerging power is determined to compete with more established powers by aiming its intelligence operations at a more global audience. China is driven most of all by the fact that it has abundant resources and a lot of catching up to do.


China's intelligence services may not be as famous as the CIA or the KGB, but their operations are widespread and well known to counterintelligence agencies throughout the world. Chinese intelligence operations have been in the news most recently for an alleged cyberattack against California-based Google, but two other recent cases shed more light on the ways of Chinese intelligence-gathering. One involved a Chinese-born naturalized American citizen named Dongfan Chung, who had been working as an engineer at Rockwell International and Boeing. Convicted of espionage, he was sentenced on Feb. 8 to 15 years in prison. The other involved a former U.S. Defense Department official, an American named James Fondren, who was convicted of espionage and sentenced to three years in prison on Jan. 22 after having been recruited by a Chinese case officer.
Together, these cases exemplify the three main Chinese intelligence-gathering methods, which often overlap. One is "human-wave" or "mosaic" collection, which involves assigning or dispatching thousands of assets to gather a massive amount of available information. Another is recruiting and periodically debriefing Chinese-born residents of other countries in order to gather a deeper level of intelligence on more specific subjects. The third method is patiently cultivating foreign assets of influence for long-term leverage, insight and espionage.
Chinese intelligence operations stand out in the intelligence world most of all because of their sheer numbers. China has the largest population in the world, at 1.3 billion, which means that it has a vast pool of people from which to recruit for any kind of national endeavor, from domestic road-building projects to international espionage. Emerging from this capability are China's trademark human-wave and mosaic intelligence-gathering techniques, which can overload foreign counterintelligence agencies by the painstaking collection of many small pieces of intelligence that make sense only in the aggregate. This is a slow and tedious process, and it reflects the traditional Chinese hallmarks of patience and persistence as well as the centuries-old Chinese custom of "guanxi," the cultivation and use of personal networks to influence events and engage in various ventures.
And though China has long been obsessed with internal stability, traditionally focusing its intelligence operations inward, it is taking advantage of the historic migration of Chinese around the world, particularly in the West, to obtain the technological and economic intelligence so crucial to its national development (and, most recently, to try and influence foreign government policy). To Western eyes, China's whole approach to intelligence gathering may seem unsophisticated and risk-averse, particularly when you consider the bureaucratic inefficiencies inherent in the Communist Party of China's (CPC) administrative structure. But it is an approach that takes a long and wide view, and it is more effective than it may seem at first glance.

A Brief History

China's first intelligence advocate was military theorist Sun Tzu who, in his sixth century B.C. classic The Art of War, emphasized the importance of gathering timely and accurate intelligence in order to win battles. Modern Chinese intelligence began during the Chinese Communist Revolution, when Chiang Kai-Shek's Chinese Nationalist Party (the Kuomintang, or KMT) created its Investigation Section. The Chinese Communists later followed suit with a series of agencies that eventually became the Social Affairs Department (SAD), the party's intelligence and counterintelligence organ.
The most influential head of the SAD was Kang Sheng, who had become involved in the communist movement while a student at Shanghai University in the 1920s. During the first half of the 20th century, the epicenter for espionage in East Asia was Shanghai, where Chinese agents cut their teeth operating against nationalists, communists, triad gangs, warlord factions and Russian, French, Japanese, British and American intelligence services. Later, Kang traveled to Moscow, where he would spend four years being taught what the Soviets wanted him to know about intelligence operations. Much like "Wild Bill" Donovan of the United States and the Soviet Union's Felix Dzerzhinsky, Kang is considered the father of his country's intelligence services, the first Chinese official to appreciate the practice of global intelligence. Kang also played a leading role in ideological campaigns that served to out "spies" or suspected dissidents and was said to have double-crossed nearly every leader in the early CPC with the exception of Mao.
Following the Communist victory over KMT forces on Oct. 1, 1949, the domestic and counterintelligence functions of the SAD became part of the Ministry of Public Security (MPS), and the military kept its own Military Intelligence Department (MID). Given China's size and its insular geography, its first geopolitical imperative was to maintain internal security, especially along its periphery. China's intelligence services would both police the Han population to guarantee security and monitor foreigners who worked their way in from the coast as the Chinese economy developed. The emphasis on internal security meant extensive informant networks, domestic surveillance and political control and censorship by Chinese intelligence services.
By the mid-1950s, Beijing's Central Investigation Department (CID) had taken on the foreign responsibilities of the SAD. In 1971, in the midst of the Cultural Revolution, the CID was disbanded, only to be reinstituted when Deng Xiaoping came to power in the mid-1970s. Deng wanted China's intelligence services to stop using embassy officials for intelligence cover and wanted to employ journalists and businessmen instead. He later borrowed a centuries-old saying for his policy, "Hide brightness; nourish obscurity," which was meant for the development of China's military capability but could just as well apply to its intelligence agencies. This was a part of China's opening up to the world economically and politically. In the process, Deng's goal was to use intelligence services to enable China to catch up with the West as covertly as possible.
The Ministry of State Security (MSS) was created in 1983 by Deng in a merger of the CID and the counterintelligence elements of the MPS. It is currently the main civilian foreign intelligence service and reports to the premier, the State Council, the CPC and its Political and Legislative Affairs Committee. In China, as in most countries, all domestic and foreign intelligence organizations feed into this executive structure, with the exception of military intelligence, which goes directly to the CPC.

