China’s Espionage Against Taiwan (Part I): Analysis of Recent Operations

The last few weeks put Chinese espionage against Taiwan back into the headlines with a series of arrests and sentencing pronouncements. In the first week of October, a Taiwanese court sentenced Vice Admiral Ko Cheng-sheng, a former deputy commander of the Navy, to 14 months in prison for violating the National Security Act by providing military secrets to a naturalized Australian businessman Shen Ping-kang, whom Chinese intelligence recruited sometime during the 1990s (Taipei Times, October 2; Liberty Times, September 30). Taiwan’s defense attaché in the United States, Major General Li Hsien-sheng, is under investigation for providing secrets to Chinese intelligence after being tangled up in an extramarital affair; yet despite so far failing three polygraph tests, the Taiwanese government denies any investigation (China Post, September 25; Taipei Times, September 25). Taiwanese security authorities catch a number of Chinese spies every year, making this year no different; however, as the military balance tips ever in China’s favor, every secret bought or stolen by China further diminishes any remaining advantages Taiwan has for its self-defense. The last three years of Chinese espionage against Taiwan reinforce the notion that retired Taiwanese officials doing business in China remain the island’s greatest weakness.

In this two-part series, the first part will evaluate China’s recent intelligence operations against Taiwan and explore the operational implications. The second part will discuss the organizational landscape of Chinese intelligence operations against Taiwan. The Ko case, in particular, highlights new information about the Chinese intelligence bureaucracy and the overlapping roles that many of the agencies have.

China’s Espionage Campaign Continues

In the last three years, Taiwan uncovered at least 13 cases, involving more than 23 Taiwanese citizens, and several other suspicious cases still being investigated by the authorities. The predominant Chinese collection targets related to the Taiwanese military, including Taiwan’s radar and passive early warning detection systems, military exercises (such as Taiwan’s major annual exercise Han Kuang), the U.S.-supplied Patriot missile systems, and military mobilization and defense plans as well as command, control, computers, communications, intelligence, surveillance and reconnaissance (C4ISR) infrastructure. The latter specifically included the Po Sheng, Anyu-4 and Shuan-Ji programs that affect unit connectivity, air defense awareness and electronic warfare, respectively (Taipei Times, October 3; Taipei Times, February 7, 2013).

The most important of these cases was Vice Admiral Ko Cheng-sheng, who retired as a deputy commander of Taiwan’s navy. A naturalized Australian citizen of Taiwanese extraction, Shen Ping-kang, recruited him for Chinese intelligence services. This case, however, was not any sort of “false flag” operation in which the admiral was unaware of whom he was dealing with. Shen eventually introduced Vice Admiral Ko to Chinese intelligence officers as well as the United Front Work Department and the Liaison Office of the General Political Department. Moreover, Ko also agreed to work with Shen to recruit subordinate officers in order to create an internal network after he retired from the navy (Sydney Morning Herald, October 4; Taipei Times, October 3). Reportedly, Taiwanese security officials uncovered Ko and Shen’s activities while investigating an espionage case at the Naval Meteorology Oceanography Office (Want China Times, April 19, 2013). It remains unclear how much damage Ko caused—he provided at least the late-1990s version of the “Gu’an Combat Plan” for the defense of Taiwan—nor is it clear if Taiwanese authorities have run down all the potential leads from Shen’s activities. Amazingly, the sentences handed down at the beginning of October for Ko and Shen are measured not in years but months—14 and 12, respectively (Taipei Times, October 3).

The Taiwan Air Force case involving Yuan Hsiao-feng and retired lieutenant Chen Wen-jen also revealed an important vulnerability in the management of classified information. Yuan pulled several flash drives worth of data off of classified military systems to deliver to his Chinese handlers at the Second Department of the PLA’s General Staff Department (2PLA). Yuan’s theft went undetected before he retired in 2007, suggesting a lack of computer security audits and loose regulations on portable media devices. Yuan and Chen continued to search for potential agents for the 2PLA to recruit, even after Yuan’s retirement in 2007. Their greed proved their undoing as two junior officers, who the pair approached in 2011, reported a recruitment attempt. Ultimately, the 2PLA paid Yuan roughly $260,000—the figure for Chen or other benefits that his mainland business received remains out of the public eye—but the courts sentenced Yuan to twelve life sentences (Taipei Times, February 7, 2013).

