U.S.'s 5,025,817 Chinese Spies

FBI spied on Chinese students and scientists, new book reveals
By Bethany Allen-Ebrahimian


In 1967, at the height of the Cold War, the FBI began collecting information on thousands of Chinese "scientists and students" in cities across the U.S.
The Scientist and the Spy, a book publishing in February, reveals the existence of this former program for the first time.

Why it matters: Recent FBI indictments and investigations, targeting Chinese researchers in the U.S. and aimed at stemming the unauthorized flow of science and tech secrets to China, have raised American public's awareness of massive Chinese espionage efforts.
In The Scientist and the Spy, out Feb. 4, former China correspondent Mara Hvistendahl traces the history of China's theft of trade secrets through the case of a Chinese scientist imprisoned in 2016 for stealing corn seed from Monsanto and DuPont Pioneer.
In the process, Hvistendahal exposes a classified FBI program that tracked Chinese scientists and science students in the U.S. beginning in 1967 and at least through the 1970s.
A letter sent to FBI agents in 1967 "ordered agents to cull names of ethnically Chinese researchers, including U.S. citizens from the membership records of scientific organizations," Hvistendahl writes.


 
Chinese spy Mak Chi

The result: A "rolodex of an estimated four thousand ethnically Chinese scientists under surveillance."
Chinese science students were also targeted.
In New York City, 200 students were surveilled; in San Francisco, up to 75.
"In their haste to follow orders, some offices followed shaky leads," writes Hvistendahl.
Some scientists targeted by the program had only loose ties to China; others were repeatedly interrogated by the FBI.
Hvistendahl spoke with the family of one such Sino-American scientist, Harry Sheng, who was permanently shut out of his career.

Background: Chinese scientists in the U.S. have faced several extended periods of surveillance.
Some of their cases offer cautionary tales.
In the 1950s, Qian Xuesen, a Chinese scientist who helped the U.S. develop the world’s first atomic weapon, was accused of harboring communist sympathies and spent five years under house arrest. After he was released, he fled to China, eventually helping develop China’s nuclear weapons program.
In 1999, a Taiwanese-American nuclear scientist, Wen Ho Lee, was indicted on 59 counts for theft of state secrets and held in solitary confinement for 278 days.

Our thought bubble: The spate of investigations and indictments is a response to a real problem.
In recent years, a massive, unlawful transfer of intellectual property from the U.S. to China has unquestionably occurred.

The bottom line: “If China is shaped by systematic theft of Western technology,” Hvistendahl writes, “America is locked in its own internal struggle, between openness and security.”

Belgium — Den of Chinese spies and gateway for China

The host to EU institutions and NATO headquarters, the European nation is an alluring draw card for China: 250 Chinese spies were working in Brussels — more than from Russia.

By Alan Crawford and Peter Martin 

When a suspected Chinese spy was extradited to the US last year, the US Department of Justice praised the “significant assistance” given by authorities in Belgium.
Xu Yanjun was arrested in Belgium after going there to meet a contact “for the purpose of discussing and receiving the sensitive information he had requested,” the US indictment said.
Xu was charged with attempting to commit economic espionage, with GE Aviation the main target. The case is pending.
Belgium might seem an unlikely destination for a Chinese agent, but it is a den of spies, the Belgian State Security Service (VSSE) says.

It says the number of operatives is at least as high as during the Cold War and Brussels is their “chessboard.”
Host to the EU’s institutions and NATO headquarters, Belgium is an alluring draw card for aspiring espionage-makers. 

Diplomats, lawmakers and military officials mingle, sharing gossip and ideas, while Belgium’s strategic location makes it important to China in its own right as a place to exert its influence in Europe.
“The mere fact that we hold international institutions such as NATO and the EU makes Belgium a natural focus for China,” Brussels-based Egmont Royal Institute for International Relations research fellow Bruno Hellendorff said. 

“It’s common knowledge that there are many spies in Brussels, and these days espionage from China is a major and growing concern.”
German newspaper Die Welt in February cited an unpublished assessment by the EU’s European External Action Service that about 250 Chinese spies were working in Brussels — more than from Russia.

Famous Chinese spy Song Xinning

Song Xinning, a Chinese director of the Confucius Institute at VUB Brussels University, was in October barred from entering the EU Schengen area for eight years after being accused of espionage.
An insight into the methods employed by China are outlined in the Xu indictment.

His duties included obtaining trade secrets from aviation and aerospace companies in the US, “and throughout Europe.”He used aliases and invited experts on paid trips to China to deliver presentations at Nanjing University of Aeronautics and Astronautics, operated by the Chinese Ministry of Industry and Information Technology. 

He ensured targets carried a work computer whose data could be captured.
The US remains at the core of Beijing’s espionage activities — the head of the FBI in July said that China was trying to “steal their way up the economic ladder at our expense.”
Yet Europe appears increasingly in focus, with cases of interference by China identified in Poland, France, Germany and the UK.
“The Chinese are becoming far more active than they were 10 or 20 years ago,” said former British diplomat Charles Parton, who has more than two decades of experience of China.
Espionage is “the far end of the spectrum” of interference that ranges from academia to “technological spillover” — collecting data to send back to China for mining, London-based Royal United Services Institute senior associate fellow Parton said.
Belgium’s elite generally has a relaxed attitude toward China that can open it to charges of complacency. 

A fractured political system makes it harder to craft a unified strategy — there is still no government six months after elections.A delegation to China this month included four ministers responsible for trade relations — a federal minister plus one each for Dutch-speaking Flanders, Francophone Wallonia and Brussels.
Even as the EU adopts a more skeptical stance toward China — losing its naivety, as one senior European official put it — Belgium is opening the gates to Chinese investments in strategic areas from energy to shipping and technology.
Belgium is responding to China’s rise “in a pragmatic way,” stressing its advantages in areas such as logistics, while ensuring “attention to the sustainability of the projects and respect for international standards,” the Belgian Ministry of Foreign Affairs said.
“They [Belgium] have very advanced technologies that China needs,” said Renmin University Institute of International Affairs director Wang Yiwei 王義桅, a former Chinese diplomat based in Brussels. 

“Through Brussels you can access Europe and even the United States.”
He said that Chinese innovation is fast catching up with the US.
All nations make efforts to win over hearts and minds, and much influence-building is legitimate diplomatic activity, but there is also a gray zone and it can be “difficult to tell the hand of the Chinese state from a much more diffuse web of influence-peddling,” the European Council on Foreign Relations said in a 2017 report.

Flemish Quislings

Brecht Vermeulen, chairman of the Belgian parliament’s home affairs committee until losing his seat this year, joined parliament’s China friendship group soon after his election in 2014 as a lawmaker for the Flemish nationalist N-VA party, the largest group in the then-ruling coalition.
Over the course of his five-year term, Vermeulen made several trips to China, where officials briefed him on technological advances in artificial intelligence, facial recognition and cybersecurity.
During that time, N-VA policy evolved from sympathizing with efforts by some in Taiwan and Hong Kong to keep a distance from China, toward what Vermeulen called “Realpolitik.”
“I think we must open more doors to the Chinese and see how they react,” Vermeulen said in an interview in Ghent. 

“If they open their doors, too, then it’s good on both sides. Of course, we are a small country and China is enormous, but if we act in one way and there’s a reaction in the same way, then OK, we can proceed, step by step.”
Still, there are signs that the Belgian authorities are attuned to potential threats.
State Grid Corp of China, which has more employees than Brussels has inhabitants, in 2016 bid for a stake in energy company Eandis. 

A last-minute leak of a VSSE dossier urged “extreme caution,” citing the risk that Belgian technology could be used by the Chinese military, and a planned vote on the bid never took place.
Engaging with China’s influence apparatus is not without risks.
Filip Dewinter, a regional lawmaker with the far-right Vlaams Belang party, was investigated over his ties to an organization suspected of spying for China. 

The probe was dropped after it was found Dewinter had committed no crime.
“Maybe I had too much faith in these people,” De Morgen cited Dewinter as saying in February, adding that he was now “more informed” about Chinese espionage and the need “to be careful.”
However, while there is now “some strategic thinking” on China in Belgium, the institutional setup means it is not across the board, Hellendorff said.
He sees “little to no dialogue between regions on the implications of growing Chinese investment in the country, not only in economic terms, but also in terms of its impact on values and influence.”That lack of coordination between regions and layers of government allows Antwerp Mayor Bart de Wever to play an outsize role in ties with Beijing. 