The Chin Case

Since the time of Sun Tzu, perhaps the most successful Chinese spy has been the legendary Larry Wu-Tai Chin (Jin Wudai), an American national of Chinese descent who began his career as a U.S. Army translator and was later recruited by a precursor to the MSS while studying or working in China prior to the Korean War. Following his army service, he joined the CIA as a translator for the Foreign Broadcast Information Service, beginning a 30-year career as a double agent. His most valuable intelligence may have been the information he passed about President Richard Nixon's desire to establish relations with China in 1970, which gave the Chinese leadership a leg up during subsequent negotiations with the United States.
The key to Chin's success may have been his use of third-country "cutouts" (when a case officer travels from one country and an agent travels from another to meet in a third country) and his careful money laundering. Chin traveled to Canada and Hong Kong to pass along intelligence, in meetings that could last as little as five minutes. He was paid significant amounts of money for his espionage activities, and after he moved to Virginia to work for the CIA he became a slumlord in Baltimore, investing his cash in low-income properties.
The Chin case exemplifies, above all, a careful use of operational security, which allowed him to operate undetected (using methods in which the MSS specializes) until a defector exposed him in 1985. Chin had the same handler for 30 years, which means both agent and case officer had a high level of experience and the ability to keep all knowledge of the operation within narrow channels of the MSS. And the Chinese government never acted on Chin's intelligence in a way that would reveal his existence. The only way he could have been detected, other than through exposure by a defector, would have been during his foreign travel or by extensive investigation into his property holdings. Convicted of espionage, Chin committed suicide in his jail cell on Feb. 22, 1986, the day of his sentencing.

Current Organization

Today, China's intelligence bureaucracy is just that — a vast array of intelligence agencies, military departments, police bureaus, party organs, research institutions and media outlets. All of these entities report directly to executive governmental decision makers, but with the CPC structure in place there isparallel leadership for intelligence operations, with the CPC institutions holding the ultimate power. Beyond the party itself, the opaque nature of China's executive leadership makes it difficult to determine exactly where or with whom the intelligence authority really lies.

