China suspected of using social media to recruit spies

A former official at the Danish Foreign Ministry also received a LinkedIn message from a stranger, apparently a woman working for a recruitment firm, asking to meet him in Beijing. But at the meeting, three middle-aged men showed up and said they could help him “get inside the workings” of the Chinese government for research.

A former White House official under President Barack Obama received a friend request on LinkedIn from someone claiming to be a researcher at the California Institute of Technology, with a profile showing connections to White House advisers and ambassadors. But the person was not real.

Social media is being used by intelligence agents around the world to recruit people, and LinkedIn is a gold mine, Western counterintelligence officials say. Intelligence agencies in the US, UK, Germany and France have issued warnings about foreign agents reaching out to thousands of users on LinkedIn, with Chinese spies being the most active.

“We’ve seen Chinese intelligence agencies do this on a massive scale,” said William R. Evanina, director of the U.S. National Counterintelligence and Security Center. “Instead of sending agents to the United States, they recruit individual targets. It’s much more efficient to sit behind a computer in China and send friend requests to thousands of targets using fake profiles.”

The Chinese government’s use of social media for what U.S. officials say is nefarious purposes is drawing attention. Facebook, Twitter and YouTube said they had removed accounts spreading misinformation about the Hong Kong protests. Twitter said it had removed nearly 1,000 accounts. This is the first time Facebook and Twitter have blocked accounts linked to disinformation from China.

LinkedIn, owned by Microsoft, is a vehicle for spreading disinformation but, more importantly, it is an ideal tool for recruiting spies, US officials say. LinkedIn has 645 million users who use it to find job opportunities, mostly from strangers. On the other hand, LindedIn is also the only US social media platform not blocked in China.

Chinese spies often make offers of cooperation on various channels, including LinkedIn. They sometimes pose as recruiters for large corporations, offering attractive remuneration to targets for consulting, engagement or research support. From there, they develop a relationship with the target.

“The Chinese want to build relationships with people from the political, academic and business elites,” said Jonas Parello-Plesner, a former Danish foreign ministry official who was approached by a Chinese spy on LinkedIn. “Many of these people are looking for gray-zone intelligence or are looking for interference, influence or classic espionage.”

People who have recently left government jobs are often targeted because they are looking for new jobs, according to Parello-Plesner and other former officials.

Nicole Leverich, a LinkedIn spokeswoman, said the company actively searches for and removes fake accounts and has a team dedicated to handling information from a variety of sources, including government agencies.

“It’s very clear that we stand by our policies: Creating fake accounts or operating with the intent to scam or lie to members is a violation of our terms of service,” she said.

According to the AP news agency, some of the photos on the fake accounts were generated by artificial intelligence.

In a series of recent cases, LinkedIn has proven to be an effective spying tool. Kevin Patrick, a former CIA and Defense Intelligence Agency employee, was sentenced in May to 20 years in prison for spying for China. The relationship began in February 2017 after Patrick responded to a message from a Chinese intelligence officer posing as a representative of a research institute, according to the FBI.

The US Justice Department last October charged Yanjun Xu, a Chinese intelligence agent, with economic espionage after he recruited a GE Aviation engineer through a LinkedIn connection.

Evanina, director of the US National Counterintelligence and Security Center, said Chinese spies often contact thousands of people at a time on LinkedIn.

“Individuals in the private sector and academia are also approached this way,” he said. “Foreign intelligence agencies look for anyone who might have access to information they need, such as a company’s trade secrets, intellectual property or research.”

China's Foreign Ministry has not commented.

An unnamed former Obama administration foreign policy official has recounted in interviews a months-long process in which he was approached by someone who appeared to be a Chinese spy.

In May 2017, five months after he left his government job, a person calling himself Robinson Zhang contacted him on LinkedIn.

Zhang’s profile photo shows the Hong Kong skyline. He identifies himself as the director of public relations at a company called R&C Capital. In a message to the former US official, Zhang describes R&C as “an international consulting firm based in Hong Kong” that specializes in “global investments, geopolitical research, public policy, etc.”

“I am quite impressed with your CV and think you are suitable for some high-income opportunities,” Zhang wrote.

Still skeptical, the US official asked Zhang for the company's website. Zhang gave him the address of a website with a picture of the Eiffel Tower but little information about R&C Capital, which puzzled him.

In a message sent in August 2017, Zhang said Zhejiang University was looking for a speaker for a conference on Belt and Road projects before making further offers, although the two sides had not previously discussed the matter.

The former US official put Zhang in touch with an agency representing him but has not heard back.

R&C Capital's website says it is headquartered at 68 Mody Road in Hong Kong, but there is no company of that name in the city. Hong Kong's company registry does not record R&C Capital.

Parello-Plesner, the former Danish official, also had similar exchanges on LinkedIn with a user named Grace Woo, who contacted him in 2011.

Woo said she worked for DRHR, a headhunting firm in Hangzhou, China. When she learned that Parello-Plesner was traveling to Beijing in 2012, Woo asked him to travel to Hangzhou to meet with a representative of the company. She wanted Parello-Plesner to send her a passport photo to help arrange the trip, but he refused.

Parello-Plesner agreed to meet at the St. Regis hotel in Beijing. Woo did not show up. In her place were three middle-aged men. They said they were from a Chinese government research organization but did not have business cards.

“I thought the meeting was shady,” Parello-Plesner said.

These people said they could fund his research if Parello-Plesner would cooperate with them.

Parello-Plesner suspected the three men were security or intelligence officers and reported them to British authorities upon returning to London, where he was living at the time.

German intelligence officials in December 2017 named the DRHR as one of three front organizations for Chinese intelligence, and said Chinese spies had used LinkedIn to connect with 10,000 Germans. Last October, French intelligence agencies also reported to the government that Chinese spies had used social media sites, specifically LinkedIn, to connect with 4,000 French people. The targets included government employees, scientists, and company directors, according to Le Figaro.

However, it is extremely difficult to determine the origin of the people behind fake social media accounts.

US diplomat Brett Bruen said a user named Donna Alexander contacted him in 2017 on LinkedIn. Her profile said she was a researcher at the California Institute of Technology, but her profile picture showed an actress.

A representative for the California Institute of Technology said they had no employees by that name. Alexander’s LinkedIn network included White House officials and former ambassadors. “This person appears to be connected and accepted by a lot of people in the U.S. foreign policy establishment,” Bruen said.