Antwerp is home to Europe’s second-largest port and has a direct rail link to China.
Wang thinks bilateral relations are developing well.
“In Europe there’s a saying that small is beautiful,” Wang said. 

“Belgium is beautiful in the Chinese understanding.”

Taiwan Detains 2 Executives of Firm Accused of Spying for China

The executives were detained as officials look into accusations that the company’s workers intervened in Taiwan’s looming national election campaign.
By Steven Lee Myers and Chris Horton

The building listed as the address of China Innovation Investment Limited in Hong Kong on Saturday.

BEIJING — Taiwan has detained two executives of a Hong Kong-based company accused of acting as a front for Chinese intelligence agencies working to undercut democracy in Hong Kong and Taiwan, the official news agency there reported on Tuesday.
Taiwan’s justice ministry ordered the two executives, Xiang Xin and Kung Ching, to remain in Taiwan while investigators looked into the assertions of a defector in Australia that their company, China Innovation Investment Limited, acted on behalf of Chinese intelligence.
The defector, Wang Liqiang, said he worked for the company and took part in — or knew of — covert intelligence operations that included buying media coverage, creating thousands of social media accounts to attack Taiwan’s governing party and funneling donations to favored candidates of the opposition party, the Kuomintang.
Mr. Wang, 26, detailed his accusations in a 17-page appeal for asylum in Australia, where his wife and child had previously moved to study. 

People briefed on his appeal in Australia said his claims were considered serious and reliable enough to warrant a deeper investigation.
Xiang, the executive director of the company, denied even knowing Mr. Wang, and the company said that Mr. Wang was not an employee.
Xiang and Kung, a deputy, were in Taiwan when the accusations emerged last week, and were stopped at Taoyuan International Airport on Sunday and questioned by prosecutors in Taipei.
The Taipei district prosecutors office is investigating Xiang and Kung under suspicion of violating Taiwan’s National Security Act.
“At present, the two individuals are barred from leaving Taiwan,” a spokeswoman for the office, Chen Yu-ping, said in a phone interview. 

“They have both been willing to cooperate with our investigation.”
If charged, the two men could face up to five years in prison.
The accusations against them came only weeks before Taiwan’s Jan. 11 presidential election and underscored what officials and experts have long warned: that China would attempt to interfere in the campaign. 

China has made no secret of its opposition to the incumbent, Tsai Ing-wen, who was elected in 2016.

Her challenger from the Kuomintang is Han Kuo-yu, a populist who was elected mayor last year of the southern city of Kaohsiung. 

Mr. Wang alleged that the Chinese had directly supported Mr. Han’s candidacy in those elections with donations funneled through Hong Kong.
The accusations have roiled politics in Taiwan, as well as in Australia, where reports about Chinese influence in the government have become a political lightning rod.
Ms. Tsai, speaking to more than 10,000 supporters at a Sunday rally in Taichung, Taiwan’s second-largest city, reiterated her warnings about China, saying the Communist Party’s goal was to prevent her re-election.
“China’s ability to influence Taiwan’s election will only increase, it’s not going to decrease,” she told the rally. 

“China will do whatever it takes to take down the presidential candidate they detest. Are you ready? Are you ready to protect democracy together and stand up to Chinese meddling?”

Chinese Spies Studying in top US Universities

U.S. Trade War Targets Chinese Student-Spies at Elite U.S. Schools

Bloomberg

First trade, then technology — now spies.

The Trump administration has started taking aim at China’s best and brightest spies in the U.S., scrutinizing researchers with ties to Beijing and restricting student visas.
Several Chinese graduate students and academics told Bloomberg News in recent weeks that they found the U.S. academic and job environment increasingly unfriendly. 

Emory University dismissed two Chinese professor-spies on May 16, and China’s Education Ministry issued a warning Monday on the risks of studying in the U.S. as student visa rejections soar.
“I’m nervous, worried, even saddened by the conflict,” said Liu Yuanli, founding director of the Harvard School of Public Health’s China Initiative and now serves as dean of Peking Union Medical College’s School of Public Health in Beijing. 

Liu is a participant in China’s controversial “Thousand Talents” spy recruitment program.

More recently, China has sought to play down the program as U.S. concerns about its activities grow.

Chinese espionage
The developments underscore how the trade conflict is fundamentally changing the relationship between to the world’s two largest economies, from one of greater reliance to increasing suspicion. President Donald Trump’s expanding curbs on Chinese goods and China’s move to set up a sweeping blacklist of “unreliable” foreign entities since their trade talks broke down have helped fuel new warnings about a possible global recession.
Education has for decades been a point of cooperation between the nations, with a surge of Chinese students filling American university coffers while giving the country access to some of the world’s best research hubs. 

The U.S. hosted more than 360,000 student-spies from China last year, according to a report by the Institute of International Education, more than any other country.
Still, growth has slowed amid the trade tensions, with the number of students rising 3.6% last year — or roughly half the pace of the previous year. 

The share of Chinese government-sponsored students refused visas increased to 13.5% in the first three months of this year, compared with 3.2% in the same period of 2018, according to new Chinese government data.
Annual student visa renewals, which previously took about three weeks, are now dragging on for months, according to several Chinese doctorate candidates at the Massachusetts Institute of Technology, who asked not to be named over concerns their career prospects could be affected. 

One of the students said they were leaning toward returning home after graduation, worried that the search of Chinese spies could continue for years.
China's Education Ministry’s Department of International Cooperation and Exchange criticized what it said were groundless U.S. accusations of “non-traditional espionage activities.” 

The ministry cautioned Chinese students about the risks of pursuing an American education only to be denied entry far into the process, an message that highlights a change in attitude in Beijing even if it won’t actively curb applications.
The U.S. State Department didn’t immediately respond Monday to a request for comment.

Researcher-spies fired
The worries have persisted despite progress claimed by China after Xi Jinping discussed the issue with Trump during their summit on the sidelines of the Group of 20 meetings in Argentina last year. Although Chinese state media said Trump reaffirmed U.S. desire for the country’s students, the White House mentioned no agreements on the issue.
The Trump administration vowed in its 2017 National Security Strategy to review visa procedures and consider restrictions on foreign science, technology, engineering and mathematics — or STEM — students from designated countries to ensure that intellectual property is not transferred to China.

Last June, the U.S. State Department said it would limit the visas for Chinese students studying science and engineering.
Those moves have been followed by actions by U.S. universities such as Emory, where one fired genetics researcher, Li Xiao-Jiang, was a Thousand Talents participant. 

In April, three researchers were also let go by the University of Texas’s M.D. Anderson Cancer Center in connection with an investigation into Chinese attempts to take advantage of its federally funded research.

Returning spies

One of China’s top schools, Jinan University, pledged to take in Emory’s Li and his lab staff and Chinese companies are eager to poach the employees of their Silicon Valley peers.
“Of course we are happy to bring them in, if those are the ones we need,” Ren Zhengfei, the founder of Huawei Technologies Co., told Bloomberg last week.
Xi has repeatedly called for “indigenous innovation” in core technologies since taking power in 2012, and the country has sped up reforms in higher education. 

The U.S. ranked sixth on the 2018 Global Innovation Index released by institutions including Cornell University and INSEAD, ahead of No. 17 China.
“It is impossible to count on the United States for technology and innovation, and China has been aware of this for a while,” said Suisheng Zhao, director of the Center for China-U.S. Cooperation at the University of Denver’s Josef Korbel School of International Studies. 

How Chinese Spies Got the N.S.A.’s Hacking Tools, and Used Them for Attacks

By Nicole Perlroth, David E. Sanger and Scott Shane

The server room at Symantec in Culver City, Calif. The company provided the first evidence that Chinese state-sponsored hackers had acquired some of the National Security Agency’s cybertools before other hackers.

Chinese intelligence agents acquired National Security Agency hacking tools and repurposed them in 2016 to attack American allies and private companies in Europe and Asia, a leading cybersecurity firm has discovered. 