The Ministry of State Security

The Guojia Anquan Bu, or Ministry of State Security, is China's primary foreign intelligence organization, but it also handles counterintelligence in cooperation with the Ministry of Public Security (MPS). MSS involvement in domestic operations is widespread through its First and Fifth Bureaus, activities that are coordinated with the MPS. (Due to this overlap, we will discuss domestic operations in the MPS section below.) One target set that clearly falls under MSS jurisdiction is foreign diplomats. Bugging embassies and surveilling embassy employees or those traveling on diplomatic passports is common practice for the MSS. According to one leaked MSS statement, "foreign diplomats are open spies." This is not a false statement, but it does reflect a certain paranoia on the part of the agency and an intention to target such officials. It also underscores the fact that Beijing views all foreigners with suspicion.
As did its predecessor organizations, the MSS follows the bureaucratic structure of the Soviet Union's KGB (the result of founder Kang's formative tour in Moscow), but it operates like no other intelligence agency in the world. We call it espionage with Chinese characteristics. The MSS network is so diffuse and decentralized that each individual asset may be doing nothing particularly illegal — often merely collecting open-source information or asking innocuous questions. But when all the information these assets have collected is analyzed at the Institutes of Contemporary International Relations in Beijing, it can produce valuable intelligence products. Still, it remains to be seen from the outside whether such a process is effective in producing actionable intelligence in a timely manner. For example, in the case of technology theft — a growing focus of the MSS — by the time the intelligence is processed and exploited the technology may already be outdated.
While it is difficult to assess MSS analytical capabilities, much is known about its recruitment and operations. Training for most MSS intelligence officers begins at the Beijing University of International Relations. This is a key difference in the Chinese approach to recruiting intelligence officers. The MSS taps university-bound students prior to their university entrance exams, choosing qualified students with a lack of foreign contacts or travel to make sure they haven't already been compromised. The MSS also places a heavy emphasis on the mastery of foreign languages and operates an intensive language school for officers. To root out possible defectors and moles embedded in the MSS network, the agency runs an internal security department known as the Ninth Bureau for Anti-Defection and Countersurveillance.
These full-time intelligence officers ultimately are charged with managing a legion of agents (also referred to as assets or operatives) who do the actual spying. This is another distinguishing characteristic of Chinese intelligence — the sheer number of temporary and long-term assets spread worldwide in a decentralized network managed by MSS handlers. (The FBI believes there could be hundreds of thousands of individuals and as many as 3,000 front companies operating in the United States alone.) The MSS employs Chinese nationals living abroad, some of whom function as temporary agents and some of whom serve as long-term operatives. For budgetary and security reasons, the MSS prefers to recruit its assets in China, before they venture overseas. It also prefers ethnic Han Chinese because it considers them more trustworthy and easier to control. In recruiting these assets, the MSS relies first on pride in national heritage (known as the "help China" approach), but if more coercion is needed it can always revert to pressure tactics — threatening to revoke their passports or permission to travel granted by sponsoring organizations, promising a dismal future upon their return or making life difficult for their families in China.
One should not assume, of course, that every Chinese national living overseas is a spy working for the Chinese government. Most are not, and many may simply be Chinese students or professionals trying to collect information for their own academic or business purposes, gathering it legally from open sources but also in ways that could be considered illegal. From the targeted country's perspective, the problem with China's human-wave approach to intelligence gathering is that it is difficult to tell if the activities constitute espionage or not.
The MSS divides its operatives into short-term and long-term agents. Short-term agents are recruited only a few days before leaving and are often assigned to infiltrate Chinese dissident organizations. They may be promised financial stipends and good jobs upon their return, or they may be encouraged by the threat of having their passports revoked. Sometimes dissidents themselves are arrested and forced to spy as short-term agents, either overseas or domestically, in order to stay out of jail. Long-term agents are known as chen di yu, or "fish at the bottom of the ocean," what Westerners would call "sleeper agents." Though they likely constitute the minority of Chinese agents, they provide most of the high-value intelligence. Before going overseas, long-term agents with foreign visas are often recruited through their danwei, or traditional Chinese work units, by local MSS intelligence officers. These "fish" are identified, recruited and trained months before departure, and they are deployed mainly to gather intelligence, develop networks and, in some cases, influence foreign policy and spread disinformation in the host country.
The MSS encourages agents abroad to achieve their academic or business goals as well as their intelligence goals, since China benefits either way, and legitimate pursuits provide effective cover for illicit ones. Agents are asked to write letters to their families at home about their arrival in country, studies or work and financial situation, letters that the MSS will intercept and monitor. Long-term agents are generally told to return to the mainland every two years for debriefing, though this can be done in Hong Kong or in third countries. Agents are expressly prohibited from contacting Chinese embassies and consulates, which are known to be monitored by host-country counterintelligence.
It is not uncommon for the MSS to use the more traditional method of diplomatic cover for foreign operations. For example, in 1987 two Chinese military attaches were expelled from Washington, D.C., when they were caught trying to buy secrets from a National Security Agency (NSA) employee who was, in fact, an FBI double agent. While these two agents likely worked for China's Military Intelligence Department (MID), it is believed that MSS agents also serve under similar cover. Since most of its recruitment is done in China, however, the MSS does not likely operate from within embassies. We have noticed a shift in the last 10 years or so, in which Chinese intelligence services have begun accessing non-Chinese agents, usually government officials. For example, a Chinese military attache might establish a covert intelligence-gathering relationship with another military or defense official, and their meetings would appear as part of their normal liaison activities. This is what occurred in the case of Ronald Montaperto, a senior U.S. Defense Intelligence Agency analyst focusing on China. He claimed his meetings with People's Liberation Army (PLA) officers in the 1990s and early 2000s were part of his regular liaison responsibilities. However, Montaperto eventually admitted to orally providing classified information to Chinese military attaches in 2006.
