Over the past three decades, observers have become far better at documenting the Chinese Communist Party (CCP)’s global espionage and influence activities, from U.S. Navy sailors selling warship secrets and employment ads that presage espionage pitches to the hacking of infrastructure. Hundreds of prosecutions, intelligence assessments, cyber investigations, and indictments have revealed how Chinese intelligence officers and their collaborators recruit agents, acquire technology, conduct cyber intrusions, and pursue influence operations around the world.
The affidavits supporting these indictments are particularly detailed in the United States. Prepared by experienced FBI and other federal investigators working alongside assistant U.S. attorneys, they often provide unusually detailed, evidence-based accounts of how investigations unfolded and how suspects allegedly incriminated themselves.
This growing body of evidence has transformed our understanding of the scope and methods of Chinese intelligence operations. Nicholas Eftimiades and other researchers have compiled an extensive literature documenting Chinese espionage cases, identifying who was recruited, what was targeted, where and when operations occurred, and what patterns emerged. Their work has been indispensable in demonstrating the scale of the challenge and the economic and national security costs it imposes.
The literature is evolving, reflecting a maturing understanding of the challenge itself. The earliest studies sought to establish that Chinese intelligence posed a significant and growing threat. Later scholarship assembled hundreds of individual cases into an empirical record from which recurring patterns could be identified. More recent work has shifted again, asking a different question: What kind of political and institutional system consistently produces these operations? The field has evolved from documenting espionage to explaining the party-led system behind it.
Building on this empirical foundation, scholars such as Peter Mattis, Alex Joske, Samantha Hoffman, Adam Kozy, and Nigel Inkster have shifted attention from individual espionage operations to the CCP’s objectives, institutions, and organizational mechanisms. Rather than asking only what happened, they ask why the party conducts intelligence as it does, how intelligence activities are organized and directed, and who participates beyond the formal intelligence services.
That perspective reveals something fundamental. Chinese espionage is best understood not as the activity of a handful of intelligence agencies. It is the product of a CCP-led political system that treats intelligence as one instrument of governance. The Ministry of State Security (MSS), the Ministry of Public Security (MPS), and the People’s Liberation Army (PLA) are indispensable components, but they operate within a much larger party-state system that integrates political authority, intelligence collection, influence operations, technology acquisition, and selected elements of Chinese society in pursuit of regime security and national power.
China’s Party-Led Intelligence Ecosystem
The MSS, MPS, and PLA remain the principal professional intelligence and security organizations. The MSS serves as China’s primary civilian intelligence and counterintelligence service. The MPS and its subordinate provincial Departments and local Public Security Bureaus focus primarily on domestic security but increasingly support overseas intelligence collection and transnational repression, particularly where local jurisdictions maintain ties to overseas Chinese communities – e.g. the dozens of overseas “police stations” exposed by Safeguard Defenders and others. The PLA contributes military intelligence, technical collection, cyber capabilities, and support to military modernization.
Yet these organizations constitute only the professional core of a much broader CCP-directed ecosystem. Around them operates a network of state-owned enterprises, private technology firms, universities, research institutes, United Front organizations, commercial contractors, and individual “non-traditional collectors.” Recent leaks involving the cyber contractor iSOON and analysis of them by Natto Thoughts illustrated how ostensibly private companies can perform state security missions while providing varying degrees of deniability for government agencies.
Describing this as a “whole-of-society” effort risks overstating the case and alienating diaspora communities needed to resist the CCP’s illegal efforts. The party does not mobilize Chinese society in its entirety. Most Chinese citizens understandably avoid politics whenever possible. Rather, the CCP selectively mobilizes those sectors of society most useful to its objectives – government agencies, technology firms, universities, research organizations, professional associations, overseas organizations, and selected individuals. It is therefore more accurate to describe this as a party-directed, whole-of-system approach than a genuinely whole-of-society one.