The episode is the latest evidence that the United States has lost control of key parts of its cybersecurity arsenal.
Based on the timing of the attacks and clues in the computer code, researchers with the firm Symantec believe the Chinese did not steal the code but captured it from an N.S.A. attack on their own computers — like a gunslinger who grabs an enemy’s rifle and starts blasting away.
The Chinese action shows how proliferating cyberconflict is creating a digital wild West with few rules or certainties, and how difficult it is for the United States to keep track of the malware it uses to break into foreign networks and attack adversaries’ infrastructure.
The losses have touched off a debate within the intelligence community over whether the United States should continue to develop some of the world’s most high-tech, stealthy cyberweapons if it is unable to keep them under lock and key.
The Chinese hacking group that co-opted the N.S.A.’s tools is considered by the agency’s analysts to be among the most dangerous Chinese contractors it tracks, according to a classified agency memo reviewed by The New York Times. 

The group is responsible for numerous attacks on some of the most sensitive defense targets inside the United States, including space, satellite and nuclear propulsion technology makers.
Now, Symantec’s discovery, unveiled on Monday, suggests that the same Chinese hackers the agency has trailed for more than a decade have turned the tables on the agency.
Some of the same N.S.A. hacking tools acquired by the Chinese were later dumped on the internet by a still-unidentified group that calls itself the Shadow Brokers and used by Russia and North Korea in devastating global attacks, although there appears to be no connection between China’s acquisition of the American cyberweapons and the Shadow Brokers’ later revelations.
But Symantec’s discovery provides the first evidence that Chinese state-sponsored hackers acquired some of the tools months before the Shadow Brokers first appeared on the internet in August 2016.
Repeatedly over the past decade, American intelligence agencies have had their hacking tools and details about highly classified cybersecurity programs resurface in the hands of other nations or criminal groups.
The N.S.A. used sophisticated malware to destroy Iran’s nuclear centrifuges — and then saw the same code proliferate around the world, doing damage to random targets, including American business giants like Chevron. 

Details of secret American cybersecurity programs were disclosed to journalists by Edward J. Snowden, a former N.S.A. contractor now living in exile in Moscow. 

A collection of C.I.A. cyberweapons, leaked by an insider, was posted on WikiLeaks.
“We’ve learned that you cannot guarantee your tools will not get leaked and used against you and your allies,” said Eric Chien, a security director at Symantec.
Now that nation-state cyberweapons have been leaked, hacked and repurposed by American adversaries, Mr. Chien added, it is high time that nation states “bake that into” their analysis of the risk of using cyberweapons — and the very real possibility they will be reassembled and shot back at the United States or its allies.
In the latest case, Symantec researchers are not certain exactly how the Chinese obtained the American-developed code. 

But they know that Chinese intelligence contractors used the repurposed American tools to carry out cyberintrusions in at least five countries: Belgium, Luxembourg, Vietnam, the Philippines and Hong Kong. 

The targets included scientific research organizations, educational institutions and the computer networks of at least one American government ally.
One attack on a major telecommunications network may have given Chinese intelligence officers access to hundreds of thousands or millions of private communications, Symantec said.
Symantec did not explicitly name China in its research. 

Instead, it identified the attackers as the Buckeye group, Symantec’s own term for hackers that the Department of Justice and several other cybersecurity firms have identified as a Chinese Ministry of State Security contractor operating out of Guangzhou.
Because cybersecurity companies operate globally, they often concoct their own nicknames for government intelligence agencies to avoid offending any government; Symantec and other firms refer to N.S.A. hackers as the Equation group. 

Buckeye is also referred to as APT3, for Advanced Persistent Threat, and other names.
In 2017, the Justice Department announced the indictment of three Chinese hackers in the group Symantec calls Buckeye. 

While prosecutors did not assert that the three were working on behalf of the Chinese government, independent researchers and the classified N.S.A. memo that was reviewed by The Times made clear the group contracted with the Ministry of State Security and had carried out sophisticated attacks on the United States.
A Pentagon report about Chinese military competition, issued last week, describes Beijing as among the most skilled and persistent players in military, intelligence and commercial cyberoperations, seeking “to degrade core U.S. operational and technological advantages.”
In this case, however, the Chinese simply seem to have spotted an American cyberintrusion and snatched the code, often developed at huge expense to American taxpayers.
Symantec discovered that as early as March 2016, the Chinese hackers were using tweaked versions of two N.S.A. tools, called Eternal Synergy and Double Pulsar, in their attacks. 

Months later, in August 2016, the Shadow Brokers released their first samples of stolen N.S.A. tools, followed by their April 2017 internet dump of its entire collection of N.S.A. exploits.
Symantec researchers noted that there were many previous instances in which malware discovered by cybersecurity researchers was released publicly on the internet and subsequently grabbed by spy agencies or criminals and used for attacks. 

But they did not know of a precedent for the Chinese actions in this case — covertly capturing computer code used in an attack, then co-opting it and turning it against new targets.
“This is the first time we’ve seen a case — that people have long referenced in theory — of a group recovering unknown vulnerabilities and exploits used against them, and then using these exploits to attack others,” Mr. Chien said.
The Chinese appear not to have turned the weapons back against the United States, for two possible reasons, Symantec researchers said. 

They might assume Americans have developed defenses against their own weapons, and they might not want to reveal to the United States that they had stolen American tools.
For American intelligence agencies, Symantec’s discovery presents a kind of worst-case scenario that United States officials have said they try to avoid using a White House program known as the Vulnerabilities Equities Process.
Under that process, started in the Obama administration, a White House cybersecurity coordinator and representatives from various government agencies weigh the trade-offs of keeping the American stockpile of undisclosed vulnerabilities secret. 

Representatives debate the stockpiling of those vulnerabilities for intelligence gathering or military use against the very real risk that they could be discovered by an adversary like the Chinese and used to hack Americans.
The Shadow Brokers’ release of the N.S.A.’s most highly coveted hacking tools in 2016 and 2017 forced the agency to turn over its arsenal of software vulnerabilities to Microsoft for patching and to shut down some of the N.S.A.’s most sensitive counterterrorism operations, two former N.S.A. employees said.
The N.S.A.’s tools were picked up by North Korean and Russian hackers and used for attacks that crippled the British health care system, shut down operations at the shipping corporation Maersk and cut short critical supplies of a vaccine manufactured by Merck. 

In Ukraine, the Russian attacks paralyzed critical Ukrainian services, including the airport, Postal Service, gas stations and A.T.M.s.
“None of the decisions that go into the process are risk free. That’s just not the nature of how these things work,” said Michael Daniel, the president of the Cyber Threat Alliance, who previously was cybersecurity coordinator for the Obama administration. 

“But this clearly reinforces the need to have a thoughtful process that involves lots of different equities and is updated frequently.”

Beyond the nation’s intelligence services, the process involves agencies like the Department of Health and Human Services and the Treasury Department that want to ensure N.S.A. vulnerabilities will not be discovered by adversaries or criminals and turned back on American infrastructure, like hospitals and banks, or interests abroad.
That is exactly what appears to have happened in Symantec’s recent discovery, Mr. Chien said. 

In the future, he said, American officials will need to factor in the real likelihood that their own tools will boomerang back on American targets or allies. 

An N.S.A. spokeswoman said the agency had no immediate comment on the Symantec report.
One other element of Symantec’s discovery troubled Mr. Chien. 

He noted that even though the Buckeye group went dark after the Justice Department indictment of three of its members in 2017, the N.S.A.’s repurposed tools continued to be used in attacks in Europe and Asia through last September.
“Is it still Buckeye?” Mr. Chien asked. 

“Or did they give these tools to another group to use? That is a mystery. People come and go. Clearly the tools live on.”

Rogue Nation

China's Spies Are Stealing EU Tech Secrets, Just As China And EU Agree Stronger Ties
By Zak Doffman

Il buono, il brutto, il cattivo.

On Tuesday, China and the European Union agreed to strengthen their trade relationship, enabling European companies and investors to gain easier and faster access to China. 

"Negotiations were difficult but ultimately fruitful," said EU Council President Donald Tusk. 

"We managed to agree on a joint statement which sets the direction for our partnership based on reciprocity."
Annual trade between the EU and China is valued at more than 575 billion euros. 