A key MSS target is technological intelligence, which is gathered by ethnic Chinese agents in three primary ways: Chinese nationals are asked to acquire targeted technologies while traveling, foreign companies with the desired technologies are purchased by Chinese firms, and equipment with the desired technologies is purchased by Chinese front companies, usually in Hong Kong.
In the first method, scholarly exchange programs — most often involving recruits from the Chinese Student and Scholar Association — have been the most productive, with the intelligence gathered by Chinese scientists and academics who have been co-opted by Chinese intelligence services. Sometimes technological intelligence is gathered by MSS intelligence officers themselves. The trade-off in using untrained nationals is that the average scientist knows nothing about operational security, and Chinese assets are often caught red-handed. Typically they are not prosecuted, since the fragment of "stolen" information is not valuable in and of itself and is only a tiny piece of the much-larger puzzle.
Two examples of Chinese firms buying U.S. companies are China National Aero-Technology Import & Export Corp. (CATIC) and Huawei. In the first case, CATIC bought the American defense technology firm Mamco Manufacturing, a Seattle-based aircraft parts manufacturer, in 1990. CATIC has a direct connection to the PLA and probably wanted to use the Seattle firm to acquire aerospace technology. The U.S. investigation also found that Mamco technology itself was already under export limitations. Huawei has attempted to buy many foreign firms outright, including U.S.-based 3com. Huawei established a joint venture with the U.S. anti-virus software company Symantec in 2008, headquartered in Chengdu, China. At this point it only offers software in China, but Stratfor sources say that if Huawei were to be used for Chinese intelligence, it could easily insert spyware into computer systems subscribing to the service.
In Hong Kong, agents are recruited by the MSS' Third Bureau, which handles Chinese intelligence operations in Taiwan, Hong Kong and Macao. One of their major tasks is purchasing targeted technologies through front companies. These businesses are usually not run by intelligence officers themselves but by people who have connections, sometimes overt, to the MSS. One recent case involved the 88 Queensway Group, named for the address of an office building in central Hong Kong that houses many state-owned Chinese companies, along with the China Investment Corporation, the country's sovereign wealth fund. A U.S. Congressional report claimed a possible link between the building and "China's intelligence apparatus."
An example that reveals a more clear connection between a Chinese front company and Chinese intelligence is the 1984 case involving Hong Kong businessman Da Chuan Zheng, who was arrested in the United States for illegally acquiring radar and electronic surveillance technology for China. After his arrest, he told U.S. customs agents that he had shipped more than $25 million worth of high-technology equipment to China. MSS agents are usually quite honest with the companies they work with regarding the products they are purchasing and why they are sending them to China, though they do use fraudulent documents to get the goods through customs. If the agent is not honest, signs that he is trying to illegally export technology include paying cash when such a sale would usually involve financing and denying follow-up maintenance services.
Another major focus of the MSS is identifying and influencing the foreign policy of other countries — the classic objective of national intelligence operations. Goals in this case are common to all national intelligence agencies — information on political, economic and security policies that may affect China; knowledge of foreign intelligence operations directed at China; biographical profiles of foreign politicians, intelligence officers and others, especially those who deal with China; technological capabilities of foreign countries; and information on Chinese citizens who may have defected.
This challenging mission involves developing relationships with foreigners who could possibly be recruited to spy on their native countries. This process used to involve rather crude entrapment schemes but more subtle methods have evolved. Two relatively simple techniques in China involve entrapment. Intelligence officers will offer classified information to reporters or other foreigners visiting or working in China in what is commonly called a "false-flag operation," then turn around and arrest them for spying. Another approach involves attractive Chinese women — or men — who will approach foreigners visiting China for the purposes of establishing a sexual liaison. French diplomat Bernard Boursicot was recruited in this way by a male opera singer in 1964. He was finally arrested for spying for China 20 years later.
Even the more subtle recruitment methods have obvious signs. A typical approach might begin with Chinese nationals abroad, usually academics, identifying professors, journalists, policy researchers or business people native to the host country who focus on China. Next, these targets receive invitations to conferences at research associations or universities in China that are often controlled by the MSS or MID. The foreigner's trip is paid for but he or she is subject to a packed and tiring schedule that includes bountiful banquets and no small amount of alcohol consumption. The goal is to make the target more vulnerable to recruitment or to cause him or her to divulge information accidentally.
Often the recruitment can be couched in the traditional Chinese custom of guanxi. A relationship is developed between the Chinese host and foreign visitor in which information is shared equally that will inform their respective academic or business pursuits. More meetings are held and information exchanged, and soon the foreigner's family is invited to visit as well. Eventually the foreigner comes to depend on his Chinese contacts for information crucial to his or her work. At first the Chinese contacts (usually intelligence officers) may ask only for general information about the foreigner's government agency, university or company. As the dependence develops, the Chinese contact will begin to ask for more specific intelligence, even for classified information. At some point the contact may even threaten to cut the foreigner off from access to the information on which the foreigner now depends.

