PRC Exploitation of Russian Intelligence Networks in Europe

Executive Summary:

• Russian-cultivated circles overlap with People’s Republic of China (PRC) intelligence networks. These intersections include politicians on both extremes of Europe’s political spectrum, and across countries which include Belgium, Germany, Poland, and the Czech Republic.
• “Daniel Woo,” a PRC state security officer, is a key figure connecting many of the network’s members. Woo has successfully influence debates in the German Bundestag and paid Belgian lawmakers to disseminate propaganda.
• State security networks further overlap with observer missions, lending legitimacy to Russian-organized elections in occupied territories in Ukraine.
• The networks extend to political parties leading polls for some of this year’s European Parliament and EU member state elections.
• Some action has already been taken. The Czech government sanctioned Voice of Europe, a media organization controlled by Russia through Viktor Medvedchuk, an oligarch charged with treason in Ukraine. Subsequently, Polish authorities arrested its legal representative.

Revelations about Russian intelligence assets in Europe expose overlaps with influence operations run by spy agencies from the People’s Republic of China (PRC). Western mainstream media outlets have covered the Russian cases, but the ways in which PRC intelligence has been tapping into the same networks—including operations revealed in China Brief—have received little attention (The New York Times, March 29; China Brief, December 3, 2021). These overlaps exist at the level of both individual people and organizations, and they have the potential to disrupt European democratic processes.

New Russian Attempts to Capture European Politics

Two recent investigations have exposed Russian intelligence operations targeting European politics in unprecedented detail. For the first time, extensive allegations identify members of the European Parliament (MEPs) as having worked with Russian spy networks, in some cases in exchange for monetary rewards.

In January, a media consortium from the Baltic states reported that hacked emails revealed Latvian MEP Tatjana Ždanoka had cooperated with two officers from Russia’s Federal Security Service (FSB; Федеральная служба безопасности) for more than a decade (The Insider, January 29; Eesti Päevaleht, January 29). The alleged cooperation involved gathering information and organizing pro-Russian events. Ždanoka has not questioned the authenticity of the correspondence, but denied knowing that her contact was an FSB officer. The Latvian authorities opened a criminal investigation into her in February (Latvian Public Broadcasting, March 17).

The second case came to light days before Easter. A coordinated effort by European intelligence and spearheaded by Czech counter-intelligence agencies cracked down on a Russian influence network. On March 27, Czech authorities announced sanctions against Voice of Europe (VoE), a Prague-based media company ultimately controlled by Ukrainian pro-Kremlin oligarch Viktor Medvedchuk (Czech Ministry of Foreign Affairs, accessed March 29). The next day, Polish counterintelligence arrested the company’s legal representative—a former officer of Poland’s Government Protection Bureau (Biuro Ochrony Rządu), roughly equivalent to the US Secret Service—under suspicion of cooperating with Russian intelligence (ABW, March 28; O2, March 28; Czech Ministry of Justice, April 3). According to a Hungarian media report citing intelligence sources, Visegrád Post, a Budapest-based media outlet, “has the same financing” as VoE. The case is part of the international counterintelligence investigation (HVG, March 31; April 8). Czech “security community” sources confirmed the cases bear similarity (Deník N, April 4).

VoE has published news content, conducted interviews and organized several events with politicians at the EP and in EU member states (Le Point, April 5; Deník N, April 9). According to media reports, VoE also paid politicians from Germany, France, Poland, Belgium, the Netherlands, and Hungary and contributed to their campaigns (Deník N, March 27). In exchange, the politicians disseminated pro-Russian narratives. Media reports based on Czech cabinet sources claim that politicians who accepted money from the organization include Petr Bystroň, an MP with Germany’s far-right Alternative für Deutschland (AfD) (Deník N, April 2). Maximilian Krah, another AfD MEP and the party’s top candidate for the next European Parliament elections, gave at least two interviews to VoE. He denies receiving remuneration (VoE, September 11, 2023, August 1, 2023; Der Spiegel, March 28). But back in 2021, Krah and Bystroň both met with Medvedchuk in Ukraine (Focus.ua, November 8, 2021). Filip Dewinter, a leading MP with the far-right Flemish separatist party Vlaams Belang, has also done work for VoE, interviewing a former Czech president in September 2023. He likewise denies getting paid (Le Monde, March 29; YouTube, September 18, 2023).