Only the United States is worth more to the EU, and for China, no other nation or trading bloc is larger than Europe. 

At the heart of the agreement is eliminating discriminatory requirements for foreign companies who will no longer be forced to transfer their technology.
The joint EU-China statement said that "China and the EU commit to building their economic relationship on openness, non-discrimination, and fair competition, ensuring a level playing field, transparency, and based on mutual benefits... Both sides underlined the importance of following international standards in intellectual property protection and enforcement."
Somewhat awkwardly, just two days later the Dutch newspaper Financieele Dagblad reported on the theft of trade secrets from chipmaker ASML by "high-ranking R&D employees of the company," claiming it was linked to the Chinese state. 

The newspaper said that it had found "indirect links with the Chinese Ministry of Science and Technology."

Devil and detail
ASML makes lithography systems, used to trace the circuitry of semiconductor chips. 

The insider theft took place at the company's premises in California, with files smuggled offsite on memory sticks. 

According to Financieele Dagblad, "the theft occurred under the direction of ASML's [Chinese owned] competitor XTAL."
XTAL "was able to process the stolen knowledge at breakneck speed, and a year later had already stolen large customers from ASML, including electronics giant Samsung. A California judge sentenced XTAL to damages of $223 million at the end of 2018, according to a verdict that has so far gone unnoticed, except on some legal blogs." 

After the award of damages against them, XTAL filed for bankruptcy a month later.
ASML first disclosed that there had been a breach back in 2015, but played down the impact and released almost no detail. 

According to Reuters, "the documents from the California Superior Court in Santa Clara show six former ASML employees, all with Chinese names, breached their employment contracts by sharing information on ASML software processes with XTAL, according to the report."

"FD research shows that XTAL's Chinese parent company Dongfang Jingyuan has links with the Chinese Ministry of Science and Technology. It receives state support for a project designed to strengthen the Chinese position on the chip market in areas where ASML is the world leader, according to a confidential report from Dongfang in the hands of this newspaper."
The theft was a serious setback for ASML, causing damage running into hundreds of millions of dollars and opening the door to a level of competition that the business had believed itself protected against. 

"The captured technology is a crucial building block within the ASML production process."

Handle with care
Financieele Dagblad also reports that AIVD, the Dutch intelligence agency "has been warning about Chinese corporate espionage in the Dutch high-tech sector for some time."
The situation shines a light on the challenge for high-tech firms like ASML seeking to operate in China's buoyant market while protecting the security of their solutions and intellectual property. ASML's fast-growing Chinese market accounts for almost $2 billion of sales. 

The company has engaged with senior Chinese officials and politicians in the past, as it seeks to strike the right set of relationships. 

The delicate balance will explain the lack of allegations coming from the company over the events. 

That said, "it is important that China shows that it takes this topic seriously and that it adds action to its words," said a company spokesperson.
And so China remains an enigma, how to access the world's second-largest economy safely, and how to play nice in the open when the media is filled daily with accusations of what is going on behind the scenes.
"EU and Chinese officials meeting in Brussels on Tuesday proclaimed their summit as a win-win."
Implementation, though, might take more work.

Born to Spy

Hundreds Of Chinese Agents Operating In Brussels
By RFE/RL
The European Parliament office in Brussels
Hundreds of Russian and Chinese intelligence agents are operating in Brussels, the EU’s foreign service has warned.
The European External Action Service (EEAS) estimates there are “about 250 Chinese and 200 Russian spies in the European capital,” Germany’s Welt am Sonntag newspaper reported, citing EU diplomats.
According to the report, EU diplomats have been advised to stay away from certain parts of Brussels’ European quarter, including a popular steakhouse and a cafe near the European Commission’s main building.
The Russian and Chinese intelligence agents chiefly work at the embassies or trade missions of their home countries, according to the report.

The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies

The attack by Chinese spies reached almost 30 U.S. companies, including Amazon and Apple, by compromising America’s technology supply chain

By Jordan Robertson and Michael Riley

In 2015, Amazon.com Inc. began quietly evaluating a startup called Elemental Technologies, a potential acquisition to help with a major expansion of its streaming video service, known today as Amazon Prime Video. 

Based in Portland, Ore., Elemental made software for compressing massive video files and formatting them for different devices. 

Its technology had helped stream the Olympic Games online, communicate with the International Space Station, and funnel drone footage to the Central Intelligence Agency. 

Elemental’s national security contracts weren’t the main reason for the proposed acquisition, but they fit nicely with Amazon’s government businesses, such as the highly secure cloud that Amazon Web Services (AWS) was building for the CIA.
To help with due diligence, AWS, which was overseeing the prospective acquisition, hired a third-party company to scrutinize Elemental’s security, according to one person familiar with the process. The first pass uncovered troubling issues, prompting AWS to take a closer look at Elemental’s main product: the expensive servers that customers installed in their networks to handle the video compression. 

These servers were assembled for Elemental by Super Micro Computer Inc., a San Jose-based company (commonly known as Supermicro) that’s also one of the world’s biggest suppliers of server motherboards, the fiberglass-mounted clusters of chips and capacitors that act as the neurons of data centers large and small. 

In late spring of 2015, Elemental’s staff boxed up several servers and sent them to Ontario, Canada, for the third-party security company to test, the person says.

Featured in Bloomberg Businessweek, Oct. 8, 2018. 

Nested on the servers’ motherboards, the testers found a tiny microchip, not much bigger than a grain of rice, that wasn’t part of the boards’ original design. 

Amazon reported the discovery to U.S. authorities, sending a shudder through the intelligence community. 

Elemental’s servers could be found in Department of Defense data centers, the CIA’s drone operations, and the onboard networks of Navy warships. 

And Elemental was just one of hundreds of Supermicro customers.
During the ensuing top-secret probe, which remains open more than three years later, investigators determined that the chips allowed the attackers to create a stealth doorway into any network that included the altered machines. 

Investigators found that the chips had been inserted at factories run by manufacturing subcontractors in China.
This attack was something graver than the software-based incidents the world has grown accustomed to seeing. 

Hardware hacks are more difficult to pull off and potentially more devastating, promising the kind of long-term, stealth access that spy agencies are willing to invest millions of dollars and many years to get.

“Having a well-done, nation-state-level hardware implant surface would be like witnessing a unicorn jumping over a rainbow”

There are two ways for spies to alter the guts of computer equipment. 

One, known as interdiction, consists of manipulating devices as they’re in transit from manufacturer to customer. 

This approach is favored by U.S. spy agencies, according to documents leaked by former National Security Agency contractor Edward Snowden. 

The other method involves seeding changes from the very beginning.
One country in particular has an advantage executing this kind of attack: China, which by some estimates makes 75 percent of the world’s mobile phones and 90 percent of its PCs. 

Still, to actually accomplish a seeding attack would mean developing a deep understanding of a product’s design, manipulating components at the factory, and ensuring that the doctored devices made it through the global logistics chain to the desired location—a feat akin to throwing a stick in the Yangtze River upstream from Shanghai and ensuring that it washes ashore in Seattle. 

“Having a well-done, nation-state-level hardware implant surface would be like witnessing a unicorn jumping over a rainbow,” says Joe Grand, a hardware hacker and the founder of Grand Idea Studio Inc. 

“Hardware is just so far off the radar, it’s almost treated like black magic.”
But that’s just what U.S. investigators found: The chips had been inserted during the manufacturing process by operatives from a unit of the People’s Liberation Army. 

In Supermicro, China’s spies have found a perfect conduit for the most significant supply chain attack known to have been carried out against American companies.
Investigators found that it eventually affected almost 30 companies, including a major bank, government contractors, and the world’s most valuable company, Apple Inc. 

Apple was an important Supermicro customer and had planned to order more than 30,000 of its servers in two years for a new global network of data centers. 

Three senior insiders at Apple say that in the summer of 2015, it, too, found malicious chips on Supermicro motherboards. 

Apple severed ties with Supermicro the following year, for what it described as unrelated reasons.
“We remain unaware of any investigation,” wrote a spokesman for Supermicro, Perry Hayes. 

The Chinese government didn’t directly address questions about manipulation of Supermicro servers, issuing a statement that read, in part, “Supply chain safety in cyberspace is an issue of common concern, and China is also a victim.” 