The Ministry of Public Security

The Gong An Bu, or Ministry of Public Security (MPS), is the national security organization that oversees all provincial and local police departments. But like any national security service, it also has important intelligence responsibilities, which it coordinates with the MSS. These responsibilities mainly involve dissidents and foreigners in China. This role overlaps with the MSS, and most analysts believe the MPS follows the direction of the MSS. There are likely some disagreements over territory and competition between the two agencies, but they seem to work together better than most modern domestic and foreign intelligence entities.
Domestic intelligence and security begins with the universal Chinese institution called danwei, or the work unit. Every Chinese citizen is a member of a work unit, depending on where they live, work or go to school. The danwei is an institution used by the CPC to promote its policies as well as monitor all Chinese citizens. Each unit is run by a party cadre and is often divided into personnel, administrative and security sections that work closely with the MPS and MSS. Files are kept on all unit members, including information ranging from family history to ideological correctness.
As a member of a work unit, any Chinese citizen can be recruited to do anything on behalf of the state, including reporting on the activities of fellow citizens and foreign nationals in China. In terms of targeting foreigners, this usually happens in venues such as hotels and even dwellings, which are often wired and equipped with monitoring devices by Chinese intelligence services. Some hotels are even owned and operated by the MPS or the PLA.
The MPS and MSS are known to work together, but how effectively they do so is unclear. In 1986, the CPC sent a cable to provincial authorities in Lhasa, the capital of Tibet, directing the People's Armed Police and MPS to target specific dissident groups and to consult with the MSS before taking any action. This reflects standard operating procedure for many provincial and local MPS offices. The MSS has oversight authority, while the local MPS offices are ultimately responsible for public security nationwide.
The MPS tends to recruit many low-skilled agents who are not trained in operational tradecraft or given specific intelligence-gathering responsibilities. Multiple agents are often assigned to the same target and are told to report on each other as well as the target. This allows the MPS to compare and analyze multiple reports in order to arrive at the required intelligence. One major component of the MPS that handles domestic espionage is the Domestic Security Department, which employs a huge network of informants, many of whom can be assigned to intelligence operations (most are used to gather information for criminal investigations) and are paid little if anything at all.
Occasionally, the MPS will recruit higher-level informants who are handled differently. They are often brought out of their home provinces to be debriefed, and they work on specific intelligence assignments that receive financial and technical support. Sometimes these assets, such as ranking members of dissident groups, are arrested and forced to cooperate, but in nearly all cases their missions are afforded a high level of operational security.
Internal intelligence operations tend to be successful at the local and provincial levels but not at the national level. Most dissident groups are infiltrated and sometimes dismantled while still operating locally, and Beijing is fortunate that most groups emerge from single urban populations. The intelligence flow among provinces and from the provinces to Beijing is very weak (unless Beijing specifically asks for it, in which case the information flows quickly). This lack of communication has led to a number of intelligence failures. The Chinese have had very little success, for example, catching democratic and religious activists, particularly foreigners, when they are being spirited out of the country by various indigenous networks. The main problem here is the parallel structure of the party and government. All intelligence has to be reported to the CPC before going to other government offices. Well aware that information is power, the party must stay informed to stay in control, but local party offices are slow to inform the higher levels, and little information is shared in any orderly way between the party bureaucracy and the government bureaucracy. Indeed, such bureaucratic disconnects are the largest exploitable flaw in China's intelligence apparatus.
MPS interaction with foreigners usually amounts to technical and human surveillance. The growing number of foreigners in China, and Beijing's fear of foreign influence, has resulted in more resources being devoted to this surveillance effort. The MPS engages in a considerable amount of mobile human surveillance. Many foreigners, especially journalists and businesspeople, have reported being followed during the workday. The surveillants are easily detected because the government wants the targets to know that they are being followed and to be intimidated. At the same time, the numbers required to surveil many different foreigners mean that many barely trained informants and case officers are deployed for the job.

