◆ SIX ◆

Espionage during China’s Rise

Far more espionage cases are available for examination after 1989. This genuine upsurge of activity seems driven by a growing foreign presence in China and increasing opportunities for the PRC services (and probably tasking from the CCP) to gather intelligence abroad. While there are more cases to examine, the details are less available than for the historic set (see chapter 5). Intelligence officials from China and elsewhere strive to protect sources and methods from each other and wish to avoid upsetting commercial and diplomatic relations between an economically vibrant China and its trading partners.

The cases in chapters 4, 5, and 6 show significant continuity in Chinese espionage methods, which are largely similar to those used by other professional intelligence services. For example, these cases indicate that PRC intelligence services seek opportunities stemming from personal compromises by targeted individuals, be they sexual or otherwise; that Chinese intelligence professionals do not limit themselves to recruiting Chinese alone; and that there is significant interest in acquiring not only national secrets but also foreign technology and intellectual property of value to China’s economy and national defense. The latter includes both dual-use technology and other critical data to assist Chinese planners in fulfilling PRC Five-Year Plan goals.¹ Therefore, not only national leaders but also business executives should understand the risk of losing competitive advantage to CCP-sponsored technology acquisition operations.

This traditional spying has not gone away (and never will), though today’s headlines are dominated by cyber theft. Even on the computer screen, there is a link to the past. Network intrusions by the famous former PLA Third Department Unit 61398 (61398 部队, budui) targeted information reminiscent of that sought by spies of earlier eras: biographical data on persons of interest, classified material, and technology useful to military modernization. So much espionage activity has shifted to the digital world because that is where the information resides. CCP intelligence operations during the Anti-Japanese War (1937–45) focused on China’s largest cities because that was where the Japanese and the Nationalists had their headquarters and kept their secrets. So too do 61398, Shady RAT, and their brethren concentrate on the overseas computer networks where the information Beijing desires is stored in quantities unimaginable during the predigital age. Not only are the amounts of data vast, but also the operational sophistication of China’s hackers continues to grow.

The most notable aspect of China’s recent intelligence operations is the integration of traditional human agent operations with capabilities in cyberspace. At nearly every phase of intelligence collection, the Ministry of State Security and military intelligence are capable of using computer network exploitation to supplement traditional human intelligence and vice versa. Previously, Chinese intelligence relentlessly gathered dossiers on potential targets by interviewing retired foreign government officials, their friends, and their families. Building this database of names enabled the rapid identification of potential targets for recruitment as they traveled to and from China. These means, however, have been supplemented by the hacking of foreign databases to acquire personal data en masse. The MSS theft of data from Taiwanese residential databases and the U.S. Office of Personnel Management are only the examples that are publicly known. Criminal indictments issued by the U.S. Department of Justice in September and October 2018 show intelligence officers from the Jiangsu State Security Department ran a network of human sources and hackers to acquire foreign aviation technology. The corporate insiders recruited by this MSS department both facilitated access to foreign networks and helped cover up MSS activity on the internal networks. It is this combination of human and technical means that demonstrates China’s intelligence activities have achieved world-class status.

Anonymous German Member of Parliament (pitched summer 2016)

An unnamed member of parliament (MP) received a message through the social networking site LinkedIn from a Chinese manager named “Jason Wang.” Wang sought to engage the MP in a consulting agreement for analysis of German foreign policy and domestic politics. After exchanging several messages, Wang offered €30,000 as the beginning payment for responses to a set of questions. The Federal Office for the Protection of the Constitution intervened prior to any payment being made to the MP but reportedly not before he provided the Ministry of State Security (MSS) with some initial thoughts on German policy and politics.²

Anonymous Japanese Communicator (pitched 2003–4)

An unnamed Japanese code clerk based at the consulate in Shanghai committed suicide in May 2004 after being pressured by the Shanghai State Security Bureau (SSSB) to provide information on his colleagues and consular communications. The SSSB exploited the clerk’s affair with a woman working at a karaoke bar by approaching her in 2003 and then pressuring him to provide personal details on his colleagues, the consulate’s Chinese contacts, and the schedule for diplomatic pouches sent back to Tokyo.³

Anonymous U.S. Academic Researcher (pitched 2011–12)

A U.S. academic researcher with a senior fellow position with a Washington, DC–based think tank received an approach from a provincial state security department following a lecture in the provincial capital. The MSS officer was covered as a research fellow at the provincial academy of social sciences. Over the weeks following the lecture, the officer reached out via phone and email to arrange a meeting in person where the U.S. scholar was based. At this meeting, the officer offered him several thousand Chinese yuan as a down payment on a consulting arrangement. The scholar would write analytic papers based on his contacts and interviews with colleagues and contacts in Washington, DC, in response to prompts from the officer. He rejected the pitch.⁴

Bergersen, Gregg (arrested 2008, pleaded guilty 2008)

Gregg Bergersen worked for the Defense Security Cooperation Agency (DSCA) on its East Asia portfolio, including Taiwan. He became involved with Chinese intelligence through Kuo Tai-shen. The first recorded meeting between the two was in early 2007. Kuo presented himself as a businessman looking to get involved in U.S. military sales to Taiwan. He led Bergersen to believe that he worked for Taiwan’s ministry of national defense (though a PRC official based in Guangzhou was Kuo’s real controller) and held out a job offer with a six-figure salary for when Bergersen retired from the Department of Defense. The relationship was cemented with a paid trip to Las Vegas and cash payments. Bergersen provided classified data on U.S. defense systems and policy, and the two conspired to form a company to transfer U.S.-made command, control, communications, computers, intelligence, surveillance, and reconnaissance systems to Taiwan. Shortly after his arrest, Gregg Bergersen pleaded guilty and was sentenced to five years in prison.⁵

