By Scott Stewart
Several common misconceptions assume Chinese corporate espionage efforts are much more confined and predictable than they really are.
This includes the dangerous belief that Beijing's intelligence agencies only recruit ethnic Chinese agents, or that they only recruit agents on their home turf in China.
The Chinese government and state-owned entities also frequently benefit from walk-in agents who offer stolen information of their own accord.
Thus, whether employees are at risk of providing trade secrets to Chinese intelligence actors should be evaluated purely on their behavior, and not on their ethnicity or location.
A few weeks ago, I wrote about the dangers of setting different security standards for information stored in "riskier" areas (such as Beijing) versus "safer" areas (such as Brussels). I argued that the threat posed by sophisticated corporate espionage actors, such as Chinese intelligence agencies, is global in nature, which is why security programs to defend against them must also have a global scope. As I have discussed this topic in more depth with clients, readers, the media and my Stratfor colleague Fred Burton in a recent podcast, it occurred to me that the belief that the espionage threat is limited to certain locations only scratched the surface of several other dangerous misperceptions — especially when it comes to considering the threat posed by Chinese human intelligence (humint) operations.
In light of this, I thought it'd be worthwhile to examine and explain a few of those common misunderstandings so that businesses can ensure their security programs are adequately equipped to protect against the multifaceted and ever-evolving threat posed by Beijing's espionage operations.
Misconception No. 1: Chinese Agents Are Usually Chinese
Perhaps the first and largest misperception associated with Chinese humint operations is that they're focused exclusively on Chinese citizens, or on ethnic Chinese citizens of other countries (especially those with family back in China). Now due to the nature of Chinese society, Beijing certainly possesses incredible power and influence over the lives of its citizens.
The Chinese government can control what school a person can attend, what job a person can hold and even where they can live. The state can also find a pretext to arrest and hold anyone it so chooses. And if a person refuses to cooperate, Beijing can place an incredible amount of pressure on them either directly or indirectly via actions taken against family members. Because of this ability to persuade as well as employ positive levers such as money or nationalism, Chinese intelligence agencies can and do recruit a lot of ethnic Chinese agents. However, their humint efforts will target anyone who has access to the information they are seeking — regardless of whether they have ties to China.
A wide array of past cases illustrates the willingness of the Chinese to target non-ethnic Chinese for espionage operations. In a particularly timely case, a former employee with the U.S. State Department, Candace Claiborne, recently pleaded guilty to charges of conspiracy to defraud the U.S. government. Claiborne, who's scheduled to be sentenced on July 9, confessed that she accepted money and gifts from Chinese intelligence officers in return for providing them classified information. Other recent cases include former CIA officer Kevin Mallory, who was sentenced to 20 years on May 17 after selling classified defense information to China; and former Defense Intelligence Agency officer Ron Hansen, who pleaded guilty to espionage charges on March 15 for attempting to transmit sensitive information.
While these three examples involve U.S. government employees, there have also been a number of instances where non-Chinese corporate employees were recruited by Beijing's intelligence operations. Take, for example, the case about the U.S.-based technology firm American Superconductor Corp. (AMSC) that I've previously written about, where a Serbian engineer working for an Austrian subsidiary was bribed by Chinese competitor SINOVEL to steal AMSC's source code using a combination of money and sex.
In 2015, the CEO of the Ohio-based Valley Forge Composite Technologies also pleaded guilty and was sentenced to 93 months in prison for illegally transferring sensitive and restricted microchips to China. And among many other cases, there was the high-profile one of Glenn Duffy Shriver, the American student who attempted to penetrate the CIA at the behest of his Chinese handlers.
Misconception No. 2: Chinese Agents Are Usually Recruited in China
In addition to the false assumption that Chinese intelligence agents are usually ethnically Chinese, there is a related misperception that Chinese intelligence agencies always recruit their sources inside China. However, while Beijing's intelligence officers do prefer to conduct recruitment operations on their home turf when possible, their efforts are not confined to China — as evidenced by a case involving two naturalized U.S. citizens from Africa who worked for an engineering firm in Houston.
