The report published by the Oxford Internet Institute on September 26, 2019, indicates that foreign interference on the Internet primarily occurs through platforms like Facebook and Twitter. These operations are mainly conducted by cyber armies from seven countries: China, India, Iran, Russia, Saudi Arabia, and Venezuela. China has become a significant source of global disinformation, using social media platforms to target international audiences with fake news. It is estimated that around 300,000 to 2 million people in China are involved in these operations through local or regional offices1. As France completed its first round of elections on June 30 and the UK prepares for its general election on July 4, the topic of Chinese government interference in European politics has once again become a hot topic among experts.
Organisations Involved in Chinese Interference in European Politics
According to information published by the Taiwan Ministry of National Defense and the Army, China focuses on political, economic and military intelligence in collecting intelligence from European countries. This work is mainly carried out by the U61046 in the Eighth Bureau of the cyber warfare unit under the Network Systems Department2. The Chinese government also uses cyber-attack methods called "Advanced Persistent Threats" (APT) to hack into the systems of target countries, companies or individuals to steal data or carry out attacks.
Among them, APT31 is the most well-known cyber espionage organisation, focusing on obtaining political, economic and military intelligence that is beneficial to China. They have long exploited vulnerabilities in applications such as Java and Adobe Flash to damage victim environments, and have attacked many European countries.
Another group targeting European countries is APT10, which targets industries including construction and engineering, aerospace and telecommunications companies. Their methods of data theft include traditional spear phishing and gaining access to victim networks through hosting providers3.
The third group is APT40, which targets the European maritime industry and naval defence contractors. The UK National Cyber Security Centre (NCSC) determined that APT40 is most likely associated with China's Ministry of State Security and operates under key requirements of China's national intelligence. APT40 often sends spear phishing emails by impersonating well-known individuals who may be interested in their targets. This includes impersonating journalists, personnel from industry publications, or personnel from associated military organisations or non-governmental organisations (NGOs). NCSC determines that APT40 is most likely sponsored by the MSS Hainan Provincial State Security Bureau (HSSD)4.
The last organisation that mainly targets European countries is APT8. The industry involved in this organisation is media and entertainment, and its goal is to steal intellectual property rights. They send malicious links to potential victims through chat or instant messaging programs. Countries that have been threatened include the United Kingdom and Germany.
These organisations, which are suspected to be supported by the Chinese government, have been interfering with governments, companies and politicians in European countries for a long time, posing a serious threat to the political stability and privacy security of the target countries.
The UK, which is about to hold a general election this week, is one of the European countries most affected by China. Since 2017, some British MPs have pointed out that foreign forces such as Russia and China may have interfered in the June 2016 Brexit referendum5. The Public Administration and Constitutional Affairs Committee, made up of MPs in the House of Commons, said the government's voter registration website appeared to have been taken down by a cyberattack in the weeks leading up to the vote, which it suspected was a decentralized denial of service (DDoS) attack6. The website crash prevented both pro-Brexit and anti-Brexit voters from registering, forcing the government to extend the registration deadline, a decision some pro-Brexit campaigners were sceptical of because it was made by an anti-Brexit government.
In 2021, the British National Cyber Security Center (NCSC) is almost certain that the Chinese government-backed organization APT31 (also known as Judgment Panda, Violet Typhoon, Zirconium) launched hacking attacks on the data of millions of voters and hacked the electronic data of British parliamentarians. Online reconnaissance activity was conducted on the email account. Affected MPs include former Conservative leader Sir Iain Duncan Smith, former Conservative minister Tim Lawton, and Scottish National Party (SNP) member Stuart Macdonald.
According to a 2023 Times investigative report, Chinese intelligence agents tried to recruit thousands of British officials through LinkedIn, which has more than 930 million users, and offered them large amounts of money or lucrative business offers in exchange for British state secrets in their hands. . A Chinese intelligence officer named "Robin Zhang" bolstered his credibility by setting up fictitious securities firms and websites, as well as falsifying relationships with prominent academic institutions in London. Through these false identities and businesses, Zhang successfully established connections with British security officials, civil servants, academics and students who had access to confidential data and commercially sensitive technology7.
In addition, in 2021, the British Communications Authority (Ofcom) revoked the broadcast license of the Chinese state-owned media "China Global Television Network" (CGTN) in the UK because the licensee "Star Chinese Media Co., Ltd." It has no editorial rights and may involve spreading false information, in breach of UK broadcasting regulations8.