Military Intelligence Department

The Military Intelligence Department (MID), also known as the Second Department (Er Bu) of the PLA, primarily focuses on tactical military intelligence. Another major priority for the MID is acquiring foreign technology to better develop China's military capabilities. At the top level, the MID has a organizational structure similar to that of the MSS, and it also seems comparable in size.
The bulk of the intelligence it collects historically has been tactical information gleaned from China's border regions, especially its frontier with Vietnam. Much of the information is gathered by PLA reconnaissance units and consists of the usual military intelligence, such as order of battle, doctrine, geography, targets, strategic intentions and counterintelligence. Each military region (MR, roughly equivalent to a U.S. Army corps) has its own recon units as well as a regional intelligence center for analyzing and disseminating the information gathered. The MID also has a centralized tactical reconnaissance bureau, called the Second Bureau, which coordinates the flow of information from each MR.
The PLA has been known to send armed patrols along, and even across, its borders to identify opposing military positions and gather other forms of intelligence. Along the full length of China's border with Southeast Asia (and particularly along the Vietnamese border), the MID often recruits residents from the neighboring country and sends them back into the country to gather intelligence. There are at least 24 different ethnic groups from which these agents are recruited along this border, where the groups often comprise isolated communities that are undivided by abstract national boundaries and whose members cross the border at will. Recruitment tactics are similar to those mentioned above for other agencies, including monetary incentives and threats of arrest (or even torture).
The First Bureau of the MID is responsible for gathering human intelligence (HUMINT) overseas and focuses, like the MSS Third Bureau, mainly on Taiwan, Hong Kong and Macao. It is responsible for obtaining much of the technological intelligence used to improve China's military capabilities and for finding customers for Chinese arms exports. To hide any PLA involvement, the MID recruits arms dealers to sell to other countries, which in recent decades have included Iraq, North Korea, Argentina, Iran, Pakistan, Saudi Arabia and Syria. Careful in recruiting these dealers, the MID does extensive background investigations and prefers dealers who already have a lot of experience dealing with China. However, operational security for the actual deals can be shoddy, since so many are uncovered. China's motives for these sales are generally based on profit, in order to support other military operations, though gaining political influence in customer countries can be a contributing factor. Historically, the First Bureau has also been involved in establishing guerrilla warfare schools and assisting with insurgencies in such countries as Angola, Thailand and Afghanistan (in the 1980s and before).
The MID's Third Bureau is made up of military attaches serving in overseas embassies, which are tacitly accepted worldwide as open intelligence collection points. Some Chinese military attaches, not unlike those of other countries, have been caught in covert intelligence activities, including the two mentioned above who were arrested while trying to purchase NSA secrets in 1987. The lack of operational security in such cases involving the MID is noteworthy, including another in 1987 in which MID officers working at the United Nations in New York coordinated with Chinese nationals living in the United States to illegally export U.S. military technology to China (TOW and Sidewinder missiles and blueprints for F-14 fighters). In both of these cases, the officers did not operate using cover identities, nor did they use clandestine communication methods such as dead drops. The military attaches in the previous case even met openly with their "agent" in a Chinese restaurant.
The Third Bureau has improved its methods since the 1980s and appears to have had some success getting deeper into foreign intelligence agencies. In 2006, Ronald Montaperto, then a U.S. Defense Intelligence Agency analyst, pleaded guilty to illegally possessing classified documents and passing top secret information to Chinese military attaches. This is one particular case that deviates from the norm — information was passed within the target country from agent to handler. This is likely a tactical shift in operations involving foreign agents and not ethnic Chinese.
The Fourth, Fifth and Sixth bureaus all handle the analysis of different world regions. Another unnumbered MID bureau disseminates intelligence to military officers and China's Central Military Commission. Unlike Western services, the MID is known to put a great emphasis on open-source intelligence.
MID's "seventh bureau" is the Bureau of Science and Technology. This is where China's vaunted "cyberintelligence" operations are designed and managed with the help of six government-linked research institutes, two computer centers and legions of patriotic citizen hackers. The bureau includes companies that produce electronic equipment — computers, satellites, listening devices and such — for espionage and technical support. Computer espionage is ideally suited to China with its large, technologically savvy population and diffuse intelligence-gathering techniques (assets and methods that have been described in previous Stratfor coverage).
As part of the CPC, the PLA staffs a large and powerful office called the General Political Department (GPD), which places individuals at every level of the military, including within the MID, solely for the purpose of monitoring and ensuring the ideological commitment of the armed forces. Indeed, the MID is likely one of the Chinese organizations that is more thoroughly penetrated and monitored by PLA/GPD, since a group of well-trained clandestine intelligence officers that are part of the PLA could easily threaten any regime, and specifically the CPC's control of the military. The political department handles counterintelligence cases within its countersabotage department, and prosecutes them as "political" cases. While the obvious purpose of this department is political, it seems to be the main counterintelligence arm of the MID.
While not part of the MID, the Third Department of the PLA is another intelligence organization that handles signals intelligence (SIGINT). It is actually the third largest SIGINT operation in the world, after those of the United States and Russia, monitoring diplomatic, military and international communications — effectively all but domestic intercepts. Although we know very little about this form of Chinese intelligence-gathering, we can only assume that it is likely a key component of China's collection effort, which has made great strides in advancing China's military capabilities and enabling it to keep up with other militaries.
In the past, a major criticism of China's intelligence operations was the time it took to clone a weapons system — gather the information, reverse-engineer the system and put the pieces back together. By the time something was copied from an adversary's arsenal, the adversary had already advanced another step ahead. That does not seem to be such a problem today, especially in those areas involving asymmetrical technologies such as anti-ship ballistic missiles, which China is developing on its own. The PLA's main challenge, one that rests specifically with the MID, is to develop advanced training, manpower and doctrinal capabilities. One recent step in this direction is the PLA navy's anti-pirate mission in the Gulf of Aden, which gives it an opportunity to observe how other countries' exercise command and control of their naval assets, lessons that will be of great value as China develops a blue-water navy. The new challenge is to figure out how to effectively use the technology, not just build it.

