Five Eyes Warns of Chinese Spies Using Job Platforms to Recruit Insiders
Security agencies from the 'Five Eyes' alliance have issued a warning about Chinese spies aggressively using online job platforms, including LinkedIn, to recruit people with access to sensitive information. “China’s military intelligence services are using an increasingly wide array of professional networking sites and online job platforms to target Five Eyes government and military personnel — and anyone with access to classified or privileged information,” according to a joint statement by the FBI, Britain’s MI5 security service and the domestic intelligence agencies of Australia, Canada and New Zealand. 'Five Eyes' alliance comprises US, Britain, Canada, Australia and New Zealand. Although there have been similar warnings from individual countries in the past, the joint bulletin has reportedly being described as unprecedented. China has reportedly denied the accusations. The Chinese embassy in the UK strongly condemned the accusations, calling the allegation of Chinese espionage threats “entirely fabricated” and “malicious slander.” The “Five Eyes” members have “engaged in unscrupulous espionage and intelligence-gathering activities around the globe. Their activities are the real threat to peace-loving countries,” the embassy said in a statement.
What “Safeguarding Our Secrets” bulletin from 'Five Eyes' says China’s military intelligence is using an increasingly wide array of professional networking sites and online job platforms to target Five Eyes government and military personnel—and anyone with access to classified or privileged information. These actors use an aggressive online recruitment strategy whereby intelligence officers or their affiliates pose as employees of private consultancies, think tanks or human resources (HR) firms, and place online job advertisements for foreign policy and defence analysts (or similar). Successful candidates are pressured to provide “non-public” information for unspecified clients who are associated with the Chinese government. Chinese military intelligence services ultimately seek to acquire privileged military, political and economic intelligence that can provide China with a strategic and tactical advantage over the Five Eyes.
Who is at risk? Chinese intelligence officers attempt to recruit and cultivate long-term relationships with the following types of individuals in exchange for classified or priviledged information: Security clearance holders, particularly those who specialize in defence, foreign affairs and security & intelligence. Military personnel, including those stationed in the Indo-Pacific Region with knowledge of regional capabilities and general activities. Persons with either indirect or peripheral access to government information, e.g., academics, journalists, freelance writers, think tank employees, or anyone with links to defence, security, policy and economic sectors.
Recruitment: Chinese intelligence officers pose as online HR recruiters or consultants who represent fake, but often legitimate-looking, “cover companies” and claim to be located in countries other than China.
First contact: Recruiters post job ads on professional networking platforms and online hiring and freelance “gig work” websites like LinkedIn, Indeed and Upwork. Resumes are ranked based on likelihood of access to sensitive information; recruiters begin their contact strategies.
Interview: When they are required, interviews are held virtually. Recruiters conceal their identity, and may start probing applicants about access to government contacts. Military members may be asked about their roles and unit activities, home base or naval vessel.
Initial testing: Candidates are asked to write a trial report on a topic such as China’s bilateral relations, the Indo-Pacific Region and related defence issues, or international trade.
Subsequent requests and platform shift: Recruits are informed that for additional reports, the client requires more privileged information. At some point in the recruitment process, intelligence officers typically move the conversation to a more “secure” platform, such as encrypted messaging applications.
Payment: Recruits receive anywhere from a few hundred to several thousand dollars per report, and may be offered more money in return for increasingly sensitive information. Payment methods include the use of third-party payment platforms, such as PayPal, Payoneer, Zelle, Skrill, and Wise, as well as Western Union, e-transfer and cryptocurrency. Recruits will often be compensated by an account belonging to an individual they had not met as part of the recruitment process.
Why does it matter? While applicants often have no direct access to classified information, even unclassified information on government policy, or on military strategy, capabilities and installations, can be collected and combined with more sensitive reporting to form a comprehensive operational picture. Certain types of data can place the lives of frontline military or other personnel at risk, can weaken our economic prosperity, and enable interference in our democratic processes. Applicants who provide their resumes and other personally identifiable information risk compromises of personal privacy. Individuals engaged in the unauthorized disclosure of sensitive or classified information could face a number of consequences including prosecution under national laws such as those relating to espionage. Five Eyes agencies have identified individuals who have undertaken these activities, leading to criminal prosecutions, job losses, and security-clearance revocation.