The “Why” and “How” of China’s Intelligence Operations
The CCP’s intelligence system serves political objectives before operational ones. At its center lies regime security: preserving the party’s monopoly on political power. Intelligence collection, political influence, technology acquisition, military modernization, and economic development are not separate missions but mutually reinforcing components of a single political strategy.
This integrated approach explains why Beijing invests simultaneously in cyber espionage, human intelligence, influence operations, technology acquisition, and transnational repression. Advanced technology strengthens national power. Political influence abroad helps reduce external threats to party rule and shape international perceptions. Intelligence supports military modernization, while domestic security protects the CCP’s domestic infrastructure. Whether examining Taiwan, Southeast Asia, Europe, North America, or elsewhere, the strategic logic seems consistent.
Xi Jinping’s expanding national security legislation reflects this conception of governance. The National Security Law, Counter-Espionage Law, National Intelligence Law, Data Security Law, and related legislation embed intelligence and security responsibilities throughout the party-state apparatus. Unlike earlier periods, when this was an unwritten norm, Xi’s legal reforms explicitly codify the expectation that organizations and citizens support national security work while providing CCP authorities with a comprehensive legal framework for enforcing compliance.
This serves two purposes: it tells a hitherto underinformed and often naive citizenry what are their obligations to state security, and it provides visible boundaries to corrupt officials that might dissuade at least some from unauthorized exploitation of the masses, or leniency toward the favored few.
The party’s intelligence system now rarely relies upon a single method. Human recruitment, cyber operations, commercial relationships, legal authorities, influence activities, and transnational repression are combined rather than employed independently. A cyber intrusion may facilitate human recruitment. Commercial partnerships may create intelligence opportunities. Influence operations may prepare the ground for technology acquisition. The individual case often represents only one visible component of a much larger campaign.
The system also adapts continuously. Under Xi, intelligence work has become more centralized politically while becoming increasingly decentralized operationally through expanded reliance on contractors, commercial entities, technical specialists, and digital technologies. This combination enhances both scalability and plausible deniability while allowing the CCP to draw upon capabilities well beyond its formal intelligence agencies.
Implications for Policy
If China’s intelligence challenge is systemic, democratic responses must also be systemic.
Prosecutions remain indispensable, but they address only the consequences of successful intelligence operations rather than the institutional structures that generate them. Policymakers must first understand the CCP’s intelligence system itself – not merely the individual agencies operating within it. They must appreciate the distinct missions the party assigns to intelligence organizations: regime protection, political intelligence, technology acquisition, military support, influence operations, and transnational repression.
Governments should strengthen institutional resilience through improved counterintelligence awareness, research security, protection of critical technologies, and stronger support for overseas Chinese and PRC minority diaspora communities targeted by transnational repression. Those communities should be treated as partners in democratic resilience rather than viewed with suspicion because of ethnicity or national origin.
Policy must also focus on the intermediaries that enable intelligence activity: contractors, front companies, research partnerships, commercial entities, and co-opted individuals who occupy the space between government and society. Close coordination among allies – in intelligence sharing, export controls, investment screening, research protection, and countering transnational repression – will remain essential.
Finally, policymakers should recognize that the party’s intelligence system reflects nearly a century of institutional evolution rather than a recent innovation. Since the CCP’s underground organizations of the late 1920s, intelligence has been regarded as an indispensable instrument of revolutionary struggle, political control, and state power – a core business of the dictatorship. Organizations have been reorganized, renamed, merged, divided, and rebuilt, but the underlying conception has remained remarkably consistent. Today’s MSS and related institutions are best understood as the latest expression of a long-standing party tradition rather than creations of the reform era or Xi Jinping alone.
The challenge posed by China is therefore not simply one of espionage. It is the challenge of confronting a party-led intelligence ecosystem that integrates political authority, security institutions, economic policy, technological development, and selected elements of society into a coherent system of state power. Democratic governments have become much better at identifying individual operations. Their next task is to understand – and respond to – the system that generates them and devote the resources necessary to credibly respond.
The situation will only deteriorate unless the world’s democracies up their game to match the expanding challenge – without needlessly demonizing ethnic Chinese communities.
