China Warns of Espionage Risks in Outsourced Services, Citing Multiple Cases

The Ministry of State Security (MSS) in China has revealed details of three espionage cases involving individuals working for outsourced service providers, highlighting the risks associated with such arrangements. One case involved a cleaner employed by an outsourced provider who actively engaged with foreign intelligence agencies. This resulted in the theft and disclosure of classified information, posing a significant threat to national security.

The MSS explained that some outsourced personnel, due to the nature of their work, may have access to sensitive areas or participate in specialized tasks, thus increasing their potential access to national secrets. The failure to implement strict confidentiality measures can lead to serious leaks. In the first case, a property service company, lacking adequate security oversight, was contracted to manage the office building of a key secret-related unit. A cleaning staff member, driven by personal motives, contacted foreign intelligence agencies and, under their direction, stole and photographed classified documents. This individual provided classified and confidential state secrets, along with other intelligence items, to the foreign agencies, resulting in a significant breach of confidential information.

Another case involved a netizen selling classified documents online. The investigation revealed that the company involved did not have the proper qualifications to digitize classified archives but had deceived government agencies to secure contracts for handling archive materials. An employee of the company stole and copied numerous classified documents, subsequently posting them online for sale, leading to the leakage of state secrets.

The MSS also noted that foreign intelligence agencies are actively targeting key security sector enterprises, employing tactics such as phishing and network scanning. They specifically target operations and maintenance personnel who possess system management privileges. In one instance, an operations and maintenance staff member at an e-mail system manufacturer, who had remote management and system administrator account privileges, stored client account passwords and system administrator passwords on a personal computer. Foreign intelligence agencies targeted this individual, launching a cyberattack to steal the stored password information. They then used this information to conduct espionage on the e-mail systems of over a thousand key departments, obtaining a large amount of internal e-mail data.

The MSS emphasized the importance of not overlooking potential leaks in service outsourcing arrangements. Confidential agencies and institutions must remain vigilant and strengthen their management and preventive measures to safeguard state secrets.