FBI Director Chris Wray and MI5 Director General Ken McCallum have warned of the growing threat posed by the Chinese Communist Party to U.S. and U.K. interests.
The two spoke to an audience of business and academic leaders at an unprecedented joint address at MI5 headquarters last week. McCallum said the joint warning aimed to “send the clearest signal we can on a massive shared challenge: China.”
“The Chinese Communist Party is interested in our democratic, media and legal systems. Not to emulate them, sadly, but to use them for its gain, the MI5 chief said. “We aren’t crying wolf. We are seeing, cumulatively, the damage we had feared. And much of it is preventable damage.”
The FBI and MI5 see a coordinated campaign of planned, professional activity on a grand scale. Wray and McCallum made it clear that it’s the Chinese government and the Chinese Communist Party that pose the threat. Not the Chinese people, and certainly not Chinese immigrants in the U.S. and U.K. who are themselves frequently victims of the Chinese government’s lawless aggression.
“The most game-changing challenge we face comes from the Chinese Communist Party. It’s covertly applying pressure across the globe,” McCallum said. “This might feel abstract. But it’s real and it’s pressing. We need to talk about it. We need to act.”
The MI5 chief warned that most of what is at risk from Chinese Communist Party (CCP) aggression is “not, so to speak, my stuff. It’s yours. The world-leading expertise, technology, research and commercial advantage developed and held by people in this room, and others like you.”
“If you are involved in cutting-edge tech, AI, advanced research or product development, the chances are your know-how is of material interest to the CCP.,” McCallum stated. “And if you have, or are trying for, a presence in the Chinese market, you’ll be subject to more attention than you might think. It’s been described as ‘the biggest wealth transfer in human history’.”
During the address, the intelligence leaders covered a number of ways that the CCP could act, citing past examples.
Covert Theft. Late last year Chinese intelligence officer SHU Yenjoon was convicted in a U.S. court on charges of economic espionage and theft of trade secrets from the U.S. aviation sector. SHU was active in Europe too: he’d been part of a prolific Ministry of State Security network targeting the aerospace sector.
Tech Transfer. In 2017 the company Smith’s Harlow entered into a deal with a Chinese firm, Futures Aerospace. The first of three agreed technology transfers saw Futures pay £3m for quality control procedures and training courses. After further sharing of valuable IP, Futures abandoned the deal. Smith’s Harlow went into administration in 2020.
Exploiting Research. In 2020 the U.S. stopped issuing new visas in certain fields to researchers from People’s Liberation Army universities. The U.K. has reformed the Academic Technology Approval Scheme to harden efenses, and has seen over 50 PLA-linked students leave.
Information Advantage. The CCP doesn’t just use intelligence officers posing as diplomats in the classic fashion. Privileged information is gathered on multiple channels, in what is sometimes referred to as the ‘thousand grains of sand’ strategy. McCallum told how, in Germany, a retired political scientist and his wife who together ran a foreign policy think tank passed information to the Chinese intelligence services for almost ten years. And in Estonia a NATO maritime scientist was convicted for passing information to his Chinese handlers, who claimed to be working for a think tank.
Cultivating New Contacts. The deceptive use of professional networking sites is well known. Seemingly flattering approaches turn into something more insidious – and damaging. In one example a British aviation expert received an approach online, ostensibly went through a recruitment process, and was offered an attractive employment opportunity. He traveled twice to China where he was wined and dined. He was then asked – and paid – for detailed technical information on military aircraft. The ‘company’ was actually run by Chinese intelligence officers.
Cyber. McCallum recalled that a wide range of government and commercial targets were attacked by the three so-called ‘Advanced Persistent Threat’ groups which the U.K. government has attributed to China’s Ministry of State Security.
Over the last year the U.K. has shared intelligence with 37 countries to help defend against such espionage. This included the disruption in May of a sophisticated threat targeting critical aerospace companies. And McCallum said the FBI has led the way in taking the fight to those behind the keyboards.