Bishop, Benjamin Pierce (sentenced 2014)

Lt. Col. Benjamin Bishop, USA (Ret.), met Claudia He, a PRC national, at an international military conference in Hawaii. The two began a romantic relationship in 2011, and Bishop began communicating classified information by email and phone to her. Claudia He was a PhD student at Tsinghua University and in the United States was a visiting fellow researching international relations and military strategy. Unbeknownst to Bishop, she was also in contact with the MSS when she visited Beijing. The MSS paid her several thousand dollars to write interview-based papers on U.S. defense partnerships, nuclear issues, and Asia-Pacific strategy, based in part on her contact with Bishop. Bishop pleaded guilty to communicating classified national defense information to an unauthorized person and unlawfully retaining classified national defense papers. A federal court sentenced him to seven years in prison.⁶

Chang Chih-hsin (張祉鑫; recruited 2010, arrested 2012)

Commander Chang Chih-hsin of the Taiwan navy was the chief political warfare officer at the naval meteorology and oceanography office when he was recruited by Chien Ching-kuo and Lu Chun-chun in 2010 or 2011. That year Chien and Lu took Chang on a trip to Cebu in the Philippines where he was introduced to Chinese intelligence officers. Chang’s materials for his handlers is unknown, but he did have access to a broad set of data related to meteorological and oceanographic battle environments that he may have passed. He also agreed to assist Chinese intelligence in spotting and recruiting other active-duty military officers. Following his retirement in 2012, Chang met with Chinese intelligence officers in Fuzhou and Xiamen while on tours to China. Taiwan’s supreme court upheld his fifteen-year prison sentence in 2014.⁷

Chen Chu-fan (陳築藩; recruited after 2004, convicted 2013, overturned 2016)

Lieutenant General Chen Chu-fan was the deputy commander of Taiwan’s military police command and a high-ranking Kuomintang official who spied for the Shanghai State Security Bureau (SSSB). Chen was influential in Kuomintang political and military circles, having served as the ministry of national defense legislative liaison and deputy director of the Kuomintang’s Taipei City chapter. After his retirement in 2004, he began traveling to China and sometime thereafter came into contact with the SSSB. He agreed to assist the SSSB in recruiting a spy network inside Taiwan and introduced former Military Intelligence Bureau officer Chen Shu-lung to the SSSB. The two Chens sold documents to Chinese intelligence related to military troop deployments and planning, military exercises, election analysis, and Falun Gong activities in Taiwan. Taiwanese courts sentenced Chen to twenty months in prison in 2013 and upheld the sentence on appeal in 2014, but the sentence was overturned in 2016.⁸

Chen Shu-lung (陳蜀龍; recruited 2006, convicted 2013)

Chen Shu-lung was a retired Taiwanese army major who worked for the Military Intelligence Bureau. In 2006, Chen was approached by retired Lieutenant General Chen Chu-fan on behalf of the SSSB, and he began spying for China. It is unclear whether Chen actually met SSSB officers or whether General Chen was his sole point of contact. The two Chens sold Chinese intelligence documents related to military troop deployments and planning, military exercises, election analysis, and Falun Gong activities in Taiwan.⁹ Chen Shu-lung also sold the identities of Military Intelligence Bureau and National Security Bureau officers. He tricked one such officer into visiting Shanghai, where the officer was detained and interrogated by the MSS for three days in 2007. In 2013 a Taiwanese court sentenced Chen to eight years in prison but reduced the sentence to five years on appeal in 2014.¹⁰

Chen Wen-jen (陳文仁; recruited 1990s, arrested 2012)

Chen Wen-jen was discharged from the Taiwan air force as a lieutenant in 1992 and moved to China sometime thereafter. He went into business and married a Chinese citizen before he was recruited by 2PLA. Chen reconnected with an active-duty air force colleague, Yuan Hsiao-feng, in 2001. The two sold classified data to 2PLA, conveyed in flash drives, until 2007. Taiwanese authorities began investigating Chen and Yuan in 2011 after they attempted to recruit two junior officers. Chen was rumored to have recruited another officer who provided data on Taiwanese combat aircraft. In 2013 a Taiwan court sentenced Chen to twenty years in prison because his espionage occurred after he retired from the air force.¹¹

Chien Ching-kuo (錢經國; recruited 2009, sentenced 2013)

Following his retirement from the Taiwan navy in 2009, former lieutenant Chien Ching-kuo was recruited by Lu Chun-chun and introduced to Chinese intelligence on an all-expenses-paid trip to Bali, Indonesia. Chien operated a barbecue restaurant in Taipei after his retirement, which he used for meetings with potential Taiwanese sources. He provided classified information to China relating to Taiwanese plans to send naval vessels to the Horn of Africa for antipiracy missions. The plans ultimately did not come to fruition. In addition, he assisted Chinese intelligence in spotting and recruiting other Taiwanese security officials. Chinese intelligence treated him to overseas trips. They also arranged formal CCP status for Chien in 2011. He joined Lu on some of these trips, where he assisted Chinese intelligence in recruiting other sources, such as Chang Chih-hsin. A Taiwanese court sentenced him to three years in prison.¹²

Chou Chih-li (周自立; arrested 2015)