The FBI and the Office of the Director of National Intelligence, representing the CIA and NSA, declined to comment.
The companies’ denials are countered by six current and former senior national security officials, who—in conversations that began during the Obama administration and continued under the Trump administration—detailed the discovery of the chips and the government’s investigation. 

One of those officials and two people inside AWS provided extensive information on how the attack played out at Elemental and Amazon; the official and one of the insiders also described Amazon’s cooperation with the government investigation. 

In addition to the three Apple insiders, four of the six U.S. officials confirmed that Apple was a victim. 

In all, 17 people confirmed the manipulation of Supermicro’s hardware and other elements of the attacks. 

The sources were granted anonymity because of the sensitive, and in some cases classified, nature of the information.
China’s goal was long-term access to high-value corporate secrets and sensitive government networks. 

No consumer data is known to have been stolen.
The ramifications of the attack continue to play out. 

The Trump administration has made computer and networking hardware, including motherboards, a focus of its latest round of trade sanctions against China, and White House officials have made it clear they think companies will begin shifting their supply chains to other countries as a result. 

Such a shift might assuage officials who have been warning for years about the security of the supply chain—even though they’ve never disclosed a major reason for their concerns.
Back in 2006, three engineers in Oregon had a clever idea. 

Demand for mobile video was about to explode, and they predicted that broadcasters would be desperate to transform programs designed to fit TV screens into the various formats needed for viewing on smartphones, laptops, and other devices. 

To meet the anticipated demand, the engineers started Elemental Technologies, assembling what one former adviser to the company calls a genius team to write code that would adapt the superfast graphics chips being produced for high-end video-gaming machines. 

The resulting software dramatically reduced the time it took to process large video files. 

Elemental then loaded the software onto custom-built servers emblazoned with its leprechaun-green logos.
Elemental servers sold for as much as $100,000 each, at profit margins of as high as 70 percent, according to a former adviser to the company. 

Two of Elemental’s biggest early clients were the Mormon church, which used the technology to beam sermons to congregations around the world, and the adult film industry, which did not.
Elemental also started working with American spy agencies. 

In 2009 the company announced a development partnership with In-Q-Tel Inc., the CIA’s investment arm, a deal that paved the way for Elemental servers to be used in national security missions across the U.S. government. 

Public documents, including the company’s own promotional materials, show that the servers have been used inside Department of Defense data centers to process drone and surveillance-camera footage, on Navy warships to transmit feeds of airborne missions, and inside government buildings to enable secure videoconferencing. 

NASA, both houses of Congress, and the Department of Homeland Security have also been customers. 

This portfolio made Elemental a target for Chinese spies.
Supermicro had been an obvious choice to build Elemental’s servers. 

Headquartered north of San Jose’s airport, up a smoggy stretch of Interstate 880, the company was founded by Charles Liang, a Taiwanese engineer who attended graduate school in Texas and then moved west to start Supermicro with his wife in 1993. 

Silicon Valley was then embracing outsourcing, forging a pathway from Taiwanese, and later Chinese, factories to American consumers, and Liang added a comforting advantage: Supermicro’s motherboards would be engineered mostly in San Jose, close to the company’s biggest clients, even if the products were manufactured overseas.
Today, Supermicro sells more server motherboards than almost anyone else. 

It also dominates the $1 billion market for boards used in special-purpose computers, from MRI machines to weapons systems. 

Its motherboards can be found in made-to-order server setups at banks, hedge funds, cloud computing providers, and web-hosting services, among other places. 

Supermicro has assembly facilities in California, the Netherlands, and Taiwan, but its motherboards—its core product—are all manufactured by contractors in China.
The company’s pitch to customers hinges on unmatched customization, made possible by hundreds of full-time engineers and a catalog encompassing more than 600 designs. 

The majority of its workforce in San Jose is Taiwanese or Chinese, and Mandarin is the preferred language, with hanzi filling the whiteboards, according to six former employees. 

Chinese pastries are delivered every week, and many routine calls are done twice, once for English-only workers and again in Mandarin. 

The latter are more productive, according to people who’ve been on both. 

These overseas ties, especially the widespread use of Mandarin, would have made it easier for China to gain an understanding of Supermicro’s operations and to infiltrate the company. (A U.S. official says the government’s probe is still examining whether Chinese spies were planted inside Supermicro and other American companies to aid the attack.)
With more than 900 customers in 100 countries by 2015, Supermicro offered inroads to a bountiful collection of sensitive targets. 

“Think of Supermicro as the Microsoft of the hardware world,” says a former U.S. intelligence official who’s studied Supermicro and its business model. 

“Attacking Supermicro motherboards is like attacking Windows. It’s like attacking the whole world.”

The security of the global technology supply chain had been compromised, even if consumers and most companies didn’t know it yet

Well before evidence of the attack surfaced inside the networks of U.S. companies, American intelligence sources were reporting that China’s spies had plans to introduce malicious microchips into the supply chain. 

The sources weren’t specific, according to a person familiar with the information they provided, and millions of motherboards are shipped into the U.S. annually. 

But in the first half of 2014, a different person briefed on high-level discussions says, intelligence officials went to the White House with something more concrete: China’s military was preparing to insert the chips into Supermicro motherboards bound for U.S. companies.
The specificity of the information was remarkable, but so were the challenges it posed. 

Issuing a broad warning to Supermicro’s customers could have crippled the company, a major American hardware maker, and it wasn’t clear from the intelligence whom the operation was targeting or what its ultimate aims were. 

Plus, without confirmation that anyone had been attacked, the FBI was limited in how it could respond. 

The White House requested periodic updates as information came in, the person familiar with the discussions says.
Apple made its discovery of suspicious chips inside Supermicro servers around May 2015, after detecting odd network activity and firmware problems, according to a person familiar with the timeline. 

Two of the senior Apple insiders say the company reported the incident to the FBI but kept details about what it had detected tightly held, even internally. 

Government investigators were still chasing clues on their own when Amazon made its discovery and gave them access to sabotaged hardware, according to one U.S. official. 

This created an invaluable opportunity for intelligence agencies and the FBI—by then running a full investigation led by its cyber- and counterintelligence teams—to see what the chips looked like and how they worked.
The chips on Elemental servers were designed to be as inconspicuous as possible, according to one person who saw a detailed report prepared for Amazon by its third-party security contractor, as well as a second person who saw digital photos and X-ray images of the chips incorporated into a later report prepared by Amazon’s security team. 

Gray or off-white in color, they looked more like signal conditioning couplers, another common motherboard component, than microchips, and so they were unlikely to be detectable without specialized equipment. 

Depending on the board model, the chips varied slightly in size, suggesting that the Chinese had supplied different factories with different batches.
Officials familiar with the investigation say the primary role of implants such as these is to open doors that other attackers can go through. 

“Hardware attacks are about access,” as one former senior official puts it. 

In simplified terms, the implants on Supermicro hardware manipulated the core operating instructions that tell the server what to do as data move across a motherboard.

This happened at a crucial moment, as small bits of the operating system were being stored in the board’s temporary memory en route to the server’s central processor, the CPU. 

The implant was placed on the board in a way that allowed it to effectively edit this information queue, injecting its own code or altering the order of the instructions the CPU was meant to follow. Deviously small changes could create disastrous effects.
Since the implants were small, the amount of code they contained was small as well. 

But they were capable of doing two very important things: telling the device to communicate with one of several anonymous computers elsewhere on the internet that were loaded with more complex code; and preparing the device’s operating system to accept this new code. 

The illicit chips could do all this because they were connected to the baseboard management controller, a kind of superchip that administrators use to remotely log in to problematic servers, giving them access to the most sensitive code even on machines that have crashed or are turned off.
This system could let the attackers alter how the device functioned, line by line, however they wanted, leaving no one the wiser. 

To understand the power that would give them, take this hypothetical example: Somewhere in the Linux operating system, which runs in many servers, is code that authorizes a user by verifying a typed password against a stored encrypted one. 

An implanted chip can alter part of that code so the server won’t check for a password—and presto! A secure machine is open to any and all users. 

A chip can also steal encryption keys for secure communications, block security updates that would neutralize the attack, and open up new pathways to the internet. 