PRC Intelligence Woos Europe

Recently uncovered influence operations involving PRC intelligence attracted less media attention, although they were qualitatively similar. These were run by the Ministry of State Security (MSS), the PRC’s main civilian intelligence agency, and one of its provincial analogs. In one case, the state security network overlapped with that of the China Association for International Friendly Contact (CAIFC, 中国国际友好联络会). CAIFC is a political influence front of the People’s Liberation Army (PLA) Political Work Department Liaison Bureau (政治工作部联络局), a military intelligence organ (Project 2049, October 14, 2013). [1]

In 2023, European media reported that an officer of the Zhejiang Province State Security Department (浙江省国家安全厅) ran a network of agents in Belgium to collect information on top politicians and access sources in the European Parliament and the European Commission (Der Spiegel, December 15, 2023; Le Monde, December 15, 2023). [2] Using the name Daniel Woo, he recruited Frank Creyelman, a former Vlaams Belang legislator, and paid him to gather intelligence and coordinate propaganda operations (Der Spiegel, December 15, 2023). Woo boasted in a leaked message of having “brought pressure on the German government” through an AfD parliamentary question regarding a purported “wave of Hong Kong refugees.”

Belgian security services “were aware” of Woo’s ties to Shao Changchun (邵常淳), a PRC citizen expelled from Belgium for interference in 2017 (Nieuwsblad, December 15, 2023; De Standaard, December 15, 2023). In 2024, media reported that Vlaams Belang parliamentarian Dewinter had been paid by the PRC for political lobbying and providing access to politicians (Humo, March 25). Dewinter also invited CAIFC to visit Belgium in 2016 and called himself “an old friend” of Cheng Guoping (程国平), a vice-chair of the association (Humo, March 25).

Another MSS network surrounds the Budapest-based China-CEE Institute (中国–中东欧研究院), as previously exposed in this journal (China Brief, December 3, 2021; July 1, 2022). The institute is ostensibly a Chinese Academy of Social Sciences (CASS)-run think tank gathering European scholars, organizing debates, and publishing on politics (China Brief, December 3, 2021). However, the institute is headed by a former vice-president of the China Institutes of Contemporary International Relations (CICIR, 中国现代国际关系研究院), which serves as MSS cover for international think tank engagement (China-CEE Institute, accessed April 8). [3] The Czech member of its international academic committee was involved in a Czech network pushing PRC propaganda in the country—a network that included former Czechoslovak Communist intelligence officers (China-CEE Institute, accessed April 8; China Brief, December 3, 2021).

Overlapping Networks

The Russian and PRC intelligence webs outlined above intersect.

Daniel Woo’s network overlapped with Russian disinformation operations. This overlap originally centered on the late Manuel Ochsenreiter, an AfD parliamentary staffer who wielded considerable influence in the party (Der Spiegel, December 15, 2023). In 2018 he allegedly incited and funded a false-flag terrorist attack in Ukraine, according to a 2019 Polish court testimony (onet, October 22, 2019). The attack’s three Polish perpetrators were found guilty by the court in 2020 (Gazeta Wyborcza, March 23, 2020). The AfD staffer fled to Moscow in 2019, where he died two years later (t-online, August 20, 2021). Since no later than 2013, he had headed the far-right German media outlet Zuerst!, while concurrently working for Russia Today (Der Spiegel, December 15, 2023; Manuel Ochsenreiter, accessed August 20, 2013). More importantly, he acted as a “middleman” between the AfD, Russia, and the PRC, according to German security sources (Der Spiegel, December 15, 2023). When Woo asked Creyelman where to place pro-PRC propaganda, the Belgian suggested Zuerst!, but it remains unclear whether Woo had anything published In Ochsenreiter’s outlet. However, according to German media, Ochsenreiter “received several thousand euros from China” for organizing the Hong Kong refugee wave parliamentary question (Der Spiegel, December 15, 2023).

The most significant intersection of PRC and Russian networks has been found in the election observation missions designed to give credibility to the illegitimate plebiscites in Russian-occupied Ukrainian territories. Creyelman and Ochsenreiter participated in these missions in the Luhansk and Donetsk republics in 2018 (EPDE, accessed April 8; EPDE, accessed April 8). Ochsenreiter also observed the 2014 Crimean referendum alongside the Latvian MEP Ždanoka (Anton Shekhovstov, March 17, 2014). Filip Dewinter observed the 2018 Russian presidential elections (EPDE, January 14, 2019).