Taiwan air force colonel Chou Chih-li was arrested as part of Zhen Xiaojiang’s spy ring in 2015 alongside three other current or former military officers. There is no evidence that Chou spied while he was in uniform. He contacted serving Taiwanese military officers on behalf of Zhen and attempted to acquire classified defense information.¹³

Chun, Kun Shan (recruited 2011, sentenced 2017)

Kun Shan Chun was a naturalized U.S. citizen working as an electronic technician for the FBI. Chun began working for the FBI New York field office as a technician in 1997 and received a top-secret clearance the following year in connection with his work. In 2006 Chun and his family developed contacts with businesspeople associated with Zhuhai Kolion Technology Company Ltd. (Kolion), possibly because some of Chun’s family members invested in the company. Kolion repeatedly asked Chun between 2006 and 2010 to perform consulting tasks in exchange for payment or international trips. In 2011 Kolion representatives introduced Chun to a Chinese official, who is unidentified in public documents, while Chun was on a trip to France and Italy partly financed by Kolion. The official, who appears to have been an intelligence officer, tasked Chun with providing details on the FBI’s internal organization, how to identify traveling FBI agents, and the FBI’s surveillance technology. This official only met Chun outside the United States.¹⁴ Chun was sentenced two years in prison in 2017 after pleading guilty to acting as unregistered agent of a foreign power.¹⁵

Claiborne, Candice (contacted 2003–5, arrested 2017)

Candice Claiborne was an office management specialist at the U.S. Department of State recruited by the SSSB. The criminal affidavit suggests Claiborne met the SSSB officers in Shanghai while she was posted there from 2003 to 2005 and assigned to the consul general. The SSSB arguably did not recruit her in the normal sense but acquired leverage through supporting her son (identified in the affidavit as coconspirator A). Most of the support (cash, personal electronics, meals, international travel and vacations, tuition at a Chinese fashion school, a furnished apartment, and a monthly stipend) went to Claiborne’s son. As she apparently balked at the tasking given to her by the SSSB and tried to warn her son away from the SSSB officers, their relationship and her son’s presence in Shanghai kept her connected. Claiborne may have been a reluctant participant near her arrest in 2017, but her earlier diary entries suggested someone enticed by the promise of making an additional $20,000 per year and happy with the smaller payments she already earned.¹⁶ She pleaded not guilty in 2017 and is awaiting trial as of this writing.

Co-optee (Cut-out)

Counterintelligence officials in several countries have noticed frequent Chinese use of civilian collaborators to enable foreign intelligence operations. The FBI defines them as “mutually trusted person[s] or mechanism[s] used to create a compartment between members of an operation to enable them to pass material and/or messages securely. A cut-out or co-optee can operate under a variety of covers, posing as diplomats, journalists, academics, or business people both at home and abroad. These individuals are tasked with spotting, assessing, targeting, collecting, and running sources.”¹⁷ Examples may include Zhen Xiaojiang and Zhou Hongxu.

Doumitt, Paul (pitched 1988)

Paul Doumitt was a married, forty-five-year-old U.S. Embassy communications officer based in Beijing who was pitched by the MSS. Doumitt began a long-term romantic relationship with a young Chinese shopkeeper while his wife was in France taking care of her sick mother. MSS officers confronted Doumitt in a shop across the street from that of his mistress. They threatened to expose graphic details of the affair to his wife and embassy colleagues, demanding that he identify U.S. intelligence officers serving at the embassy. Doumitt claimed he identified diplomatic security officers serving openly in the regional security office—who manage the embassy’s overall security arrangements and threats to U.S. government personnel abroad—as potential intelligence officers. He reported the meeting to the regional security office, and then-Ambassador Winston Lord sent him home.¹⁸

Fondren, James (recruited 1999, convicted 2009)

Col. James Fondren, USA (Ret.), worked as an independent consultant after his retirement. At the time of his arrest, he was deputy director of the Washington, DC, liaison office of U.S. Pacific Command (PACOM). Fondren served in this position from 2001 to 2008 and was convicted of passing defense secrets between 2004 and 2008. He was recruited by Kuo Tai-shen in the 1990s. Kuo introduced Fondren to his case officer, Lin Hong, in 1999, giving Fondren no doubt that a Chinese official received the consulting reports he wrote for Kuo. Kuo and Fondren hid their espionage relationship in a consulting business, but Kuo was the latter’s only customer. Fondren typically sold his opinion papers to Kuo for $350 to $800 apiece. While employed by PACOM, he routinely shared classified and unclassified documents with Kuo, including drafts of the annual Pentagon report on Chinese military power. In 2010 Fondren was sentenced to three years in prison after being convicted in a five-day trial in 2009.¹⁹

Gao Xiaoming “Helen” (detained 2010, not prosecuted)

Gao Xiaoming, a contract translator for the U.S. Department of State between 2010 and 2014, confessed to providing information on her colleagues and their activities. A person whom she believed to be an intelligence officer approached her in China in 2007, asking her to provide information on her social contacts in the United States. She was given a one-time payment of $6,000 at the time and claimed she was wired $5,000 in January 2010. She later lived “briefly for free” with an architect who possessed a top-secret clearance for his work designing U.S. embassy facilities for the State Department. That employee admitted to discussing his work on U.S. facilities and his State Department colleagues by name. During her background check for her State Department contract and her U.S. naturalization paperwork, Gao concealed her relationship with the Chinese intelligence officer. For unknown reasons, U.S. authorities declined to prosecute the case either on charges related to being an unregistered agent or related to lying on immigration and security paperwork.²⁰

Gyantsan, Dorjee (recruited by 2015, convicted 2018)