These cases demonstrate the Chinese government’s ambition to steal British government information and its attempts to achieve political goals by spreading false information.
A French parliamentary report released on June 8, 2023 stated that China’s intervention activities in France are growing and its methods are becoming increasingly aggressive. The report, prepared at the request of far-right party Marine Le Pen, stresses that China is second only to Russia in terms of foreign interference and poses one of the most serious threats to France. Bernard Emié, director of the French Foreign Intelligence Service, said that China has transformed from a "controlled power" to an "offensive power", especially in terms of unfettered diplomacy9.
Investigations show that China has borrowed tactics from Russia and used information manipulation, cyberattacks and espionage to challenge and undermine the Western order. China's intervention specifically targets its image and citizens in a "public opinion war" aimed at weakening liberal democratic institutions and indirectly promoting the People's Republic of China's political model.
In addition, China also controls a large number of Chinese-language media and promotes propaganda through trolls on social networks. The report states that these activities are carried out by Chinese officials and real netizens, including the "Wolf Warriors" of the Chinese Ministry of Foreign Affairs. The diaspora is both a vehicle and a target for intervention, and every Chinese citizen, even one with dual nationality, is considered an activatable intelligence agent.
The report also mentioned China's attacks on scientific and technological heritage and pointed out significant threats in the field of digital technology, including cybersecurity risks from TikTok and China's 5G. The report recommends remaining wary of Chinese telecom giants such as Huawei.
François-Xavier Bellamy, the leading candidate of the conservative Les Républicains in the upcoming European elections, revealed on Monday that he had been cyber-attacks targeted by APT31. The news, which came shortly after Socialist candidate Raphaël Glucksmann announced that he had been targeted by a social media disinformation attack, was a reminder of the threat of foreign interference that parties campaigning for June elections still face.
Another European Parliament candidate, Raphael Glucksmann, was also attacked with disinformation from China-related social media accounts in mid-April. He was accused of being a Trojan horse for the CIA in Europe. The incidents highlight China's ongoing threat of interference in European elections10.
Lithuania's national security service has warned of increased activity by Chinese intelligence agencies and intensified cyber espionage. "Chinese intelligence agencies have also increased their cyber espionage activities against Lithuania," Lithuania's national security agency said in a press release. "Cyber actors linked to China regularly conduct vulnerability scans on the networks of Lithuanian government agencies with the goal of penetrating their networks and stealing data."
The agency added: "Currently, the focus of Chinese intelligence agencies has turned to Lithuania's domestic affairs, political divisions and foreign policy. In the short term, Chinese intelligence agencies may seek to collect information on Lithuanian presidential and parliamentary elections, as well as European Parliament elections."
Authorities say actors use social networks to target potential victims, and the increase in attacks via this new vector is due to Lithuania's ability to limit the direct collection of information by Chinese intelligence agencies.
Lithuania's national security service also stated that Lithuanian citizens are targeted when traveling to China as they may be exposed during visits to third countries, especially Southeast Asian countries11.
In addition, two Lithuanian parliamentarians were also attacked by Chinese hackers. Dovilė Šakalienė and Žygimantas Pavilionis received attacks on IPAC members via malicious emails in early 2021. They believe Chinese hackers failed to break into their accounts12. However, these cases still illustrate that Lithuania is a target of political interference by the Chinese government.
China’s propaganda activities in the Czech Republic have gradually intensified and localised. According to a report by Czech Denik N, since October 2020, there has been a collaboration between China Radio International (CRI) and the Czech alternative website AC24, with dozens of anonymous articles appearing on the website, mainly written by local Czech authors.
The articles promote China's economic achievements, technological progress and global role while attacking the United States and Western countries. The articles often use local languages and anti-Western narrative styles to attract Czech and Slovak readers, and are often forwarded on social media. In addition, the Chinese Embassy used these articles to create the illusion of positive reports in the Czech media and to demonstrate foreign support for China's policies in the country13. This strategy shows that China is gradually moving from improvisation to a systematic strategy, imitating Russia’s propaganda model and trying to influence global public opinion by establishing alternative sources of information.
