From the 20committee blog

The OPM Hacking Scandal Just Got Worse

June 11, 2015

The other day I explained in detail how the mega-hack of the Office of Personnel Management’s internal servers looks like a genuine disaster for the U.S. Government, a setback that will have long-lasting and painful counterintelligence consequences. In particular I explained what the four million Americans whose records have been purloined may be in for:

Whoever now holds OPM’s records possesses something like the Holy Grail from a CI perspective. They can target Americans in their database for recruitment or influence. After all, they know their vices, every last one — the gambling habit, the inability to pay bills on time, the spats with former spouses, the taste for something sexual on the side (perhaps with someone of a different gender than your normal partner) — since all that is recorded in security clearance paperwork (to get an idea of how detailed this gets, you can see the form, called an SF86, here).

Do you have friends in foreign countries, perhaps lovers past and present? They know all about them. That embarrassing dispute with your neighbor over hedges that nearly got you arrested? They know about that too. Your college drug habit? Yes, that too. Even what your friends and neighbors said about you to investigators, highly personal and revealing stuff, that’s in the other side’s possession now.

The bad news keeps piling up with this story, including reports that OPM records may have appeared, for sale, on the “darknet.” Moreover, OPM seems to have initially low-balled just how serious the breach actually was. Even more disturbing, if predictable, is a new report in the New York Times that case “investigators believe that the Chinese hackers who attacked the databases of the Office of Personnel Management may have obtained the names of Chinese relatives, friends and frequent associates of American diplomats and other government officials, information that Beijing could use for blackmail or retaliation.”

We can safely replace “may” in that quote with “almost certainly did” since for Chinese intelligence that would be some of the most valuable information in any of those millions of OPM files. Armed with lists of Chinese citizens worldwide who are in “close and continuing contact” (to cite security clearance lingo) with American officials, Beijing can now seek to exploit those ties for espionage purposes.

This matters because, while many intelligence services exploit ties of ethnicity to further their espionage against the United States — Russians, Cubans, Israelis, even the Greeks — none of the major counterintelligence threats to America are as dependent on blood ties as the Chinese. Simply put, in its efforts at recruiting spies abroad, Beijing is often uncomfortable operating outside its ethnic milieu. Spies run by Beijing who are not ethnic Chinese are very much the exception. This poses less of a problem for them that it might seem, however, as there are something like fifty million “overseas Chinese” worldwide, including about four million living in the United States.

Nearly every espionage case in the United States involving Beijing comes down to the ethnic angle, somewhere. To cite only a few examples, among many, Larry Wu-Tai Chin, a CIA translator/analyst, passed highly classified information to Beijing for over thirty years. Katrina Leung managed to severely damage FBI intelligence against China for years, in a complex and messy operation that confounded the Bureau. Then there’s the messy case of Wen Ho Lee, a scientist employed at Los Alamos National Laboratory, whom U.S. counterintelligence believed passed significant amounts of classified nuclear information to Beijing. Most recently was there was the case of Xiafen “Sherry” Chen, a Federal worker who was caught having unreported meetings with a Chinese regime official.

It should be noted that all the persons mentioned in the previous paragraph were born in China (Lee was born in Taiwan) then immigrated to the United States. They seem to have been persuaded to betray their adopted country on behalf of their native land. Ms. Chen, against whom serious charges were recently dropped, has alleged ethnic bias in the FBI’s pursuit of her, as did Wen Ho Lee. Members of Congress and ethnic activists have joined that chorus too. Interestingly, Beijing has sung the same tune, with regime outlets alleging that anti-Chinese prejudice is at the root of U.S. counterintelligence efforts. However, whatever blame here lies in Beijing, not Washington, DC, since it is China that is exploiting its nationals abroad to further their espionage.

Beijing also uses its citizens abroad to facilitate espionage. An interesting recent case in Hawaii, which is something of a hotbed of Chinese spying, given the large number of U.S. military commands housed on Oahu, involved a retired U.S. Army officer and defense contractor working at U.S. Pacific Command who apparently got honey-trapped by a fetching young Chinese student (this is being a common Chinese tactic). Benjamin Bishop has been sentenced to more than seven years in jail for stealing classified information from work and passing it to a Chinese woman less than half his age, who was in the United States on a student visa.

The modus operandi of Chinese intelligence and its operations abroad are understood by the FBI and the Intelligence Community. However, the extent of the information loss in the OPM hack is so vast that all the counterintelligence awareness in the world may not be able to offset the advantage in the SpyWar that Beijing has won with this vast data theft. If you are (or have been) employed with the Federal government and have listed Chinese persons in any way on your SF86, it’s time to be vigilant.