Charity Wright on China’s Digital Colonialism

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda.

Loop.Com hello, I'm Bob Gourley, the Chief Technology officer of OODA LLC. And today on the Oodacast, Charity Wright. Charity is a former NSA and U.S. army analyst and currently an expert cyber threat Intelligence analyst at Recorded Future. Charity, welcome to the oodacast.

Thank you. It's great to be here.

I'm so excited to talk to you. Charity. I want to talk to you about some of your current research, but would also like to talk to you about your background and wanted to ask, before we get into this, if you could give us a little bit of your bio.

Absolutely. I started my career in the US army in 2005. I was at that point in my third year of college and was feeling a little bored and antsy. So I somehow got roped into becoming a linguistic in the army and I happened to luck out with a recruiter that knew exactly what that meant. So I joined to be a linguist. The army assigned me to Mandarin Chinese, and then I was stationed at National Security Agency to do intelligence analysis and translation. So that's how I kind of kick started my intelligence career. Fell in love with it, fell in love with the Chinese language culture, people, and just became really interested in what's going on with the Chinese Communist Party. I finished my bachelor's degree at Hawaii Pacific University in International Studies and then I continued on to the cybersecurity industry and I pivoted over to private sector where I got to really dig in on malware analysis and nation state hacking campaigns. So that's what I've been doing for at least the past seven years. My focus has been on China, but I also do a lot of strategic geopolitical reporting and research. So anything related to cyber threats, asymmetric warfare, you know, active measures like Russia calls it. And now at Recorded Future, I'm part of the global issues team and we are a geopolitical intelligence team. And I get to focus solely on Chinese influence operations, which is a really hot topic to research right now.

Yeah, it really is. And that team at Recorded Future, is that the Insick Group?

Yes, INSEC Group is our analyst and research team. And then within Insick Group, we have several subsections that focus on certain areas like nation state threats, geopolitical threats, periodicals, and weekly reporting that, things like that.

And what does insic mean?

Insect is Swedish, I believe. It means insights or understanding.

Well, that makes sense. So, all right, that brings us to Recorded Future. And how does one get A job at Recorded Future. Everybody knows them in the intel world, but how did you come to be on their radar and get drafted into this organization?

Oh, man, this is one of my favorite stories actually. Recorded Future has grown so much, especially over the past year or two. And I've actually been a client of Recorded Future for many years. So ever since my very first cybersecurity job, I was using the Recorded Future platform to do open source intelligence research and analysis. So we've had a very close relationship over the years. And there, there came a point where I was ready to kind of pivot to the vendor side and they had an opening for an expert CTI analyst, which is a very public facing role, is a lot of what I do. And it was a perfect fit. So I reached out to some of my friends in the company and got into the interview process. Now there are a couple different ways to get into Recorded Future. One is we are posting our openings all over Twitter, LinkedIn, social media, and we have that, those openings on our website. And then also, if you know somebody that works at Recorded Future, shoot us your resume and what position you want and we can put you in through the referral system. So that's another great way to kind of fast track your resume to the top.

Cool, great, thanks. All right, and then another related question. You go to Recorded Future, you come with a background from army and nsa, plus some industry time. Is that where you learned your analytical trade crafts was the Army? Is that where you get the basics? Or tell us about that? How did you learn to be an analyst?

Yeah, I would say I definitely gained my first and foundational understanding of intelligence analysis at the National Security Agency. So we working in the SIGINT mission there was really exciting, very fulfilling mission, being able to help protect U.S. assets in the Pacific. I was stationed in Hawaii and that mission was pretty exciting. But that really gave me an understanding of the difference between mere information and valuable intelligence that could be expedited up to the White House for protection of our troops. So, so having that foundation really helped. And in the army we do a lot of wartime intelligence tradecraft and education. So I was actually a sergeant in the army, was able to be training, you know, my squad, I was a squad leader at the time, so that definitely helped. And then when I interviewed for a cybersecurity role, to be completely honest, I knew nothing about cyber or it. I, I knew nothing about network security, but it's like learning a new language. So I figured, okay, I know how to analyze intelligence. I just need to Apply it to a different form of threat, which is cyber threats. And luckily I had great leaders who were military veterans and they knew, hey, you've got the intel foundation that we need. We'll teach you the cyber stuff. So that's kind of how it worked out for me.