Other Intelligence Organizations

A Stratfor source with experience in counterintelligence estimates that more than 70 percent of Chinese intelligence operations are not directed by the agencies described above but by an array of Chinese institutes, scientific agencies and media outlets that are nominally separate from the MSS, MPS and MID. These entities often compete among themselves, sending agents out on the same missions as part of China's mosaic approach to gathering intelligence. But Stratfor suspects the level of competition precludes any effective operational integration or sharing of information, a problem that can beset any country's intelligence bureaucracy.
One such agency is the State Administration for Science, Technology and Industry for National Defense (SASTIND), which is separate from the PLA but makes direct recommendations to the CMC for research and planning in military technological development (similar to DARPA in the United States). While it usually relies on the MSS and MID for intelligence gathering, SASTIND will dispatch its own agents to obtain military and technological secrets when a high level of specific expertise is needed. Its scientists are more often involved in open-source intelligence collection, usually when sent to conferences and participating in academic exchanges. Information thus gathered helps the agency set priorities for intelligence collection by the main intelligence services.
Xinhua, or what used to be known as the New China News Agency, has historically been a major cover for MSS officers and agents as well as a collector of open-source material abroad. In this way it functions much like the Foreign Broadcast Information Service for the United States or the United Kingdom's BBC Monitoring. Since its inception, Xinhua has created news publications that aggregate and translate foreign news for general Chinese citizens as well as specific publications for high-level officials. It also produces a domestic-sourced publication for deputy ministers and above that covers internal politics.
Two organizations have historically been involved in covert action, a strategy that China has come to avoid. One is the International Liaison Department, which is controlled by the PLA's General Political Department. Responsible for establishing and maintaining liaison with communist groups worldwide, the liaison department used such links to foment rebellions and arm communist factions around the world during the Cold War. More recently it has used this network for spying rather than covert action.
The other is the United Front Work Department, a major CPC organization that dates back to the party's inception in 1921. Its overt responsibility is to help carry out China's foreign policy with nongovernmental communist organizations worldwide. In addition to being involved in covert action and intelligence gathering, the department has also been active in monitoring and suppressing Chinese dissidents abroad. Its officers typically operate under diplomatic cover as members of the Ministry of Foreign Affairs, a notable difference from China's main intelligence services.