Dorjee Gyantsan was a pro-Tibetan radio station worker living in Sweden who provided Chinese intelligence with information on other Tibetan exiles. The circumstances of Gyantsan’s recruitment are unknown, but he did receive small payments (the highest reportedly was $6,000) and had his expenses reimbursed. Gyantsan provided personal information about Tibetans living abroad, such as where they lived, their family ties, and their political activities, when he met with his Chinese case officer in Poland. The Swedish authorities claimed two case officers handled Gyantsan, including a diplomat attached to the Chinese embassy in Poland and a Sweden-based journalist for the official paper China Daily.²¹ A Swedish court sentenced him to twenty-two months in jail.²²

Hansen, Ron Rockwell (arrested 2018)

Ron Hansen was a former intelligence officer with the U.S. Army and a case officer for the Defense Intelligence Agency (DIA). After his retirement from active duty in 2006, Hansen became a member of H-11 Digital Forensics Company and H-11 Digital Forensics Services. As part of his Asia-related business, he maintained an office and an apartment in China. One of his office partners, going by the name “Robert,” maintained connection with China’s intelligence services. Although he was employed in the private sector, Hansen continued as an intelligence contractor involved in human intelligence operations for DIA until 2011. Hansen began trying to rejoin the DIA in early 2012, contacting a string of former colleagues and congressional staff through 2016. The FBI began investigating him in 2014, and he agreed to nine voluntary meetings with the bureau. He told them in early 2014 that two MSS officers began meeting with him in Beijing and that his partner “Robert” made the arrangements. A third MSS officer, “Max Tong,” made the introduction after serving as an MSS contact since 2011. In their pitch, the two MSS officers offered $300,000 per year for “consulting services” and began overpaying Hansen for computer forensics products. After this meeting, “Robert” no longer served as an intermediary. The officers gave Hansen a preprogrammed cell phone for him to use inside China to arrange meetings with his handlers. Hansen and his MSS handlers also refined their method of transferring money. Previously he had received cash, but he had been caught by U.S. Customs for not declaring currency in excess of $10,000. In 2016 they began processing payments to a Visa merchant account related to a company Hansen owned. The MSS handled roughly $200,000 in payments this way until Hansen’s arrest in 2018. He provided the MSS with information on his former colleagues, analytic products based on classified materials, and export-controlled computer forensics equipment. In June 2018 Hansen was arrested and charged with fifteen counts related to espionage, money laundering, and export control violations.²³

He, Claudia (not prosecuted)

Claudia He was a PhD student at a Chinese university researching international security issues. The MSS paid He to write papers on U.S. defense issues and strategy toward China based on her contacts while she was in the United States as a visiting fellow at the University of Maryland and sleeping with defense contractor Benjamin Bishop.²⁴ See Benjamin Pierce Bishop.

Ho Chih-chiang (何志強; recruited 2007, arrested 2010)

Ho Chih-chiang was a China-based Taiwanese businessman who was recruited in 2007 to assist Chinese intelligence in spotting and recruiting other Taiwanese sources. Chinese intelligence paid Ho and offered other unspecified privileges for his business inside China. During a trip to Taiwan, Ho made a failed recruitment of a National Security Bureau (NSB) officer in which he offered $20,000, expensive liquor, and promise of regular pay higher than an NSB pension. Ho asked the NSB officer for information relating to the service’s overseas deployments, satellite communications, and Taipei’s policies toward Falun Gong, Tibetan independence, and Japan.²⁵

Hsieh Chia-kang (謝嘉康; recruited 2009–10, arrested 2017)

Major General Hsieh Chia-kang was the deputy commander of the Matsu defense command at the time of his arrest. When the investigation into his spying began, Hsieh was moved from his position as commander of the missile defense command, where he had access to technical details for the U.S.-made MIM-104F Patriot missile and the domestically developed Tien-Kung III and Hsiung-Feng 2E cruise missiles. Retired Taiwan army colonel Hsin Peng-sheng allegedly brought Hsieh into contact with Chinese intelligence, who recruited the general in 2009 or 2010. Hsieh met his handlers in Malaysia and Thailand. Taiwanese investigators were not clear whether Hsieh had been paid in exchange for providing classified defense information and helping recruit other Taiwanese military officers. A fellow military officer told security officials about the connection between Hsieh and someone recruited by Chinese intelligence.²⁷

Hsin Peng-sheng (辛澎生; recruited 2016, arrested 2017)

Retired Taiwan army colonel Hsin Peng-sheng worked in the travel industry, and Chinese intelligence recruited him in 2016 while he was leading a Taiwanese tour group to China. Hsin agreed to assist Chinese intelligence in finding and recruiting other Taiwanese sources and recruited Major General Hsieh Chia-kang, with whom he had previously served. Unspecified sources told the Ministry of Justice Investigation Bureau in 2016 that Hsin had been recruited, prompting the investigation that led to Hsin and Hsieh.²⁶

Hsu Nai-chuan (許乃權; arrested 2015)

Taiwan army major general Hsu Nai-chuan was the highest-ranking officer implicated in the Zhen Xiaojiang spy ring. He served as the commander of both the Kinmen and Matsu defense commands and commander of the Kaohsiung military academy. He also had been a candidate for Kinmen magistrate. He was sentenced to three years in prison, which was reduced by two months on appeal. The high court ruled that his efforts to build Zhen’s spy network only qualified as “attempts at” rather than acts of espionage.²⁸