Yeah, and charity. There's a lot of folks that I hear from that have a similar path like that. It sounds in fact a lot like mine. I was an all source analyst, a Navy intelligence officer and I got pulled into this new world of cyber and I took all those old methods of all source analysis and applied it to this new mission domain and studied the technology. And that was back in 98. So I think there's a lot of us have that kind of journey.

Yeah, absolutely. Well, thank you for your service. I won't hold the Navy part against you.

I was very joint, if that counts.

In fact, yes, me too.

My first boss was Air Force. My second boss was army and great bosses at this, the first Cyber Command joint task force for computer network defense.

That's amazing. That's really cool. I think when I was at the Agency, I was finishing my, my time around 2010. That's when they really started recruiting Chinese linguists from the second mission to go to cyber. Now I don't know if my Mandarin was at that level, but I ended up getting out around 2011 anyway.

Cool. Well, I want to ask you some other tradecraft kind of questions and one is I know analysts get training in methodologies and also the fact that we all have biases. We're human, we need to do things to mitigate these biases. I think that's more important than ever, especially in this fast moving world of cyber and also in this world we live in where all of us are on social media and we're consuming media that sometimes is full of anger and hate and polarization and extreme emotion. And I think it's harder than ever to maintain good, open minded analytical methodologies. Do you agree and if so, what kind of tips do you have for us on how to keep an open mind when doing analysis?

It really is very challenging. And you know, there's memes out there about how everyone believes they're expert cyber researcher because they can use Google. But it's so much more than that. And I think that's the, the gap in understanding in our society today is, is sometimes people don't know who to trust, where to go for, for good information and unbiased reporting. So yeah, it is, it is one of our major challenges right now. With countering, you know, disinformation and misinformation. I think that as an analyst it's important for us to be aware of our own bias, especially when we're scrolling through personal social media feeds. I know for me, I had to take a little break from Facebook during election season because it was just a lot and I have a variety of friends with lots of different views and it started getting kind of intense. Personally, as much as I am opinionated and I wanted to step in and, and clarify untruths, I had to step back and go, you know what, I don't have to fight every fight. Sometimes we just have to take a step back and recognize when we feel emotional in response to social media or in response to a news story and question why and what is soliciting that emotional response and then take a step back, go, okay, what's the truth here and what's not? Maybe we don't know answers and that's okay. Sometimes we just have to be okay with not knowing the truth. That's hard.

Have you ever sensed that someone is intentionally trying to manipulate you because you're a cyber analyst? And the reason I ask that is seems like that would be a danger. If you're reporting on these big nations like Russia and China, you're known to be doing that. Is there any chance that you might be a target of their malicious influence campaigns? And if so, how would you inoculate yourself against that?

Yeah, personally I'm very, I'm a very paranoid analyst. I don't add just anyone to my social media feeds or even to LinkedIn because I understand the risks of social engineering and fishing. Also, I have been collected on in the past by CCP sponsored spies. Basically. I know of a couple of incidents for sure. So I am very cautious, especially because I'm in a very public facing role where I report publicly and help reveal on behalf of recorded future we what the Chinese state is doing as far as threat activity. So you know, I think step one is just having a healthy paranoia and just being cautious and using common sense. And then also anytime somebody has an opposing view, I just first listen and say, okay, I hear you. I recognize that's your opinion. We may different opinions. It's not worth fighting about. But honestly I don't think I've had any foreign agents trying to manipulate me into sharing misinformation. I think I would see that coming, but nobody's foolproof. So you just got to be cautious.