In April 2018, the two employees were arrested and charged with stealing trade secrets for CBFM, a Chinese company set up for the purpose of helping Beijing develop the ability to manufacture syntactic foam — a strong, buoyant material used for naval warfare and offshore oil exploration. In another case, a Chinese Ministry of State Security officer was arrested in April 2018 in Brussels, where he had planned to meet and finalize the recruitment of an engineer from U.S.-based GE Aviation who could provide information on fan blade technology for jet engines.
Misconception No. 3: Chinese Agents Are Usually Recruited by China
The assumption that agents are recruited in China is largely built on the idea that Chinese espionage actors always use a "human wave" approach wherein they send agents into the West with the intention of burrowing into targeted companies, universities and research programs as moles. Again, there are numerous cases of this approach being used, but it is by no means the only way Beijing operates.
There are also many instances of the Chinese benefitting from what are commonly referred to as walk-ins. These agents approach the Chinese government, state-owned enterprises or other companies to offer stolen information of their own accord — often in exchange for a financial reward or some other personal profit.
A prime example of this involves a 2018 case in which two men were arrested in Germany and charged with stealing commercial secrets from the Cologne-based chemical company Lanxess. The company discovered that one of its engineers had stolen data pertaining to specific chemical processes with the intention of opening a rival company in China. The men even attempted to poach Lanxess clients at a chemical trade fair for their new company, a move that appears to have tipped off the company to the pair's activities. The fact that they stole the secrets with the intention of starting their own company — and not to provide the information to the Chinese government or a state-owned enterprise — highlights that they were indeed acting on their own volition, rather than being dispatched to steal the information.
Whether employees are at risk of providing trade secrets to Chinese intelligence actors should be evaluated purely on their behavior, and not on their ethnicity or location.
Another similar case of a self-motivated agent involves the chemical company Chemours, the world's largest producer of sodium cyanide (which is used in mining). In October 2017, an employee in China, Jerry Jindong Xu, was arrested and charged with attempting to steal the company's trade secrets to then sell to Chinese investors. The indictment alleges that Xu sent copies of sensitive documents and unauthorized photos relating to the construction and design of sodium cyanide plants to his private email account — thereby violating confidentiality agreements he had signed upon beginning work there and upon his departure in June 2016. Xu also allegedly established a personal business, Xtrachemical, to exploit the information he stole from Chemours for his own financial gain. According to a conversation between Xu and a potential Chinese investor, it appears that Xu had intended to use the work he had done at Chemours to establish a rival factory, and approached co-workers to gain access to sensitive documents during his employment.
In 2017, four executives at the U.S. manufacturer Applied Materials were also arrested and charged with stealing trade secrets. According to the indictment, the case allegedly dates back to 2012, when the accused conspirators copied classified schematics for sensitive details and processes related to the company's semiconductor production services. The four defendants were relatively cavalier in their theft — recruiting other staff to download proprietary files to help them establish their own competing company in either the United States or China. The group also sent the sensitive information via personal email addresses and discussed the thefts openly in online communications.
In yet another case, an employee with the pharmaceutical company GlaxoSmithKline stole proprietary information in order to attract Chinese investors and set up a rival company in 2016. Like many of these other cases, the GlaxoSmithKline employees appear to have had an entrepreneurial motivation. But given the relationship between the government and commerce in China, Chinese officials were likely not too far removed from such investors. Indeed, Beijing has what it calls the "thousand talents program," which is intended to lure Chinese-educated expatriates in the West back home with generous financial offers — especially those who return with highly sought-after technologies.
As demonstrated by these various cases, those who underestimate the complexity, aggressiveness and scope of Chinese espionage efforts do so at their own peril. Companies whose security programs focus exclusively on ethnic Chinese as potential Chinese intelligence agents are likely to be caught off guard. Thus, assessments on whether employees are at risk of being recruited need to be made based on their behavior, and not on whether they have any known connection to China.
No comments:
Post a Comment