Jiangsu State Security Department

The Jiangsu State Security Department (JSSD) is the Jiangsu provinciallevel department of the MSS. In September and October 2018 the U.S. Department of Justice released criminal complaints and indictments related to the JSSD’s worldwide efforts from 2010 to 2015 to acquire the underlying technology related to a turbofan engine used for U.S.- and European-made commercial aircraft. The JSSD operation involved Chinese intelligence officers using a combination of human agents recruited inside foreign aerospace manufacturing companies and outside hackers to gain access to the targeted companies’ networks. JSSD officers also employed a Chinese graduate student in the United States to run background checks on potential recruitment targets and may have directed him to join the U.S. Army Reserves. The United States lured Xu Yanjun, a JSSD deputy division director involved in the operation, to Belgium, where he was arrested and extradited. Xu had presented himself as a representative of the Jiangsu Science and Technology Promotion Association to bring foreign experts and employees of the targeted companies to China. While in China, the JSSD would attempt to acquire documents or other pertinent technical information from the visitors in exchange for travel expenses and modest honoraria. The JSSD officers, like Xu, maintained close contact with researchers from the Nanjing University of Aeronautics and Astronomics (南京航空航天大学) about aviation technology and even accompanied university staff on travel.²⁹

Ko Cheng-sheng (柯政盛; recruited 1998, arrested 2013)

Vice Admiral Ko Cheng-sheng served as deputy commander of Taiwan’s navy from 2000 to 2003. Australian-Taiwanese businessman Shen Pingkang recruited Ko on behalf of Chinese intelligence in 1998. To hide the relationship, Shen paid for Ko and his family to travel to Australia. From there, Ko and Shen would travel to China together to meet with their handlers. It is unclear whether military intelligence or the United Front Work Department recruited the pair. Taiwanese authorities could not provide a clear accounting of what Ko betrayed to China. After Ko’s retirement in 2003, he attempted to recruit several younger officers. A Taiwanese court sentenced him to fourteen months in prison in 2014, possibly taking into account Ko’s age and cooperation.³⁰

Ko Chi-hsien (葛季賢; indicted 2015, convicted 2017)

Retired Taiwan air force officer Ko Chi-hsien was one of several air force officers implicated in the Zhen Xiaojiang spy ring. He previously served as deputy commander of the air force academy flight training command.³¹ In 1990 Ko was one of four F-104G pilots involved in a tense confrontation over the Taiwan Strait when Chinese fighters intercepted two Taiwanese RF-104G reconnaissance planes. He was regarded as a hero for his role in getting the Chinese interceptors to back off the reconnaissance planes.³² A Taiwanese court sentenced Ko to three to ten years in prison.

Kuo Tai-shen (arrested 2008, pleaded guilty 2008)

Kuo Tai-shen was a Louisiana-based furniture importer and naturalized Taiwanese American who served as the principal agent between the 2PLA and his sources James Fondren and Gregg Bergersen. As Kuo began doing business in China in the early 1990s, a Chinese friend introduced him to Lin Hong of the Guangzhou Friendship Association as “someone [Kuo] needed to know to do business in China.”³³ No public information is available on how the relationship subsequently developed. They used Kuo’s mistress, Kang Rixin, as an intermediary and met in her Beijing apartment rented by Kuo. In 2007 Kuo and Lin began using commercial encryption to communicate via email.³⁴ Initially, Kuo’s intelligence value was his marriage to an old Kuomintang family in Taiwan. In 1996 he met Fondren, a retired U.S. Air Force lieutenant colonel. Two years later, Kuo began paying Fondren for consulting services. He also introduced Fondren to Lin in 1999. Fondren’s reports became more valuable in 2001 when he became the deputy director of the U.S. Pacific Command liaison office in Washington, DC. Kuo continued to handle Fondren until his arrest, and, as part of his own plea, he testified against Fondren in his 2009 trial.³⁵ Kuo also developed Bergersen, another Defense Department source, who worked on Asian issues for the Defense Security Cooperation Agency (DSCA). Although Kuo’s case officer never seemed enthusiastic about Bergersen, Kuo sought to use Bergersen to get a contract for transferring U.S. technology to Taiwan in support of the Po Sheng program. He acted as Bergersen’s case officer, wining and dining him as well as treating him to a gambling trip in Las Vegas in 2007. In return, Bergersen gave him access to DSCA documents, some of which were classified, on U.S.-Taiwan military cooperation. After his arrest in 2008, Kuo pleaded guilty and was sentenced to more than fifteen years in prison.³⁶

Lee, Jerry Chun Shing (arrested 2018)

Jerry Chun Shing Lee is a former CIA case officer who retired in 2007 and was recruited by the MSS’s Guangdong State Security Department in 2010. According to the affidavit, two MSS officers approached Lee in Shenzhen to offer $100,000. They told him they knew his background and “were in the same line of work” before offering to take care of him for life. Less than a month later, the MSS officers began tasking Lee to collect CIA and national defense information. During a trip to the United States in 2012, U.S. investigators searched Lee’s belongings to find notebooks containing classified information about agents recruited by the CIA, agency operational facilities, meeting locations, and operational phone numbers. Lee also provided information about another retired case officer, and the MSS appears to have used that information to approach the case officer in 2013. Lee and his MSS handlers communicated through a series of separate email accounts and phone numbers as well as one of Lee’s business associates. The FBI arrested Lee in January 2018.³⁷

Leung, Katrina (recruited 1984, arrested 2003)