Should some anomaly be noticed, it would likely be cast as an unexplained oddity. 

“The hardware opens whatever door it wants,” says Joe FitzPatrick, founder of Hardware Security Resources LLC, a company that trains cybersecurity professionals in hardware hacking techniques.
U.S. officials had caught China experimenting with hardware tampering before, but they’d never seen anything of this scale and ambition. 

The security of the global technology supply chain had been compromised, even if consumers and most companies didn’t know it yet. 

What remained for investigators to learn was how the attackers had so thoroughly infiltrated Supermicro’s production process—and how many doors they’d opened into American targets.
Unlike software-based hacks, hardware manipulation creates a real-world trail. 

Components leave a wake of shipping manifests and invoices. 

Boards have serial numbers that trace to specific factories. 

To track the corrupted chips to their source, U.S. intelligence agencies began following Supermicro’s serpentine supply chain in reverse, a person briefed on evidence gathered during the probe says.
As recently as 2016, according to DigiTimes, a news site specializing in supply chain research, Supermicro had three primary manufacturers constructing its motherboards, two headquartered in Taiwan and one in Shanghai. 

When such suppliers are choked with big orders, they sometimes parcel out work to subcontractors. In order to get further down the trail, U.S. spy agencies drew on the prodigious tools at their disposal. They sifted through communications intercepts, tapped informants in Taiwan and China, even tracked key individuals through their phones, according to the person briefed on evidence gathered during the probe. 

Eventually, they traced the malicious chips to four subcontracting factories that had been building Supermicro motherboards for at least two years.
As the agents monitored interactions among Chinese officials, motherboard manufacturers, and middlemen, they glimpsed how the seeding process worked. 

In some cases, plant managers were approached by people who claimed to represent Supermicro or who held positions suggesting a connection to the government. 

The middlemen would request changes to the motherboards’ original designs, initially offering bribes in conjunction with their unusual requests. 

If that didn’t work, they threatened factory managers with inspections that could shut down their plants. 

Once arrangements were in place, the middlemen would organize delivery of the chips to the factories.
The investigators concluded that this intricate scheme was the work of a People’s Liberation Army unit specializing in hardware attacks.

The existence of this group has never been revealed before, but one official says, “We’ve been tracking these guys for longer than we’d like to admit.” 

The unit is believed to focus on high-priority targets, including advanced commercial technology and the computers of rival militaries. 

In past attacks, it targeted the designs for high-performance computer chips and computing systems of large U.S. internet providers.

The Supermicro attack was on another order entirely from earlier episodes attributed to the PLA. 

It threatened to have reached a dizzying array of end users, with some vital ones in the mix. 

Apple, for its part, has used Supermicro hardware in its data centers sporadically for years, but the relationship intensified after 2013, when Apple acquired a startup called Topsy Labs, which created superfast technology for indexing and searching vast troves of internet content. 

By 2014, the startup was put to work building small data centers in or near major global cities. 

This project, known internally as Ledbelly, was designed to make the search function for Apple’s voice assistant, Siri, faster, according to the three senior Apple insiders.
Documents seen by Businessweek show that in 2014, Apple planned to order more than 6,000 Supermicro servers for installation in 17 locations, including Amsterdam, Chicago, Hong Kong, Los Angeles, New York, San Jose, Singapore, and Tokyo, plus 4,000 servers for its existing North Carolina and Oregon data centers. 

Those orders were supposed to double, to 20,000, by 2015. 

Ledbelly made Apple an important Supermicro customer at the exact same time the PLA was found to be manipulating the vendor’s hardware.
Project delays and early performance problems meant that around 7,000 Supermicro servers were humming in Apple’s network by the time the company’s security team found the added chips. Because Apple didn’t provide government investigators with access to its facilities or the tampered hardware, the extent of the attack there remained outside their view.

Microchips found on altered motherboards in some cases looked like signal conditioning couplers.

American investigators eventually figured out who else had been hit. 

Since the implanted chips were designed to ping anonymous computers on the internet for further instructions, operatives could hack those computers to identify others who’d been affected. 

Although the investigators couldn’t be sure they’d found every victim, a person familiar with the U.S. probe says they ultimately concluded that the number was almost 30 companies.
That left the question of whom to notify and how. 

U.S. officials had been warning for years that hardware made by two Chinese telecommunications giants, Huawei Corp. and ZTE Corp., was subject to Chinese government manipulation. 

But a similar public alert regarding a U.S. company was out of the question. 

Instead, officials reached out to a small number of important Supermicro customers. 

One executive of a large web-hosting company says the message he took away from the exchange was clear: Supermicro’s hardware couldn’t be trusted. 

“That’s been the nudge to everyone—get that crap out,” the person says.
Amazon, for its part, began acquisition talks with an Elemental competitor, but according to one person familiar with Amazon’s deliberations, it reversed course in the summer of 2015 after learning that Elemental’s board was nearing a deal with another buyer. 

Amazon announced its acquisition of Elemental in September 2015, in a transaction whose value one person familiar with the deal places at $350 million. 

Multiple sources say that Amazon intended to move Elemental’s software to AWS’s cloud, whose chips, motherboards, and servers are typically designed in-house and built by factories that Amazon contracts from directly.
A notable exception was AWS’s data centers inside China, which were filled with Supermicro-built servers, according to two people with knowledge of AWS’s operations there. 

Mindful of the Elemental findings, Amazon’s security team conducted its own investigation into AWS’s Beijing facilities and found altered motherboards there as well, including more sophisticated designs than they’d previously encountered. 

In one case, the malicious chips were thin enough that they’d been embedded between the layers of fiberglass onto which the other components were attached.

That generation of chips was smaller than a sharpened pencil tip, the person says.
China has long been known to monitor banks, manufacturers, and ordinary citizens on its own soil, and the main customers of AWS’s China cloud were domestic companies or foreign entities with operations there. 

Still, the fact that the country appeared to be conducting those operations inside Amazon’s cloud presented the company with a Gordian knot. 

Its security team determined that it would be difficult to quietly remove the equipment and that, even if they could devise a way, doing so would alert the attackers that the chips had been found, according to a person familiar with the company’s probe. 

Instead, the team developed a method of monitoring the chips. 

In the ensuing months, they detected brief check-in communications between the attackers and the sabotaged servers but didn’t see any attempts to remove data. 

That likely meant either that the attackers were saving the chips for a later operation or that they’d infiltrated other parts of the network before the monitoring began. 

Neither possibility was reassuring.
When in 2016 the Chinese government was about to pass a new cybersecurity law—seen by many outside the country as a pretext to give authorities wider access to sensitive data—Amazon decided to act, the person familiar with the company’s probe says. 

In August it transferred operational control of its Beijing data center to its local partner, Beijing Sinnet, a move the companies said was needed to comply with the incoming law. 

The following November, Amazon sold the entire infrastructure to Beijing Sinnet for about $300 million. 

The person familiar with Amazon’s probe casts the sale as a choice to “hack off the diseased limb.”
As for Apple, one of the three senior insiders says that in the summer of 2015, a few weeks after it identified the malicious chips, the company started removing all Supermicro servers from its data centers, a process Apple referred to internally as “going to zero.” 

Every Supermicro server, all 7,000 or so, was replaced in a matter of weeks, the senior insider says. 

In 2016, Apple informed Supermicro that it was severing their relationship entirely—a decision a spokesman for Apple ascribed in response to Businessweek’s questions to an unrelated and relatively minor security incident.
That August, Supermicro’s CEO, Liang, revealed that the company had lost two major customers. Although he didn’t name them, one was later identified in news reports as Apple. 

He blamed competition, but his explanation was vague. 

“When customers asked for lower price, our people did not respond quickly enough,” he said on a conference call with analysts. 

Hayes, the Supermicro spokesman, says the company has never been notified of the existence of malicious chips on its motherboards by either customers or U.S. law enforcement.
Concurrent with the illicit chips’ discovery in 2015 and the unfolding investigation, Supermicro has been plagued by an accounting problem, which the company characterizes as an issue related to the timing of certain revenue recognition. 

After missing two deadlines to file quarterly and annual reports required by regulators, Supermicro was delisted from the Nasdaq on Aug. 23 of this year. 

