Mapping the Birth of World’s Largest Intelligence Service

In 1920s Shanghai, Zhou Enlai founded the first Chinese communist spy network, operating in the shadows against nationalists, Western powers and the Japanese. The story of Chinese spies has been a global one from the start. Unearthing previously unseen papers and interviewing countless insiders, Roger Faligot’s astonishing account reveals nothing less than a century of world events shaped by Chinese spies.

Chinese Spies upholds a fascinating narrative exposing the sprawling tentacles of the world’s largest intelligence service, from the very birth of communist China to Xi Jinping’s absolute rule today. Read an excerpt.

Faced with the intensification of the cyber-war, several other powers, primarily neighbouring Asian countries, set up new services to counter the Chinese threat. This was the case in April 2008 for India, after websites and databases linked to its foreign ministry were attacked by Chinese hackers, identified through Indian counterintelligence’s analysis of IP addresses. Even more seriously, the computer systems of the Indian National Security Council, headed by Mayankote Kelath Narayanan, had been hacked.

Narayanan was given the task of commissioning an audit of the National Technological Research Organization (NTRO), the Indian equivalent of the NSA, which worked closely with the RAW and the Indian army’s special services, as well as the economic intelligence body responsible for raising awareness within private companies under constant attack by the Chinese in 2007-8. The conclusion these analysts arrived at could just as well be applied to all the other countries falling  prey  to  these  attacks:  it  was  vital  to  create a  cyber-warfare counterstrike force, namely a coordinated structure of cooperating services—in India’s case, this would include the NTRO, the Army Cyber Security Establishment and the Economic Intelligence Bureau.

India’s experience was of concern to two other major regions also being specifically targeted by Chinese cyber warriors: North America and Europe. At this point, virtually every individual on the planet ought  to  have begun  feeling  concerned:  in  2009,  once  again,  the  Chinese hacking apparatus had infiltrated a messaging system, in this instance belonging to Google, which drew attention to the activities of the PLA’s intelligence-gathering laboratories. Indeed, leaving aside the commercial dispute that made it clear to the Chinese that Google wanted to topple the Chinese internet provider Baidu and its affiliates, the US security services were convinced that civilian agencies and groups of ghost hackers alone would not have been able to penetrate Gmail’s encryption without the help of specialist units, brought in by the PLA3. This led a French specialist to conclude: “This was not just a commercial battle, but a ‘dry run’ for a cyberwar, con-ducted by the PLA3. Not one aspect of this war escaped them.”40

It also explained why one of these operational divisions—Chengdu’s Bureau of Technical Reconnaissance (BRT3), covering operations against Xinjiang, Tibet and north-east India—was congratulated by the army for the “exceptional qualities of its work in the  field  of  computerization,  information-gathering  in a  hostile  environment, and its research supporting academic structures and other ministries that work to protect state secrets.” Meanwhile, there were also attacks being carried out in the other direction: Ji Guilin, editor-in-chief of the Chinese defence ministry’s new web-site, launched in August 2009, complained just six months later that the United States had already carried out some 230 million attacks against the site (www.mod.gov.cn).

But the emerging war of communications was not only a battle of cutting-edge computer technology; it was simultaneously being fought in the shadows, by individuals finding their own ways to penetrate the enemy system. This became evident in the case of a Chinese network that was dismantled in Louisiana, which gave the FBI and others a clear idea of the Chinese secret services’ new MO and intensive use of the internet for sending encrypted messages.

A bit of background: in early February 2008, the FBI published the conclusions of a lengthy investigation into Kuo Tai Shen, a Chinese-American from Taiwan, Kang Yuxin, his female liaison and a Chinese citizen, and Gregg Bergersen, the US agent they had recruited, who was  a  specialist  arms  dealer  to  Taiwan  at  the  Defense  Security  Cooperation Agency in Arlington, Virginia. Some of the more note-worthy aspects of this case included the use of a furniture shop in a town called Houma as the network’s cover, and the recruitment of a Taiwanese operative, which was becoming more and more frequent thanks to the United Front Work Department—the CCP’s special service for rallying Chinese in the diaspora to Beijing’s cause. The new Taiwanese president at this time, Ma Ying-jeou, was favourable to the idea of a rapprochement with Beijing.

The other unusual aspect of the affair was the massive use of inboxes hosted by Bellsouth.net, Hotmail and Gmail.41 Thanks to them, Ms Kang had been able to correspond with “Mr X”, a Chinese intelligence officer who was based first in Canton and then in Hong Kong. Kuo, the network manager, also received emails telling him to call certain numbers, which subsequently revealed the role of the Chinese services using Hutchicity, an internet provider based in Hong Kong.  The  FBI  also  noted  that,  during  their  exchanges,  Kuo  and “Mr X” had used a coding system purchased commercially in February 2007, PGP Desktop Home 9.5 for Windows—but then discussed its use on the phone! The description of the investigation gives as much information about the workings of the FBI, in liaison with the US Pacific  Command  intelligence  service,  as  about  the  methods  the  Chinese were using. For example, it tells us that on 4 June, “Mr X” used FedEx to send Kuo a new internet address for sending secret information obtained through Bergersen and transferred via encrypted attachments. This detail suggests not only the use of countless wire-taps, but also the interception of emails and conversations in Hong Kong, undoubtedly with the help of both the local NSA branch in the US consulate and Britain’s GCHQ, which continued to have a presence in its former colony.