Right. Being cautious I think is is good advice for all of US I think.

Honestly, I think the bigger risk for Americans or anyone in the five eye countries like UK and Canada as well, I think the bigger risk is that foreign countries like China and Russia, they want to kind of tear us apart from the inside. They may pose as Americans and try to stir up dissent and argument and conflict to create division and sow division in our society. So I'm more cautious about who am I engaging with in neighborhood Facebook groups or who am I engaging with in LinkedIn comments that seem to be argumentative or really strongly opinionated because essentially you don't know for sure. Unless you know that person personally, you don't know for sure that you're actually speaking to an American. There are Russian trolls, Chinese trolls, Iranian trolls. Well, you know, Iran got caught posing as proud boys last year or in 2020 during the election season in social media. So we know that happens. We just have to be really cautious about who are we really debating and do we need to.

Right, right. I'd like to shift now charity and ask a little something a little closer to your expertise of China. And that is one of the reports that you guys produced at Recorded Future focused on China's digital Silk Road and this China's digital colonialism in July 2021. I really liked that report for a lot of reasons. In fact, I think it's really one of the best I've read because to me, it said things that I had no idea were occurring. I thought I understood what was happening with China's infrastructure programs and their telecom, but I had no idea the kind of insights that you developed there in that report. And to me, it's an actionable kind of report that I think a lot of people should pay more attention to. So first, kudos on that.

Thank you very much. I appreciate that.

And I will be linking to that report in our show notes on both the video and the podcast version of this for anybody to get to it. But maybe you could tell us why people should read it. Can you give us a little overview of what's in this report?

Yes. So as a China researcher, I like to really kind of zoom out and see the big picture. And I think that's very useful in predicting future patterns of behavior, like what they might do forecast the threat. Last year I was doing a lot of research. We kept seeing news reports about new infrastructure projects that China is doing overseas, like in Latin America or South Asia or Africa. Africa in particular. Not just Belt and Road Initiative projects like bridges and roads and things like that, but the Digital Silk Road is a nickname for their IT projects. So they're laying underground cable, they're putting satellites in space, they are establishing Internet infrastructure in countries that haven't had it before, which is very helpful and useful for many of those countries. They want to be connected to the rest of the world. Now my concerns were when we started seeing reports of cyber espionage campaigns from China using that infrastructure to collect intelligence on people, governments in those recipient nations. That's very concerning because now all of a sudden it appears that the Chinese state is using these infrastructure projects as a foothold for espionage overseas. So that's what really triggered me to do this research, was this is very concerning what is the scope and the scale of what's happening. So when I started digging into the research, what I discovered was that there are hundreds of of digital projects around the world that Chinese companies are sponsoring. Some of them are being gifted to these nations and to some of these political regimes. And what China gets in trade is they get access to the information oftentimes and they also get access to very important AI data through surveillance systems and, and security mechanisms that they're providing these countries. Now there's two different sections to this report. One is the espionage side, which we're definitely concerned about in the west because of the billions of dollars that were basically bleeding out from Chinese espionage, technology transfer and the theft of proprietary information from both private and public sector. But then the other side of the report is about human rights surveillance concerns. That is that these Chinese tech companies are providing very advanced facial recognition devices and software and in trade for providing it to countries like, let's say in Africa or Latin America, they also get access to that data to help further refine how the algorithms are working on dark skinned individuals. And knowing how China is using this type of technology inside their own country to imprison Muslims and target specific religious groups, we're very concerned about what that means for these recipient nations as well. And what we discovered was that oftentimes they're not just providing the, the devices themselves and the networks and the servers. They're also sending teams over to train these police troops and military troops and governments how to use it the way they're using it in China. That's a big concern.

One of the phrases you use in there is a autocratic toolkit, as in the Chinese are providing an entire autocratic toolkit to, to these many leaders who want to surveil their own people and use it for population control and maintain their own power and push back against any kind of democracy or opening up in their country. And to me, that's a very scary thing because it's just not only are they send money to China, they bring China's technology in China benefits from espionage, but then that country controls their populace more and crimes cramps down on freedom. And yes, seems very negative. And I felt a little bit pessimistic about it, frankly.