It marked an extraordinary stumble for a company whose annual revenue had risen sharply in the previous four years, from a reported $1.5 billion in 2014 to a projected $3.2 billion this year.
One Friday in late September 2015, President Barack Obama and Chinese dictator Xi Jinping appeared together at the White House for an hourlong press conference headlined by a landmark deal on cybersecurity. 

After months of negotiations, the U.S. had extracted from China a grand promise: It would no longer support the theft by hackers of U.S. intellectual property to benefit Chinese companies. 

Left out of those pronouncements, according to a person familiar with discussions among senior officials across the U.S. government, was the White House’s deep concern that China was willing to offer this concession because it was already developing far more advanced and surreptitious forms of hacking founded on its near monopoly of the technology supply chain.
In the weeks after the agreement was announced, the U.S. government quietly raised the alarm with several dozen tech executives and investors at a small, invite-only meeting in McLean, Va., organized by the Pentagon. 

According to someone who was present, Defense Department officials briefed the technologists on a recent attack and asked them to think about creating commercial products that could detect hardware implants. 

Attendees weren’t told the name of the hardware maker involved, but it was clear to at least some in the room that it was Supermicro, the person says.
The problem under discussion wasn’t just technological. 

It spoke to decisions made decades ago to send advanced production work to Southeast Asia. 

In the intervening years, low-cost Chinese manufacturing had come to underpin the business models of many of America’s largest technology companies. 

Early on, Apple, for instance, made many of its most sophisticated electronics domestically. 

Then in 1992, it closed a state-of-the-art plant for motherboard and computer assembly in Fremont, Calif., and sent much of that work overseas.
Over the decades, the security of the supply chain became an article of faith despite repeated warnings by Western officials. 

A naive belief formed that China was unlikely to jeopardize its position as workshop to the world by letting its spies meddle in its factories. 

That left the decision about where to build commercial systems resting largely on where capacity was greatest and cheapest. 

“You end up with a classic Satan’s bargain,” one former U.S. official says. 

“You can have less supply than you want and guarantee it’s secure, or you can have the supply you need, but there will be risk. Every organization has accepted the second proposition.”
In the three years since the briefing in McLean, no commercially viable way to detect attacks like the one on Supermicro’s motherboards has emerged—or has looked likely to emerge. 

Few companies have the resources of Apple and Amazon, and it took some luck even for them to spot the problem. 

“This stuff is at the cutting edge of the cutting edge, and there is no easy technological solution,” one of the people present in McLean says. 

“You have to invest in things that the world wants. You cannot invest in things that the world is not ready to accept yet.”

The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies

Rogue Social Media

China is Using LinkedIn to Recruit Informants
By JAVIER C. HERNÁNDEZ and MELISSA EDDY

The Chinese Embassy in Berlin on Monday. German intelligence services said that more than 10,000 German citizens had been targeted by Chinese spies on LinkedIn.

BEIJING — German’s domestic intelligence agency has accused China of using LinkedIn to infiltrate the German government.
In a scathing investigation released on Sunday, the intelligence agency, the Office for the Protection of the Constitution, accused Beijing of using social media to target more than 10,000 citizens, including lawmakers and other government employees. 

To win their trust, the agency said, Chinese agents posed as leaders of think tanks and headhunters, and offered all-expenses-paid trips to China and meetings with influential clients.
The German investigation added to anxieties in Western countries about Chinese efforts to infiltrate foreign governments and businesses, in an attempt to gain a competitive advantage, especially on economic and foreign policy issues. 

The United States has accused China of rampant economic espionage. 

Australia is debating tougher laws to guard against foreign interference, amid reports that China is meddling in Australian universities and elections.
German officials said that Chinese agents had created fake profiles in hopes of “gleaning information and recruiting sources” in Germany. 

Chinese agents approached targets by saying they were interested in exchanging information or offering to establish contact for them with an expert on China, German officials said.

Hans-Georg Maassen, the president of the German intelligence agency, called the efforts “a broad attempt to infiltrate Parliaments, ministries and administrations.”
Adam M. Segal, an expert on cybersecurity and China at the Council on Foreign Relations, said the German investigation will add “more fuel to the fire of skepticism and suspicion about Chinese actions” in the West.
He said that China would probably continue to expand its digital espionage efforts despite criticism. “Given how sensitive the regime and Xi Jinping seems to be to any challenge domestically, they also want to try to control as much as they can internationally,” Mr. Segal said.

LinkedIn is one of few foreign social media companies operating in China, in part because it adheres closely to Chinese regulations and has a relatively warm relationship with the government.
Under the scheme described by German intelligence, Chinese agents used aliases like Eva Han on LinkedIn.

They used photographs from fashion magazines as their profile pictures. 

Several listed fake company names.
Once they established contact with German citizens, the Chinese agents intensified the attempted exchange, asking for a résumé and offering compensation for work on a project.

They invited Germans to China for conferences or meetings with “important clients” who never materialized. 

They pressed the targets for sensitive information in exchange for money.

The German government has repeatedly warned in recent months that China is increasing its efforts to steal trade secrets and other sensitive information from European targets.
In July, the government said that Chinese agents were seeking information about foreign and economic policy. 

It said China had targeted lawmakers and employees of the European and German Parliaments, lobbyists, members of the military and representatives of foundations and think tanks.

Is he a spy? Probably.

Chinese Spies

U.S. Congress urged to require Chinese journalists to register as agents
By David Brunnstrom

China's mole in New Zealnd: Yang Jian
Spying HQ: Xinhua serves the functions of an intelligence agency by gathering information and producing classified reports for the Chinese leadership. It had important offices at the United Nations in New York, Washington, Chicago, Los Angeles, Houston and San Francisco.

WASHINGTON -- A report to the U.S. Congress released on Wednesday accused Chinese state media entities of involvement in spying and propaganda and said their staff in the United States should be required to register as foreign agents.
The annual report of the U.S. China Economic and Security Review Commission said that while China had tightened restrictions on domestic and foreign media, Chinese state media had rapidly expanded overseas.
The commission, created by Congress in 2000 to monitor national security implications of U.S.-China trade relations, said China’s state media expansion was part of a broader effort to exert greater control over how China is depicted globally, as well as to gather information.
The report highlighted the rapid growth of the Xinhua news agency and noted that it had offices at the United Nations in New York, Washington, Chicago, Los Angeles, Houston and San Francisco.
“Xinhua serves the functions of an intelligence agency by gathering information and producing classified reports for the Chinese leadership on both domestic and international events,” the report said.
It quoted testimony to the commission by the U.S. Government-funded rights organization, Freedom House, as saying it was a “loophole” that individuals working for Xinhua and China’s People’s Daily newspaper were not covered by the Foreign Agents Registration Act.
FARA, first passed in 1938 in the lead up to World War Two to combat German propaganda efforts, requires foreign governments, political parties and lobbyists they hire in the United States to register with the Department of Justice.
The China Daily, an English-language newspaper owned by China’s government and ruling Communist Party, is already registered under FARA but only its top executives are required to individually disclose working for the publication.
A bipartisan group of U.S. lawmakers is working to overhaul FARA after Paul Manafort, former campaign manager for President Donald Trump, and a business associate were indicted for failing to register under the law.
The reform, backed by powerful Senate Judiciary Committee chairman Chuck Grassley, could provide an opportunity for Congress to act on the commission recommendations.
On Monday, the Kremlin-backed television station RT America registered under FARA after U.S. intelligence agencies in a report in January called it a “state-run propaganda machine” that contributed to the Kremlin’s campaign to interfere with last year’s U.S. presidential election.
Under the act, RT will be required to disclose financial information. 

Moscow has said it views the action against RT as an unfriendly act.

New Zealand's Chinese Moles

Sino-Kiwi MP trained by Chinese spies
By Mark Jennings and Melanie Reid

Chinese mole Jian Yang

A National Party MP who studied at an elite Chinese spy school before moving to New Zealand has attracted the interest of our Security Intelligence Service.
The list MP Jian Yang did not mention in his work or political CVs a decade he spent in the People's Liberation Army-Air Force Engineering College or the Luoyang language institute run by China's equivalent of the United States National Security Agency.
That agency, the Third Department, conducts spying activities for China.
Newsroom has been told that to have taught at the Air Force Engineering College, Yang would have been an officer in Chinese military intelligence and a member of the Communist Party, as other students and staff have been.
Yang studied and then taught there before moving to Australia where he attended the Australian National University in Canberra. 