Katrina Leung is a Chinese American businesswoman and civic leader recruited by FBI agent James J. Smith in 1982 to report on her contacts and conversations in China. Between 1982 and 2000, the FBI paid Leung $1.7 million for her reporting on Chinese politics, military, and efforts to influence U.S. elections. Her reporting was eventually disseminated directly to policymakers at the White House and the National Security Council.³⁸ She first came to the FBI’s attention in 1981 due to her proximity and relationship to several subjects of a bureau investigation into illicit technology transfers. The FBI attempted to run Leung as a double agent, and in 1984 the MSS recruited her during one of her frequent trips to China. Her case officer Mao Guohua directed her to open a separate post office box for their communications. The full extent of her relationship to the MSS is unknown, but the first documented instance of passing classified information to the ministry without approval occurred in 1990 when the FBI received a report that Leung alerted the MSS to sensitive technical and counterintelligence operations. This was the first of several incidents that suggested Leung had turned on the FBI, and the bureau allowed her handler J. J. Smith to address the issues himself. Problematically, Leung and Smith began sleeping together in 1983 and continued to do so up until their arrests in 2003. Sometime in the 1990s, Smith started sharing operational details with Leung and consulting her on other U.S. intelligence community operations. During their liaisons she examined and copied classified documents from Smith’s briefcase for the MSS. Consequently, Leung probably betrayed nearly every U.S. operation and investigation of which the FBI’s Los Angeles field office was aware. The FBI received a report in 2000 that identified Smith, who would soon retire, as the likely source of the problems.³⁹ The subsequent investigation began slowly, and the FBI arrested the pair in 2003. A federal court dismissed all charges against Leung in 2005, because the judge believed the U.S. government had “irreversibly prejudiced” Leung’s ability to mount a defense in its plea agreement with Smith.⁴⁰

Li Zhihao (李志豪; arrested 1999)

Dubbed the most famous communist double agent ever to infiltrate Taiwan’s military intelligence bureau, Li betrayed at least three of the bureau’s agents on the Chinese mainland before being apprehended in 1999. Li staged an escape by swimming to Hong Kong in the late 1980s, apparently at the direction of the Guangdong State Security Bureau. He was eventually recruited by Taiwan intelligence, which did not discover Li’s true loyalties for a decade. In 1999 a Taiwan court sentenced him to life in prison. In 2015 Taipei appeared to trade Li back to Beijing in exchange for the release of two military intelligence bureau officers, Chu Kung-hsun and Hsu Chang-kuo, whom Chinese intelligence kidnapped from Vietnam in 2006. Taiwanese authorities, however, denied there was an explicit trade. Shortly afterward on November 7, 2015, CCP leader Xi Jinping and KMT leader Ma Ying-jeou conducted a scheduled meeting in Singapore.⁴¹

Liu Chi-ju (劉其儒; indicted 2015)

Liu Chi-ju is a retired Taiwan air force officer who was connected to the Zhen Xiaojiang ring. He served as an intermediary between Zhen and two other sources, Ko Chi-hsien and Lou Wen-ching, whom he had been instrumental in recruiting. Although Liu was indicted, his whereabouts are unknown, and he presumably stayed in China where he has business interests.⁴²

Lo Hsien-che (羅賢哲; recruited 2004, sentenced 2011)

Brigadier General Lo Hsien-che was serving as the chief of Taiwan army electronic information when Taiwanese authorities arrested him in February 2011 for spying for China. Lo was recruited by 2PLA while he served as a defense attaché in Thailand. According to Taiwanese sources, the recruiting officer was a 2PLA secret line officer who had served in Washington, DC, covered as a commercial officer in the embassy.⁴³ Lo’s primary handler was a female Chinese intelligence officer who lived in Thailand and possessed Australian citizenship. This woman traveled frequently between Thailand, Australia, China, and the United States and maintained contact with Lo over the Internet after he returned to Taiwan in 2005. Some reports suggest she acted as a honey trap (see meiren ji in the web-based glossary). Lo was paid by 2PLA $100,000 to $200,000 per delivery of classified information.⁴⁴

U.S. intelligence confronted Lo during a visit to the United States in August 2010. Lo claimed that he was forced to confess his activities on video and that the Americans turned the file over to Taiwan authorities after he refused to act as a double agent. Because of his confession, Lo was sentenced in 2011 to life in prison rather than execution.⁴⁵

Lu Chun-chun (盧俊均; recruited before 2009, arrested 2014)

Lu Chun-chun was a Taiwanese officer whose last military post was at the missile command center in 2005. Following his retirement, Lu joined friends in a China-based business venture where his contacts in the Xiamen municipal government introduced him to Chinese intelligence officers. Lu also recruited Chien Ching-kuo in 2009 with cash gifts and an all-expenses paid trip to Bali, Indonesia, where Chien was introduced to Chinese intelligence officers. Lu and Chien together recruited Chang Chih-hsin and introduced him to Chinese intelligence in Cebu, Philippines. The pair attempted to recruit at least three other Taiwanese officials in this way. It is unclear what other information or services Lu provided to Chinese intelligence. Lu received a three-year suspended sentence because he did not have a criminal record.⁴⁶

Maihesuti, Baibur (recruited 2008, convicted 2010)

Baibur Maihesuti was a naturalized Swedish citizen of Uighur descent who reported personal details, contact information, travels, and political leanings of other Uighurs primarily in Europe. Maihesuti joined the World Uighur Congress to spy on its membership, and he also reported on other Chinese exiles of interest to Beijing. The two MSS officers who recruited and handled him worked from the Chinese embassy in Stockholm under journalistic and diplomatic cover. The MSS paid Maihesuti in both cash and unspecified services. They used a covert telephonic system to communicate with Maihesuti. In 2010 Swedish authorities sentenced him to sixteen months in prison.⁴⁷ This is one of the few cases known to have been conducted completely outside China.