One of the few cases where Taiwan authorities have described the China-side of an espionage case involves a well-known fortune reader and senior academic at Taiwan’s Central Police University, Wang Chang-yu. Wang traveled regularly and extensively in China for both his academic work and his fortune readings. A Chinese intelligence officer, ostensibly from the Taiwan Affairs Office’s Beijing municipal government branch, developed a relationship with Wang, promising that, in exchange for the professor’s assistance, he could expand the mainland side of Wang’s fortune-telling business. As the relationship developed, Wang was introduced to “Xiao Zhang,” who would serve as his principal contact and go-between (Taipei Times, June 20, 2012; Epoch Times, June 19, 2012).

This is fairly consistent with the tradecraft employed by China in a number of cases, including against the United States, where Chinese intelligence provided couriers and/or handled the agent using more than one case officer at the same time. Taiwanese-American businessman Kuo Tai-shen—known for his role suborning two U.S. Department of Defense officials—was given a courier, Kang Yuxin, to handle his contact with the 2PLA (U.S. District Court for Eastern Virginia, February 2008). In the case of Glenn Duffie Shriver—a U.S. student who was paid by his Chinese handlers to apply to the Central Intelligence Agency and the U.S. Department of State after his recruitment during his studies in China—one Chinese intelligence official managed the relationship with Shriver, while another more senior official, “Mr. Wu,” became part of the operation when money was put on the table (see China Brief, November 5, 2010; The Washingtonian, June 7, 2012).

One of the more aggressive attempts to penetrate Taiwan’s intelligence agencies was the Chinese arrest in 2012 of Lin Linghui, the spouse of a Taiwanese Military Intelligence Bureau (MIB) colonel. The Chinese intelligence service—most likely the Ministry of State Security (MSS)—then contacted the officer in an effort to lure him to China (China Post, January 17). Similarly, retired MIB Major Chen Shu-lung lured a government acquaintance to Shanghai, where the acquaintance was interrogated for three days (Central News Agency [Taiwan], October 7, 2013). If this sounds incredible, it is worth remembering that Chinese intelligence in 2006 lured two senior MIB officers to Vietnam with the prospect of a high-level Chinese defector, where they kidnapped the Taiwanese officers and brought them to China (China Post, December 12, 2013; Boxun, July 20, 2006). Just as Taiwan’s effort to negotiate the release of the kidnapped MIB officers has failed, so too have efforts to negotiate Mrs. Lin’s release (China Post, January 17).

Several spying allegations remain unresolved, including Taiwan’s most recent defense attaché to the United States, who lingers under a cloud of suspicion after multiple failed polygraphs. The most prominent is the dismissal this August of the Mainland Affairs Council (MAC) deputy director, Chang Hsien-yao, for passing classified documents to Beijing via a Taiwanese businessman. Chang was reportedly dismissed after a two-year investigation, started after Investigation Bureau officials intercepted a fax from the MAC offices that contained sensitive information about cross-Strait airspace management (China Post, August 30). Chang publicly has maintained his innocence, claiming that the government is fabricating evidence and that he only ever followed official instructions (Want China Times, August 26; South China Morning Post, August 25). Superficially, the description of how Chang purportedly passed information to Chinese authorities bears the hallmarks of many Chinese espionage cases on the island, but the investigation remains ongoing, with Chang under curfew and innocent until proven guilty (United Daily News, October 8; China Times, October 8).