Oh, I know. And so many people said charity, this report's really scary and I did not mean for it to come off that way. But as a threat analyst, you know how it goes. We're analyzing, we're analyzing specific adversary nations and the behavior and the activities that they're doing that may pose a threat to their competitors, which would be the United States and the five eyes. Now, big picture for this report is the background is very important. And the background is that democracy in the world today is in decline for the 15th consecutive year. That's very concerning because if we want to promote our values, democratic values, freedom, liberty and freedom of information around the world, we need democracies to be strong. And that's something that we have seen a steep decline, especially in the past year in the midst of false allegations of widespread election fraud in the United States, the insurrection that happened on January 6th. All of these factors contribute to the decline of democracy in the world, especially with, with the United States always being pretty much the beacon of what that looks like or what it should be modeled as. So knowing that that is going on, what we're most concerned about is the increase in the spread of China's socialism with Chinese characteristics. And whether or not that's their objective is debatable. I have colleagues that argued no, China's just trying to grow in their own right and reclaim what they believe is their rightful place at the top of the global world order. Well, that itself would be considered a threat to the United States because right now the United States is number one. So displacing the United States is considered, you know, a very concerning trend. So that's where the report really came from, is this place of, okay, here's what we're most concerned with right now. Looking at these trends and the way things are, are going, we need Western nations to step in and kind of interrupt, maybe work with these countries, these more developing countries, work with them more, offer, you know, cost efficient solutions or alternatives to technology from companies like Huawei, zte, Cloudwalk, the ones that are based in China and maybe, maybe overusing their access to those recipient countries, charity.

I think you actually end the report in a way that I think is kind of a call to action for open societies to work closer together and understand that they don't have to just take all this. We can do more together. So I like that. And I would like every leader in every open society to read this report and get on a common baseline understanding of what's happening in this digital colonialism coming out of China.

Absolutely. And since the report was written earlier this summer, we have seen some organizations taking action, which is very encouraging. We've had the attention of the US Government. President Biden just held the Summit for Democracy last week. And the three main objectives of that summit really addressed the, the concerns that we put forth in this report. In addition, I think G7 has met about countering China's global influence. And you know, the US China Commission I had a meeting with yesterday about, about this exact topic. So it's very interesting.

Well, to help people understand why it's so important to read, would you walk us through one of the case studies you've done here? You, you list eight case studies in your report, many in Africa, South America, Latin America. Can you pick a favorite and walk us through one of the case studies?

Yes, I can. Since we released it on recorded future websites, I've also revised it and updated it for the John Hopkins University School of International Studies Journal, which will, I think the updated version will be out this very soon actually. But let me scroll down to some of the case studies. I think one of the most. Yeah, I'll start here. One of the most impactful case studies in this report was African Union. Now this one is a little more widely known of, but because of the reporting that was behind it, there were some news sources that reported on this incident. In January of 2017, the African Union headquarters in Ethiopia received, let's say, a brand new beautiful building. It was received from China. The Chinese government gifted this beautiful building to the African Union and it came with a full IT center and it was very modern and upgraded the IT equipment and the, the network was provided by Chinese companies. Now what happened was they, okay, so they were gifted the building in 2012. When they opened later in January of 2017, some of the computer scientists at African Union that were employed there started seeing suspicious data traffic. Basically they discovered massive amounts of data being transferred to unfamiliar servers in Shanghai, China. So this was happening every night between midnight and 2am and when they brought this concern up, they were met with some pushback from the Chinese teams that had installed it. And they actually discovered that there were two digital backdoors built in to their Data infrastructure at the African Union. Now, not only that show just how espionage was being conducted, transferring very important geopolitical secrets and happenings from AU to Shanghai, but they also discovered that there were wiretaps built into walls and installed under desks in very important meeting and conference rooms. And all of this built by and established by Chinese companies that provided it. I believe it was zte. So that was a very concerning discovery. After that they ended up ripping out all that infrastructure and replacing it with infrastructure from a different company. But that was just one example out of over a dozen that I discovered where China had installed some new data infrastructure servers. At first it was managed by the Chinese companies, engineers, excuse me, and then it was handed over to the local people to run those servers and they had no idea that the back doors were even installed. So that's a significant finding.