Mateusz Piskorski, a former Polish far-right MP, observed the Donbas elections in 2014 along with Ochsenreiter. The two men kept in touch and “cooperated closely,” according to Der Spiegel (Anton Shekhovstov, November 1, 2014; Der Spiegel, December 15, 2023). Piskorski was arrested in 2016 and charged with espionage for both Russia and the PRC. According to Le Monde, it was to Daniel Woo that Piskorski provided information on the PRC side (Prokuratura Krajowa, April 23, 2018; Le Monde, December 15, 2023). A group of European politicians and journalists signed a letter supporting Piskorski against the charges, including Ždanoka and Ochsenreiter (Uwolnić Piskorskiego!, accessed April 8). Piskorski was released on bail in 2019, and continues to work with pro-Russian fringe media, for example interviewing the Russian far-right ideologue Aleksandr Dugin (Myśl Polska, January 1, 2023; YouTube, February 26).

Ladislav Zemánek is another Russian asset working for an MSS network. Zemánek is an alt-right scholar and politician sanctioned in Ukraine (Office of the National Security and Defense Council of Ukraine, accessed April 10). In 2014, Zemánek took part in the Donbas elections observation mission alongside Ochsenreiter, Piskorski, and Creyelman (EPDE, November 4, 2021; Anton Shekhovstov, November 1, 2014). Zemánek writes briefings on Czech politics for the Budapest institute and continues to provide comments to PRC state media (China Daily, July 10, 2023; China Brief, December 3, 2021).

Entering the Mainstream

Russia-cultivated networks offer opportunities for PRC intelligence. They can be used even when its members are marginal but well-connected and can provide access to major parties in Europe, especially to those already being cultivated by PRC influence organs.

The Russian networks PRC agencies are tapping into may appear at first to be on the fringes of the political spectrum and thus of limited use. For example, Piskorski, the early Woo contact, participated in Russian operations through his activism in Polish racist and neo-Nazi movements (Krytyka Polityczna, May 30, 2018). [4] After his arrest, Polish media reported that Piskorski was receiving funds from an election-observer organization headed by Luc Michel, the leader of an extra-parliamentary “national Bolshevik” party in Belgium (Rzeczpospolita, May 26, 2016; PCN, ca. 2001). [5] However, Piskorski’s access to the Polish political mainstream shows he is not simply a fringe character. In 2022, he interpreted for Poland’s first lady in 2022 (Wirtualna Polska, March 12, 2022). The opportunity reportedly came through Piskorski’s ex-wife, a politician in the president’s party who worked for companies controlled by a state cybersecurity agency (Wirtualna Polska, March 16, 2022; NASK, March 2022).

These networks have perhaps most clearly entered the mainstream in Belgium. Vlaams Belang is polling first for this June’s Belgian federal and Flemish elections (Le Soir, March 22; March 23). Moreover, Filip Dewinter, the CAIFC-linked MP, is also the first deputy speaker of the Flemish parliament, one of Belgium’s sub-national legislatures. Although Frank Creyelman was no longer a legislator when assisting Woo, he retained contacts across European politics. His brother, a sitting MP, was on a parliamentary defense procurement committee until the Woo revelations surfaced (VRT, December 21, 2023).

In Germany, too, the far right is no longer fringe. The AfD is currently polling second for next year’s general election (Wahlrecht). Contacts with Russian AfD networks intersect with preexisting PRC ties. Ochsenreiter, the late AfD parliamentary staffer linked to Russia, was part of Woo’s network (Der Spiegel, December 15, 2023). In 2020, Ochsenreiter interviewed leading AfD MEP—and VoE interviewee—Maximilian Krah, who praised China’s economic achievements and urged Europe to ignore PRC aggression toward Taiwan (Zuerst!, August 29, 2020). Krah was a vice-chair of an informal EU-China friendship group at the European Parliament, which partnered with major CCP influence organs (Sinopsis, November 26, 2019; EU-China Friendship Association). [6] Krah directly interacted with one of these organs—the CCP International Liaison Department (ILD)—during a 2019 trip paid for by a PRC state-owned company and Huawei (t-online, October 1, 2023). According to German media, Guo Jian (郭健), Krah’s assistant at the European Parliament, helped set up a PRC-aligned lobbying organization in Germany, and assisted Krah on the 2019 trip (see picture above) (t-online, October 1, 2023; Zhejiang Daily, September 24, 2020). Guo and the lobbying group arranged a trip to the PRC around the same dates for a delegation that included Tim Lochner, a German city councilor, promoting ties with Lishui (丽水), a prefecture-level city in Zhejiang province (t-online, October 1, 2023). In 2023, Lochner became the AfD’s first mayor (Der Spiegel, December 17, 2023).