Conclusions

A few conclusions can be taken away from Taiwanese espionage cases over the last several years. First, not much has changed. The General Lo Hsien-che case, whom the Chinese recruited in Thailand and handled exclusively outside of China, remains an anomaly. Perhaps, because of the increased difficulty for Taiwanese authorities to uncover such operations or because the marginal gains for Chinese intelligence are not worth the increased costs of posting officers abroad, no similar espionage cases have emerged. Only one of the cases above, involving Chien Ching-kuo, Lu Chun-chun and Chang Chih-Hsin, involved even third-country meeting sites (not China, not Taiwan) (Central News Agency [Taiwan], October 18, 2013; Taipei Times, January 5, 2013).

The cases here bear out the author’s previous assessments that Chinese intelligence would continue to rely on Taiwanese agents who had interests inside the People’s Republic and traveled back and forth regularly, despite the emergence of China’s willingness and ability to run operations outside China and Taiwan. Most of the Chinese intelligence infrastructure is domestic, dominated by the sprawling apparatus of the MSS and its many subordinate departments at the provincial and local level (see China Brief, July 1, 2011).

The second lesson relates to what Chinese intelligence looks for in prospective foreign agents that they try to recruit. The seemingly universal presence of a Taiwanese businessman or retired official with interests on the mainland suggests Chinese intelligence focuses on people who can serve as bridges to the intelligence target. These are people whose economic livelihoods and careers depend upon China, making the threat implicit when intelligence officers approach them. Although this is more indirect than familiar Western forms of clandestine agent operations in which an intelligence officer recruits a source inside the target (e.g. a terrorist organization, a foreign ministry or a foreign military), China’s approach to Taiwan still offers some operational benefits. Instead of expending a great deal of effort to identify key people inside Taiwan on their own, Chinese intelligence is putting the onus on its Taiwanese recruits, who already have existing relationships and, perhaps, even some idea of who among their government contacts could be approachable. By doing so, Chinese intelligence make their job easier by focusing on Taiwanese inside China over whom they can develop leverage and meet away from the prying eyes of Taiwanese security agencies. Moreover, by virtue of their presence inside China and local registration requirements, Chinese intelligence already has access to a great deal of information about prospective Taiwanese agents prior to conducting any surveillance.

This approach also would be substantially lower risk than using a mainlander to attempt to recruit Taiwanese in sensitive positions inside Taiwan itself.  A mainland intelligence officer caught in Taiwan while trying to recruit government officials could result in contractions of cross-strait openness; however, even if there are no policy repercussions, a Chinese intelligence officer would still be sitting in a Taiwanese jail. And Taiwan and the Kuomintang have a long, successful history of exploiting such people.

Critiquing Taiwan’s counterintelligence posture could only prove the old security adage that there is no good time to catch a spy. With at least 20 distinct cases of espionage in the last decade, Taipei’s friends in the United States have justifiable concerns about the security of U.S. defense systems sold to Taiwan. Former American Institute of Taiwan director Bill Stanton summed up these concerns at a conference last year when he said China’s intelligence successes “undermine U.S. confidence in security cooperation with Taiwan” (Taipei Times, November 15, 2013). Taiwan has made several substantial efforts to improve security—including trip reporting and routine polygraphs for personnel with sensitive access as well as boosting its counterintelligence staff—and serious offenders can, but not always, receive heavy prison sentences (China Post, October 25, 2013; Taipei Times, March 8, 2011; Taipei Times, May 17, 2005). One of the few measures that might alleviate anxiety is the sharing of damage assessments to help make way for improved U.S.-Taiwan counterintelligence cooperation of the kind that reportedly helped close the General Lo Hsien-che case three years ago (China Post, March 9, 2011; Taipei Times, February 18, 2011). Without knowing the degree of severity of Taiwan’s espionage losses, the U.S. government has no choice but to assume the worst case in spite of the many questions that could be raised about how much damage each spy did, such as whether technical information was transferred via documents or electronic files versus word of mouth (see China Brief, March 15, 2012).