Mak, Chi (麦大志; convicted 2007)

Chi Mak was a naturalized American citizen who came to the United States via Hong Kong. From his emigration in the 1960s to the British colony, Mak maintained a relationship with military intelligence, probably 2PLA. In Hong Kong, he reportedly kept logs of U.S. and other naval vessels docking in the harbor. Mak came to the United States in 1978 and was naturalized as a citizen in 1985. During the years between arriving in the United States and acquiring a security clearance in 1996, his intelligence activities are not clear. In 1987 a relative of Mak’s wife working for the ministry of aviation asked Mak to serve as a conduit for Greg Dongfan Chung (chapter 4) to send information back to China, because the Mak channel was safer than others.⁴⁸ After Mak acquired a secret clearance while working for L-3 subsidiary Power Paragon on U.S. Navy projects, he began providing a wide range of export-controlled, but not necessarily classified, technical information to Chinese military intelligence. Among the files were data on submarine electronics, the quiet electric drive for the Virginia-class submarine, an electromagnetic aircraft launch system for aircraft carriers, and the Aegis combat system with its associated command and control systems. Mak used his family members, most notably his brother Tai Mak, as couriers. The Maks appeared to be ideologically motivated, and the only direct compensation was that Mak’s case officer looked after Tai Mak’s mother-in-law. Tai Mak and his wife were arrested at Los Angeles International Airport in late 2005 as they prepared to leave for Hong Kong in possession of CDs with encrypted data intended for the PLA. Mak was arrested shortly thereafter. In 2008 a federal court sentenced Mak to twenty-four years for export control violations, being an agent of a foreign power, and lying to federal agents.⁴⁹

Mak Tai-wang (sentenced 2008)

Tai Mak, as he is usually known, is the younger brother of Chi Mak and acted as the latter’s courier to 2PLA. He came to the United States via Hong Kong in 2001, and he worked as a broadcast engineer for Phoenix Television, which is closely connected to the Chinese party-state. According to some reports, Tai Mak also was a PLA officer or had another formal affiliation with the military.⁵⁰ The FBI arrested Tai Mak and his wife at Los Angeles International Airport in late 2005 as they attempted to fly to Hong Kong with CDs containing technical data collected by Chi Mak and encrypted by his son Billy Mak. In 2008 a federal court sentenced Tai Mak to ten years in prison for his role in supporting his brother’s espionage.

Mallory, Kevin (recruited 2017, convicted 2018)

Kevin Mallory was a defense contractor and former CIA operations officer who sold classified documents to the SSSB. He met with the SSSB in China under the guise of academic exchange with the Shanghai Academy of Social Sciences. During meetings in March and April 2017, Mallory sold eight classified documents for $25,000. He also wrote two white papers on U.S. policy at the request of his handlers. The SSSB officers provided him with a cell phone with an encrypted messaging app installed for communication and transferring files as well as SD cards. Mr. Mallory had a long career with the U.S. government, including stints in the Army (1981–86), the State Department Diplomatic Security Service (1987–90), and several active-duty assignments as a reservist, holding an active security clearance through 2012. He was found guilty in June 2018 for lying to investigators and providing defense information to aid a foreign government.⁵¹

Shanghai State Security Bureau

The SSSB is the MSS element responsible for intelligence and counterintelligence operations in Shanghai municipality. Unlike many of the provincial and local MSS units, the SSSB runs clandestine agent operations against foreign countries inside and outside China. It is known for being one of the most active units operating against the United States. The SSSB was created no later than 1985, but it was not part of the original MSS organization created in 1983. Many of the cover organizations used in SSSB operations are throwaway corporate outfits, such as the Shanghai Pacific and International Strategy Consulting Company used to approach Nate Thayer, but it does use the Shanghai Academy of Social Sciences to provide operational cover for its officers and hide the operational purpose behind a source’s travel to China.⁵² See Anonymous Japanese Communicator; Claiborne, Candice; Mallory, Kevin; Shriver, Glenn Duffie; Thayer, Nate.

Shen Ping-kang (沈秉康; recruited 1998, arrested 2013)

Shen Ping-kang is a Taiwanese businessman with Australian citizenship who served as a go-between for Chinese military intelligence and Admiral Ko Cheng-sheng. Because of his cross-strait business, Shen came into contact with the 2PLA and the PLA’s political warfare officers. Shen’s Chinese contacts learned of his relationship to Admiral Ko and recruited him as a pathway to Ko. Between 1998 and 2007 Shen paid for several all-expense paid trips for Ko and his family to Australia, from where Shen and Ko would then would travel to China. News reports were unclear whether it was military intelligence or the United Front Work Department that recruited Shen. He was sentenced to twelve months in prison in 2014.⁵³

Shriver, Glenn Duffie (recruited 2004, pleaded guilty 2010)

Glenn Duffie Shriver was a recent college graduate when the SSSB recruited him in 2004. He responded to a call for papers on U.S.-China relations, and the SSSB officers followed up with him because of his supposedly prize-winning paper. Between 2005 and 2010, Shriver attempted to join the Department of State as a foreign service officer and the CIA as a case officer. The SSSB paid him $70,000 for his efforts. Throughout this time period, Shriver was in communication with his primary SSSB handler on a monthly basis, and one of his handlers offered to meet him in Hong Kong if coming to Shanghai was too risky. According to one account, CIA and FBI officials knew about Shriver’s recruitment by the SSSB, and the final stages of the background investigation were a sham to prepare for prosecution. In October 2010 Shriver pleaded guilty to conspiring to steal classified information, and he received a four-year prison sentence.⁵⁴