Wray said the CCP sees cyber as the pathway to cheat and steal on a massive scale. “The Chinese government is set on stealing your technology,” the FBI director said. “Whatever it is that makes your industry tick, and using it to undercut your business and dominate your market. And they’re set on using every tool at their disposal to do it.”
Citing examples, Wray said that last spring, Microsoft disclosed some previously unknown vulnerabilities targeting Microsoft Exchange Server software. “Chinese hackers had leveraged these vulnerabilities to install more than 10,000 webshells, or backdoors, on U.S. networks, giving them persistent access to data on those systems,” Wray explained.
In recent years, the FBI has seen Chinese state-sponsored hackers relentlessly looking for ways to compromise unpatched network devices and infrastructure. And Wray said Chinese hackers are consistently evolving and adapting their tactics to bypass defenses. “They even monitor network defender accounts and then modify their campaign as needed to remain undetected. They merge their customized hacking toolset with publicly available tools native to the network environment—to obscure their activity by blending into the “noise” and normal activity of a network. The point being, they’re not just big. They’re also effective.”
Wray also warned that the CCP uses elaborate shell games to disguise its efforts from foreign companies and from government investment-screening programs.
“For example, they’re taking advantage of unusual corporate forms like SPACs, or Special Purpose Acquisition Companies, and buying corporate shares with overweight voting rights that let their owners exert control over a company out of proportion with the actual size of their stake in it.
“The Chinese government has also shut off much of the data that used to enable effective due diligence, making it much harder for a non- Chinese company to discern if the company it’s dealing with is, say, a subsidiary of a Chinese state-owned enterprise.”
Wray highlighted Chinese legislation that can bolster its campaign against the West.
“You probably all know that the Chinese government requires U.S. and U.K. companies to partner with Chinese businesses, partners that often turn into competitors. But they’re also legislating and regulating their way into your IP and your data.
“Since 2015, they have passed a series of laws that eat away at the rights and security of companies operating in China. For example, a 2017 law requires that if the Chinese government designates a company as “critical infrastructure,” that company must store its data in China—where, of course, their government has easier access to it.
“Another 2017 law would allow them to force Chinese employees in China to assist in Chinese intelligence operations. And a series of laws passed in 2021 centralizes control of data collected in China and gives their government access to and control of that data.
“Other new laws give the Chinese government the ability to punish companies operating in China that assist in implementing international sanctions, putting those businesses between a rock and hard place. And one requires companies with China-based equities to report cyber vulnerabilities in their systems, giving Chinese authorities the opportunity to exploit those vulnerabilities before they’re publicly known.”
The FBI director said the CCP is also trying to shape the world by interfering in politics. Earlier this year, for example, Wray said the Chinese government directly interfered in a Congressional election in New York, because they did not want the candidate—a Tiananmen Square protester and critic of the Chinese government—to be elected.
And Wray added that last November, the Chinese Embassy warned U.S. companies that, if they want to keep doing business in China, they need to fight bills in U.S. Congress that China doesn’t like.
“I’m not here to tell you to avoid doing business in or with China altogether,” Wray said, at the joint address with McCallum. “But I do have just a few suggestions for those who do plow ahead, because we’re not in the business of just articulating problems. We’re doing something about them, together—with MI5, with the private sector itself, with other government partners.
“First, I would encourage everyone to work with the two agencies up here. We can arm you with intelligence that bears on just what it is you’re facing.
“Our folks will race out to give you technical details that will help you lessen the effects of an attack. Together, we can also run joint, sequenced operations that disrupt Chinese government cyber attacks, working with the private sector, including Microsoft itself, and our government partners to slam shut those backdoors the Chinese government had installed on corporate networks across the U.S.
“And we can also help you to ascertain whether the cyber problem you’ve encountered is actually part of a larger intelligence operation, whether the hackers you do see may be working with insiders, or in concert with other corporate threats, that you don’t see.
“The private sector can’t stand alone against the danger—you’re not alone. The FBI and MI5 share a relentless focus on a common mission: protect our countries and keep our people safe.”
Read FBI Director Wray’s speech in full