Limitations and Potential

As with any intelligence bureaucracy, especially one in a non-democratic country, identifying the oversight and management structures of China's intelligence operations is difficult. It is very clear that the Communist Party of China has absolute control over all of the intelligence services, but exactly who is in control is unclear. China's government is known for its opaqueness and bureaucratic infighting, and the leadership of China's intelligence services is no exception. Direct authority lies with the ministers and directors of the individual services, but it appears that more power may be in the hands of the Political and Legislative Affairs Committee secretary and the head of the CMC. Stratfor sources confirm this, and they also believe the MSS director is the most powerful intelligence leader in the government (but not in the CPC). The ultimate consumers of China's intelligence product are the services' true commanders who, as it happens, constitute the country's most powerful institution — the Standing Committee of the CPC.
The oversight that party leaders have over China's intelligence operations limits the effectiveness of the operations in many ways. In addition to the inefficiencies inherent in China's parallel government-party structures, corruption is likely a pervasive problem throughout the intelligence services, just as it is in other Chinese bureaucracies. There are examples of intelligence officers bringing back scrap metal with U.S. military markings and calling it military equipment — one officer involved reportedly got a commendation for his efforts. Still, cases of corruption in the Chinese intelligence community — despite the central government's current crackdown on the problem — are kept well out of the public eye, and it is difficult to tell the pervasiveness of the problem.
Even harder to identify is China's intelligence budget. It is not intended for public consumption in any form, and even if it were, the numbers would likely be of dubious value. Much funding comes from indirect sources such as state-owned companies, research institutes and technology organizations inside and outside the government. It is important to note that many Chinese intelligence operations, such as MSS front companies or MID arms sales, are self-funded, and some even produce profits for their parent organizations. Chinese intelligence services pay little money for information, especially to ethnically Chinese agents, and thus the Chinese intelligence budget goes a long way.
And in China, it is difficult to say just what "intelligence" is. The Chinese follow a different paradigm. Whereas activities by Western companies involving business espionage would never be coordinated by a central government, in China, business espionage is one of the government's main interests in terms of intelligence. China's intelligence services focus more on business and technology intelligencethan on political intelligence, though they are shifting a bit toward the latter. And Chinese companies have no moral qualms about engaging in business espionage whether they take orders from the government or not. As mentioned above, most "intelligence" operations are not directed by the central government or intelligence services but rather by an array of institutes, agencies and media outlets.
Although China follows a different intelligence paradigm that has often shown its rough edges, it is refining its technique. It is training a professional class of intelligence officers beginning even before the candidates enter the university, and it is involving its military — particularly its naval forces — in peacekeeping, foreign-aid and anti-piracy operations worldwide. This is doing much to improve China's international image at a time when the Western world may view China as a threatening emerging power. Meanwhile, China will continue to pursue a long-term intelligence strategy that the West may not consider very advanced, but Stratfor believes it would be a mistake to underestimate this patient and persistent process. The Chinese may not be that keen on the dead-drops, surveillance and dramatic covert operations that permeate spy novels, but their effectiveness may be better than we know. Larry Chin achieved world-class status as a practitioner of operational security without following Western methods, and there may be plenty of others like him.