Chinas Surveillance State Exposed: Leaked Documents Reveal Extensive Hacking Operations

Leaked documents from a private security contractor linked to Chinas top policing agency have exposed a vast network of surveillance and hacking operations targeting both Chinese citizens and foreigners.

Chinese police are investigating an unauthorized and highly unusual online dump of documents from a private security contractor linked to the nation's top policing agency and other parts of its government. The trove of documents catalogs apparent hacking activity and tools to spy on both Chinese and foreigners.

Targets of I-Soon's Tools

Among the apparent targets of tools provided by the impacted company, I-Soon, are ethnicities and dissidents in parts of China that have seen significant anti-government protests, such as Hong Kong or the heavily Muslim region of Xinjiang in China's far west.

Significance of the Leak

Analysts consider the leak highly significant, even if it does not reveal any especially novel or potent tools. The dump includes hundreds of pages of contracts, marketing presentations, product manuals, and client and employee lists.

Methods Used by Chinese Authorities

The documents reveal, in detail, methods used by Chinese authorities to surveil dissidents overseas, hack other nations, and promote pro-Beijing narratives on social media.

Hacking Tools and Techniques

The documents show apparent I-Soon hacking of networks across Central and Southeast Asia, as well as Hong Kong and the self-ruled island of Taiwan, which Beijing claims as its territory. The hacking tools are used by Chinese state agents to unmask users of social media platforms outside China, break into email, and hide the online activity of overseas agents. Also described are devices disguised as power strips and batteries that can be used to compromise Wi-Fi networks.

Response from I-Soon and Chinese Police

I-Soon and Chinese police are investigating how the files were leaked, according to two I-Soon employees who spoke to the Associated Press. The company held a meeting about the leak and employees were told to continue working as normal.

Source of the Leak

The source of the leak is not known. The Chinese Foreign Ministry has not responded to a request for comment.

Impact on I-Soon

The leak has had a significant impact on I-Soon. The company's website was fully offline, and a representative refused an interview request. I-Soon has stated that it will issue an official statement at an unspecified future date.

I-Soon's Operations

I-Soon was founded in Shanghai in 2010 and has subsidiaries in three other cities. The company's Chengdu subsidiary, which is responsible for hacking, research, and development, was open as usual on Wednesday.

Motives Behind the Leak

The source of the leak could be a rival intelligence service, a dissatisfied insider, or even a rival contractor. I-Soon's sponsors also include the Ministry of State Security and China's military, the People's Liberation Army.

Targets of I-Soon's Services

One leaked draft contract shows I-Soon was marketing "anti-terror" technical support to Xinjiang police to track the region's native Uyghurs in Central and Southeast Asia. The documents indicate that I-Soon mostly supports the Ministry of Public Security.

Targeting of Foreign Entities

The documents reveal that I-Soon has targeted organizations related to ethnic minorities, such as Tibetans and Uyghurs. The targeting of foreign entities can be seen through the lens of domestic security priorities for the Chinese government.

Low Cost of Hacks

The documents show that I-Soon charged relatively low prices for its hacking services. For example, the company charged $55,000 to hack Vietnam's economy ministry.

Potential Involvement of U.S. Cyber Operators

Although there is no indication of a successful hack of any NATO country, U.S. cyber operators and their allies are among potential suspects in the I-Soon leak. Leaking information about hacking NATO would be inflammatory and could prompt Chinese authorities to identify the hacker.

Link to Chinese State Hacking Group

Cybersecurity researchers have linked I-Soon to a Chinese state hacking group called Fishmonger. Fishmonger has been actively tracked since 2020 and has targeted governments, NGOs, and think tanks across Asia, Europe, Central America, and the United States.

Implications for Chinese State Surveillance

The leak of documents from I-Soon sheds light on the methods used by Chinese authorities to surveil dissidents overseas, hack other nations, and promote pro-Beijing narratives on social media. Such tactics instill fear of the Chinese government in Chinese and foreign citizens abroad, stifling criticism and leading to self-censorship.