If PRC agencies can exploit further contacts along Russian networks, the potential for political influence in European politics increases. The Czech Republic provides a good example of how this can happen. Four years ago, the country shifted away from being one of the most PRC-aligned EU member states to embracing Taiwan ties and a more Western orientation (China Brief, May 9, 2019; Prospect Foundation, March 3, 2022). However, the newly exposed Russian network is linked with two parties that could form a government after next year’s election (iRozhlas, March 14). According to Czech media, the alt-right Freedom and Direct Democracy (SPD; Svoboda a přímá demokracie) facilitated interviews with politicians (including from the AfD) for VoE (Hlídací pes, March 28). A top SPD MP recently attended an event in Slovakia where VoE was an official partner (Hlídací pes, March 28). [7] Also present at the event was the first deputy speaker of the Czech Chamber of Deputies from the ANO party, which currently leads in the polls (Hlídací pes, March 28; ČT24, March 14). An MP for ANO was an observer in the 2014 Crimea referendum (ČT24, March 19, 2014). The ILD, a key influence organ, has targeted both parties, with an ANO leader claiming in 2019 that they wished to “boost exchanges with the CCP,” according to an ILD readout from the meeting (ILD, November 7, 2019; Sinopsis, November 10, 2019; Seznam zprávy, February 26, 2020). The Czech Republic’s future orientation remains uncertain but could easily pivot back if these PRC-linked political parties gain power next year.

Conclusion

Russian intelligence networks have proven fertile grounds for exploitation by PRC civilian and military intelligence. The cases outlined above show that parliamentary assistants and well-connected ex-legislators are ideal targets for intelligence gathering and manipulation. [8]

As the PRC and Russia continue to align, individual cooptees will more likely work for both authoritarian states. And as alt-right movements become more mainstream—and mainstream political parties become more alt-right—the risk of PRC intelligence influencing European politics through Russia-cultivated networks will continue to rise.

Notes

[1] For a recent discussion of CAIFC and its external operations see work published in this journal and by a China-focused think tank Sinopsis (China Brief, June 26, 2019; Sinopsis, July 18, 2022).

[2] The Zhejiang bureau concentrates on Europe, according a former senior MI6 officer (Nigel Inkster, China’s Cyber Power, Routledge, 2016, p.50, 55). This focus could be explained by Zhejiang diaspora’s strong presence on the Old Continent. For more discussion of sub-national state security organs, see work by Alex Joske and a previous publication with this journal (Deserepi: Studies in Chinese Communist Party external work, 2023; China Brief, January 14, 2011).

[3] Alex Joske, Spies and Lies: How China’s Greatest Covert Operations Fooled the World, Hardie Grant Books, 2022, p. 199.

[4] Anton Shekhovtsov, “Russia and the European Far Right”, PhD dissertation, University College London, 2018, pp. 117.

[5] Michel has engaged in high-profile pro-Russian activities in Europe and Africa where, according to a 2023 BBC investigation, he advanced Russian influence on the continent through a disinformation network (RTBF, February 18; BBC, February 1, 2023). When asked, he denied ties to Wagner and Prigozhin, despite promoting them, but stated: “I manage the cyberwar, the media war … and Prigozhin conducts military activities” (BBC, February 1, 2023). Michel and his Observatory also supported an attempt to declare the Republic of Detroit in 2021 (NPR, February 1, 2023).

[6] The European Parliament EU-China Friendship Group (EUCFG, 欧洲议会欧中友好小组) was initiated in 2010 by Gai Lin (盖琳), an EP assistant to both of its consecutive chairs. EUCFG was created “to ensure that China-friendly European politicians and former politicians continue promoting Europe-China friendship” (Sinopsis, November 26, 2019; China International Chamber of Commerce for the Private Sector, March 13). Gai acted as the group’s secretary-general, while concurrently advising a provincial-level PRC influence organ (Sinopsis, November 26, 2019). In 2021, the group was suspended after EP scrutiny over its PRC exposure (European Parliament, January 25, 2021) However, Gai has continued to be described in PRC media as secretary-general of the EU-China Friendship Association (欧盟中国友好协会), a sister organization to the now suspended group (CNS, April 12, 2023). Gai has taken up new leadership positions in Belgian and pan-European diaspora groups coopted by the PRC united front work system. The most prominent of these groups is the Europe Northeastern China Hometown Association and Chamber of Commerce (欧洲东北同乡会暨商会), gathering 49 members from across 21 countries (Nouvelles d’Europe, April 1, 2022). For more on European coopted diaspora networks see China Brief, September 16, 2020.

[7] Voice of Europe’s mention has meanwhile disappeared from the official press release (The Business Soirée, March 24, accessed March 26; accessed March 28).

[8] The targeting of parliamentary assistants by PRC intelligence organs has also been in evidence in the United Kingdom (The Times, September 11, 2023).