Yeah, this, it really reads like a drama or a science fiction. It's just you'd never believe they would have the audacity to do this. And they do it.

Yeah. You know, in the report I wrote when confronted with this information, African Union authorities remarked that this was the cost of, quote, unquote, being supported in the independent struggle on the continent and being helped economically. And it's sad to me that these independent governments and regimes are just accepting the cost because they need the infrastructure so bad. If they want to develop and get on pace with the rest of the world, they need to be connected to the Internet. Their people need access to computers and video calls so they can do business internationally and bring investment into their countries. But at what cost? And does it have to be a low cost China option or are the competitors going to offer a healthy alternative that is a reasonable, fair deal that does not include backdoors to spy on them?

Yeah, you know, you just fired another neuron here. I'm thinking maybe this is one of the reasons we need SpaceX's Starlink to, you know, come of age quicker and reach IOC quicker. And Amazon is building a constellation also, but both of them blanketing the earth in, you know, Internet, extremely high speed, low latency Internet from space. Maybe it's a way to get these countries away from the temptation of the digital silk road.

Yeah. Satellite technology also brings up other concerns is that, you know, Russia and China are now boosting their space activities quite a bit. We know that recently Russia has just been a little aggressive towards other people's satellites. So that's concerning, which is probably why we have our space force now. But I speculate. I'm just saying, I Think space technology is going to bring a whole new realm of threat activity. Right.

Well, Charity, I want to transition and ask you a few other questions, but I want to wrap up on the report saying that this is really one of the best threat intelligence products I have read ever and I strongly endorse it to everybody. I think it's well worth a read.

Thank you. Yeah, it's. I tried to make it concise and kind of easy to go through with lots of case studies. So it's, it's a little lengthy, but it's definitely worth the read.

You've even got pictures in there for guys like me, so that's good.

I love pictures. It makes things so much more visual, like to be able to see the African Union building or to see the locations or the people that are being, you know, that are behind these hacks.

Well, Charity, I know you focus on China, but I also want to get your thoughts on some of the other threats around and was wondering if I can mention a couple countries and then get your succinct articulation of the cyber threat from these countries, starting with Russia. What do you see as the Russian cyber threat?

Okay, so we've got two sides to Russia in my mind. We've got the cybercriminal aspect and then we've got the state sponsored aspect. Ransomware is a huge issue right now, especially ransomware groups operating out of Russia. And the government is turning a blind eye to what they're doing as long as they don't target Russia or bloc countries. So that is a major concern that's costing industries billions of dollars right now. Luckily, Biden and Putin are having discussions about working together to stop this type of thing. But I'm hesitant to believe that any real action will come from Russia on that. And then you've got the state sponsored threat, which is very significant. I mean, we've seen major incidents just this year like solar winds and all of the fallout from that. So constant espionage campaigns. I'm also concerned with Russia's created this roo net, very similar to China and its great firewall. Russia is kind of Balkanizing their own Internet so that if an adversary attacked their infrastructure, they'd be able to operate, or if an adversary shut down global Internet infrastructure, they'd. They would be able to independently operate their Internet. That's great for Russia, but that independence also creates the ability for them to attack the rest of the world and still function. So the consequences for them are very slim. And right now I'm most concerned with Russia not being Accountable to global organizations and not respecting, you know, basically the laws that we've all set out about what is right and what is not. So definitely very concerned with the state sponsored aspect and not just cyber intrusions, but we're seeing more and more we're recognizing when they're using influence operations in conjunction with cyber intrusion campaigns. So active measures. Nothing's off the table for Russia. They're kind of throwing their whole toolkit.