China’s interference in European elections is increasing day by day, and its methods are becoming more complex and diverse. According to multiple reports and studies, China poses a serious threat to many European countries through cyber attacks, dissemination of disinformation and espionage activities. In the UK, the China-backed APT31 group launched multiple cyberattacks on the 2016 Brexit referendum and MPs’ email accounts. In France, a parliamentary report pointed out that China’s interference has become more aggressive and is mainly aimed at public opinion warfare and penetration in the field of digital technology. Lithuania also warned that Chinese intelligence agencies have stepped up espionage activities on its domestic and foreign policies, especially using social networks to target potential victims. The Czech Republic has been affected by China’s external propaganda and has received a lot of disinformation.
These cases demonstrate the Chinese government’s attempts and implementation of its disinformation strategy to interfere in European politics. To better understand and respond to this phenomenon, our political services will use their linguistic and geopolitical expertise to closely monitor these developments. Please follow us to receive the latest updates in this series of articles. By illuminating these key issues, we hope to deepen our understanding of China’s disinformation strategies and promote a more effective global response.
1. FTVNews. "Oxford Research: Global Fake News Originates from 'These SevenCountries' China Wins the Championship with 2 Million Internet Users."September 27, 2019. https://tw.news.yahoo.com/%E7%89%9B%E6%B4%A5%E7%A0%94%E7%A9%B6-
2. Zhu,Rongde, and Jianpeng Li. "A Study on the Functional Development of theCCP’s Strategic Support Forces and Its Impact on China’s InformationWarfare." December 2021. https://www.mnd.gov.tw/NewUpload/202112/p67-93_355736.pdf.
3.Mandiant. "Advanced Persistent Threats (APTs)." https://www.mandiant.com/resources/insights/apt-groups.
4. GOV.UK."UK and Allies Hold Chinese State Responsible for a Pervasive Pattern ofHacking." July 19, 2021. https://www.gov.uk/government/news/uk-and-allies-hold-chinese-state-responsible-for-a-pervasive-pattern-of-hacking.
5. rfi."Russia or China May Have Interfered in Brexit Vote, Say MPs."November 10, 2018. https://www.rfi.fr/en/europe/20170412-russia-or-china-may-have-interfered-brexit-vote-say-mps-5.
6.Poireault, Kevin. "UK Blames China for 2021 Hack Targeting Millions ofVoters' Data." March 25, 2024. https://www.infosecurity-magazine.com/news/uk-blames-china-for-2021-electoral/.
7. Li,Bo'an. "Chinese Spies Use LinkedIn to Steal British Intelligence."August 24, 2023. https://www.voacantonese.com/a/china-used-linkedin-to-spy-on-uk-20230823/7239213.html.
8. TNLEditor. "The UK Revoked the Broadcast License of 'China Global TelevisionNetwork' in the UK, and China Countered That the 'BBC' Had Fabricated andSlandered." February 5, 2021. https://www.thenewslens.com/article/147028.
9. Basso,Davide. "China’s Interference Is ‘Increasingly Aggressive’, FrenchParliamentary Report Finds." June 9, 2023. https://www.euractiv.com/section/defence-and-security/news/chinas-interference-is-increasingly-aggressive-french-parliamentary-report-finds/.
10. Brunet,Romain. "Europe’s Election Campaigns Are under the Constant Threat ofForeign Interference." May 7, 2024. https://www.france24.com/en/france/20240507-europe-s-election-campaigns-are-under-the-constant-threat-of-foreign-interference.
11.Stankevičius, Augustas. "Two Lithuanian MPs Targeted by Decade-LongChinese Hacker Campaign." April 3, 2024. https://www.lrt.lt/en/news-in-english/19/2241549/two-lithuanian-mps-targeted-by-decade-long-chinese-hacker-campaign.
12. Stahie,Silviu. "Lithuania Warns of Chinese Intelligence Services Using SocialMedia to Target Victims." March 12, 2024. https://www.bitdefender.com/blog/hotforsecurity/lithuania-warns-of-chinese-intelligence-services-using-social-media-to-target-victims/.
13. Sebok,Filip. "Czechia: A Case Study of China’s Changing Overseas PropagandaEfforts." April 30, 2021. https://thediplomat.com/2021/04/czechia-a-case-study-of-chinas-changing-overseas-propaganda-efforts/.
Registered in England and Wales (number 14885394) whose registered office is at 20-22 Wenlock Road, London, N1 7GU.
Address: 20-22 Wenlock Road, London, N1 7GU
Email: contact@blackroomintelligence.comPhone: +44 (0) 208 058 2971Linkedin: linkedin.com/black-room-intel.png)
.png)