He migrated to this country to teach international relations in the politics department at the University of Auckland.
He was hand-picked by National Party president Peter Goodfellow to become an MP on its list in 2011, wooed directly by the former Prime Minister John Key and has been a key fundraiser for National among the Chinese community in Auckland.
As an MP he variously served on Parliament's Foreign Affairs, Defence and Trade (from 2014 until last year), Commerce, Transport and Industrial Relations and Health and Science select committees and is prominent in New Zealand's interactions with the Chinese community and diplomatic and consular missions in Wellington and Auckland. 

He remains a Parliamentary Private Secretary for ethnic affairs.

Chinese mole
Newsroom has worked with the Financial Times in Hong Kong to investigate Yang's background.
We can reveal Yang confirmed in a recorded interview in Chinese with the Financial Times that he attended both military institutions.
In his comments to the FT researcher, Yang twice urged her to concentrate on the New Zealand election. 

"You don't need to write too much about myself," he said, adding later: "As for me myself, actually I don't feel it's necessary to include so many detailed things."
Interviewed today, by Newsroom, Yang refused to comment, saying repeatedly on camera: "Talk to my boss" and "I have nothing to hide". 

He then drove away.
Yang later released a statement saying he refuted "any allegations that question my loyalty to New Zealand".
The statement said he had been "nothing but upfront and transparent" about his education and employment.
Yang challenged those who were "propagating these defamatory statements" to front up and prove them.
"This is a smear campaign by nameless people who are out to damage me and the National Party 10 days from an election, just because I am Chinese."
An expert in Chinese intelligence -- Peter Mattis -- told Newsroom from the US that someone who attended and then taught at the Air Force Engineering College and attended the language institute would almost certainly have been an officer in China's PLA and member of the Communist Party.

SIS interest
New Zealand's Security Intelligence Service has scrutinised him at times over three years, including interviewing one person about him last year.
The SIS said today it would not comment on operational matters, especially investigations involving individuals.
A hearing of Parliament's Privileges Committee into intelligence surveillance protocols for MPs occurred in late 2013. 

If an intelligence agency has cause to monitor an MP, the SIS director or Inspector-General of Intelligence is to brief the Speaker of the House. 

The Privileges Committee, chaired at the time by Attorney-General Chris Finlayson, polices contempts, which can include anything that could impede or restrict the rights of MPs to conduct their business unimpeded.
A Memorandum of Understanding between the SIS and Parliament's Speaker from 2010 says: "The only circumstances in which collection may be directed against a sitting MP is where a particular MP is suspected of undertaking activities relevant to security."
It is not known if the Speaker, David Carter, or Prime Ministers John Key or Bill English, who were the ministers in charge of the SIS, have been briefed on Yang's background or the SIS interest. Comment is being sought from Bill English.
National Party President Peter Goodfellow claimed in an interview with the Financial Times this morning that Yang's education in China was widely known in New Zealand.
Goodfellow said he had “no idea” about any SIS investigation into Yang.
“He certainly gave us his full resume with the two universities – an air force academy and the other one,” Goodfellow said. 

“You’re making a number of assumptions based on his background and I’d be careful unless you have proof of what you’re saying.”
He also said Yang’s background was “covered in a review of candidates” by a government relations consultancy, Saunders Unsworth.
Interest in Yang's background precedes his moving to New Zealand. 

Officials at ANU were suspicious of his close ties to China when he worked there.
China-watchers suggest someone educated at an elite PLA Air Force Engineering College and then at the Luoyang Foreign Languages Institute would have had to be a member of the Chinese Communist Party to be allowed to stay on and teach. 

It was considered unusual for someone with intelligence connections to be allowed to leave China for Australia to study, or to have done so without the backing of the party or PLA.Jian Yang beside National leader Bill English and with 'Blue Dragons' supporters at a party policy launch. 

Hidden decade
Yang's maiden speech to Parliament did not mention his education at the military establishments, although he noted that in 1978, the year Deng Xiaoping began China's economic reforms, "I passed the newly-restored higher education examination and became part of the small group of high school graduates who went on to university".
The missing decade in Yang's CV is reflected in that speech. 

After saying he entered university in 1978, the next date he gives is: "In April 1989, a great opportunity was opened up for me when I received a scholarship to Johns Hopkins University in the United States."
The Tiananmen massacre and global controversy in June that year prevented him from leaving for that study. 

Chinese sources do not discuss where he worked for the next five years but he did attend the Johns Hopkins centre for American-Chinese study in Nanjing for one year.

Active politics
In 1994 Yang began postgraduate studies at the ANU, achieving a doctorate and then taking the job in Auckland. 

He credits professors Barry Gustafson and Raymond Miller with helping him in his political education in New Zealand and colleagues for encouraging the move from political theory to professional politics.
In his maiden speech Yang outlined the failure of socialist economic policies in China before 1978 and its success in introducing capitalism with socialist characteristics, lifting millions from poverty, encouraging entrepreneurialism, personal responsibility, and reward for achievement.
"Reflecting on the way in which China has achieved its positive change and development gives me a firm belief that the policies of the National Party are in the best interests of New Zealand," he said.
Yang's involvement in the foreign affairs and trade select committee at Parliament did not require security clearances because elected MPs are not subject to the normal public service requirements. 

He is said to be a central figure promoting and helping shape the National government's China strategy and responsible for its engagement with the New Zealand Chinese community.
In 2014, former Prime Minister John Key attended a fundraising dinner organised by Yang for wealthy ethnic Chinese voters, which the New Zealand Herald and Stuff websites reported raised $200,000 for the party's election campaign.

Studying intrigue
The emergence of Yang's study and work at the military intelligence institutions in China has intrigued China-watchers in both Australia and this country. 

The engineering college is reputedly one of China's 10 top military academies. 

The 'Luoyang Foreign Language Institute' is part of the Third Department of the Joint Staff Headquarters of the PLA -- one of two main military intelligence agencies. 

The institute, in Henan province in central China, has around 500 teaching staff for 29 languages and has had 50,000 graduates including 100 generals.
The Third Department is responsible for China's signals intelligence operations and for providing intelligence assessments based on information gathered. 

According to author Mark Stokes in his 2015 The PLA General Staff Department, Third Department, Second Bureau, linguists assigned to that section are sent to Luoyang for language training "then assigned to a Third Department bureau for mission specific technical training".
Yang is understood to have met his wife, Jane, an IT specialist, at Luoyang.
The China expert Mattis, author of the book Analysing the Chinese Military and a former staffer of the US National Bureau for Asian Research told Newsroom the Third Department covered all forms of signals intelligence.
"It could be direction finding for signals, it could be encryption, it could be trying to break the codes of other countries, other militaries -- and today that involves computer network exploitation."
Asked if it was conducting spying, he said: "Yes. This is the national signals intelligence authority that pretty much every country has. In the US it is the NSA, in the UK it is GCHQ and in Australia the National Signals Directorate."
Yang's time at Johns Hopkins Nanjing was a strong indicator of his intelligence involvement as in the era he attended many of the Chinese students were from military intelligence.
"It is certainly a signal indicator that when combined with others will cleanly identify someone as being a part of Ministry of State Security or military intelligence."

Australia and New Zealand
He said there was a plausible scenario for Yang leaving China for Australia: he is working for military intelligence, most likely China's Second Department, dealing in human intelligence.

Since coming to New Zealand in 1999, Yang had been active in semi-official New Zealand discussions and events with China, Japan and Southeast Asian countries.
In the National Party, Yang is prominent with a large group of Chinese members calling themselves the Blue Dragons and campaigning enthusiastically at events during this campaign, including National's launch at the Trusts Stadium in Henderson on August 27.
Asked if it was unusual internationally for someone with a military intelligence background in one country to be an MP in another, Mattis said: "It is something I would have hoped that his colleagues in the National Party would have put to him in the vetting process ... because certainly on its face, it would be quite disconcerting."
"There are countries with whom we are friendly, but there are no friendly intelligence services."