Smith, James J. “J. J.” (arrested 2003)

FBI special agent J. J. Smith was the primary handler of Katrina Leung from 1982 through 2001 as well as Leung’s primary source of information within the FBI. Within a year of recruiting Leung, the two began a romantic relationship. Smith’s handling of Leung and the intelligence reporting she provided made him a key figure in the FBI’s China operations. He won a U.S. Intelligence community “collector of the year” award in the early 1990s.⁵⁵ The successes and plaudits allowed Smith to handle Leung with minimal oversight, even when problems emerged. Sometime after Leung was recruited by the MSS in 1984 as part of the bureau’s double agent operation, Leung gained access to information about the FBI’s operations. First, Smith consulted Leung about ongoing investigations and operations, including those involving other intelligence agencies. Second, Leung started copying classified documents from Smith’s briefcase that he brought to their trysts. Smith also compromised sensitive technical operations against Chinese targets.

Thayer, Nate (pitched 2014)

Veteran U.S. journalist Nate Thayer was approached via email by the SSSB to provide short interview-based reports on U.S. policy in Asia. Two men, both claiming to work for the Shanghai Pacific and International Strategy Consulting Company (SPISCC), sent Thayer emails offering to pay him for short reports on a variety of policy topics based on his contacts across U.S. and foreign governments. The SPISCC claimed their focus was on “U.S. policies toward Asian countries, U.S. interactions with them, and [the] implications [for] China and Chinese enterprises.” For the first papers suggested to Thayer, they wanted to know about the Burmese Kyaukpyu Port project and U.S.-Cambodia talks on how to manage tensions in the South China Sea. SPISCC offered to pay $500 to $1,500 per five- to sevenpage paper completed on a one- to two-week timeline. The SSSB officers offered to meet him inside or outside China, including Singapore.⁵⁶ The case ultimately went nowhere as Thayer declined to take the SPISCC consulting offer.

Wang Hung-ju (Wang Hongru, 王鴻儒; arrested 2017)

Wang Hung-ju is a former Taiwan National Security Bureau (NSB) officer who ended his career as a bodyguard for vice president Annette Lu (2002–3). He went into business after his retirement, traveling back and forth to China or living there for extended periods. In 2009 the SSSB or a Shanghai-based military intelligence unit recruited Wang to work alongside Taiwanese businessman Ho Chih-chiang in building an espionage ring in Taiwan. It is not clear, however, why Taiwanese authorities arrested Ho in 2010 while waiting seven more years to arrest Wang. One possibility is that they did not see arrestable behavior until Wang pitched a former NSB colleague who was working at the military police command. Wang offered his former coworker a sum “several times his pension” and a trip to Singapore where he would meet a Chinese intelligence officer. The former colleague rejected the approach and reported Wang to security officials. According to a ministry of national defense spokesman, no active-duty military officers worked in Wang’s spy ring.⁵⁷

Yuan Hsiao-feng (袁曉風; recruited 2001, arrested 2012)

Yuan Hsiao-feng was a Taiwan air force lieutenant colonel recruited by 2PLA agent Chen Wen-jen in 2001. On at least twelve occasions while on active duty between 2001 and 2007 he used flash drives to pass defense secrets relating to his position as an air traffic controller. Yuan was reportedly paid roughly $269,000 by 2PLA. Taiwanese counterintelligence began an investigation into Yuan and Chen after the pair failed to recruit two junior officers in August 2011. Following his conviction on twelve counts of espionage, a Taiwanese court sentenced Yuan to twelve life sentences.⁵⁸

Zhen Xiaojiang (鎮小江; arrested 2015)

Zhen Xiaojiang is a former PLA army captain who recruited a spy ring of at least four military officers and a Kaohsiung nightclub owner. Zhen, by some accounts, joined a military intelligence service after his retirement from active duty, but he may also have been a co-optee acting as a go-between for military intelligence. In 2005 he acquired a Hong Kong residency permit and started traveling regularly to and from Taiwan. The Taiwanese prosecuted for their activities on Zhen’s behalf include Major General Hsu Nai-chuan, air force Colonel Chou Chih-li, air force pilot Sung Chia-lu, civilian air force official Yang Jung-hua, and nightclub operator Lee Huan-yu. Zhen acquired classified information on Taiwan’s Frenchmade Mirage 2000 fighters, the ultra-high-frequency radar at Leshan, and other advanced Taiwanese military technology. He provided free trips to Southeast Asia for Taiwanese military officers and sometimes arranged for meetings with Chinese intelligence during the travel. He was sentenced to four years in prison in 2016.⁵⁹

Zhou Hongxu (周泓旭; arrested 2017)

Taiwanese authorities detained Chinese national Zhou Hongxu in March 2017 for spying after he pitched a junior foreign ministry official. Zhou promised to pay the diplomat in cash or overseas travel in exchange for classified documents. Zhou himself would not take possession of the documents, but the diplomat would have personally delivered them to another Chinese contact arranged by Zhou on an all-expenses-paid trip to Japan. Zhou first came to Taiwan in 2009 to study at Tamkang University on an exchange program. He returned to Taiwan in 2012 to earn a master’s degree in business at National Cheng-chi University and returned to China after completing the degree in 2016. Zhou came again to Taiwan in February on an investment visa but was arrested in March after his failed pitch of the foreign ministry official. Taiwanese investigators told journalists that Zhou was an active networker and had tried to develop other students and officials during his time as a student.⁶⁰