All right, now, what do you think of the Iranian cyber threat?

You know, Iran is a very capable adversary. I think they've had some major setbacks over the past couple of years, and we have discovered some of their campaigns and we kind of brush them off. Like that wasn't very sophisticated or that was easy to find, or we recognize it when it happens. But. But I'd say don't underestimate Iran. They're very, very capable in the cyber realm and they have a lot of grudges. They're holding for United States support of Israel, the killing of General Soleimani. They've made him into a martyr, and they're still holding onto those reasons to retaliate on the West. So I think they're very capable and we need to keep a close eye on them.

All right, thanks. What about the dprk? North Korea?

Yes. You know, Korea's struggle. North Korea is struggling right now with hunger and famine. And they're starting. Well, we saw a few years ago, they started getting very desperate for funding because of all the sanctions that have been placed on their economy. So now they've kind of pivoted over to, you know, cryptocurrency, mining and targeting banks to steal money. And so this is kind of a interesting turn of events. It makes it easier for us to kind of detect those campaigns when they're happening because we know their objectives, we know their tactics, and, and they're a little different from China and Russia. But their hackers are very capable as well. I'd say out of the big four, they're probably number four on my list of being most concerned about their activities. But they still stay in that top four list for sure.

And charity, you're a China expert and you walked us through the Chinese digital colonialism and the digital Silk Road. But can you also articulate your view of the overall Chinese cyber threat?

Yes. China right now is very focused on espionage operations around the world. They are not just targeting their biggest competitors like the US they are going after important technology, secrets, proprietary data, which then feed back into their economy and their companies. And their military. But not only that, but they're also also collecting intelligence on diplomatic relationships with some of their friends, some of their allies as well. Just last week, our Team Insect group revealed large scale espionage, cyber espionage campaign targeting Southeast Asian nations. And that was a group that we call threat actor group 16, tag 16. So we, we haven't named them their own particular name like we have in the past. We have Red Foxtrot, Red echo, red delta. Tag 16 has been seen targeting Myanmar, Thailand, Indonesia, Philippines, Hong Kong, Taiwan, a variety of governments and areas throughout. Throughout Asia. And coincidentally or not coincidentally, most of these targets are also members of the Belt and Road Initiative and they're partners in infrastructure projects. So it's interesting that China's still going after both friends and foes for espionage.

Right. Well, Charity, thanks for this. I think that's a very good succinct articulation of the global cyber threat that we all have to deal with. And I have a concluding question I wanted to ask and that is what you're reading today.

Okay. I'm glad you asked this. I am reading a really good book right now called Damascus Station. McCloskey is just a great writer. He's ex CIA. This is a spy thriller book with a little bit of romance sprinkled in. So I'm hooked. It has great reviews and I love it because I'm actually writing a spy thriller of my own. And so I'm just trying to kind of absorb all of these ideas. And Damascus Station, great book.

Really? Is it a page turner? It's something just really you get into and you.

It is realistic.

Is it a realistic novel?

I feel like it's very realistic. I didn't work in the CIA. I worked in nsa. But from the reviews that I've read from, let's say, military generals and people that have operated in CIA, they say it's, it's very realistic. It's very true to how they operate and how they work with, you know, certain assets that they manage. So it's exciting for me because I'm not a CIA person. I love getting that inside perspective.

Awesome, thanks. I'll check that out.

Yeah.

Well, Charity, thanks for this today. I really appreciate the way you explain all of this stuff. It's very helpful.

Oh, good. I'm so glad to be here and thank you for reading the digital Silk Road paper. I really appreciate your support.

Well, I'm going to do my best to share that with everybody. I know.

Awesome. Thank you.

All right, well, thanks, Charity.

Okay, have a good day.

Thanks for listening to this OODA Loop production. For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.