Inside China's Four-Year Espionage Campaign: How MSS Operatives Systematically Penetrated US Navy Operations

Inside China's Four-Year Espionage Campaign: How MSS Operatives Systematically Penetrated US Navy Operations
Photo by John Cameron / Unsplash

A newly unsealed FBI affidavit reveals the sophisticated methods China's Ministry of State Security used to infiltrate American military installations and recruit naval personnel through an elaborate spy network operating on US soil.

Bottom Line: Chinese intelligence officers orchestrated a comprehensive espionage operation targeting US Navy facilities and personnel from 2021-2025, utilizing dead drops, social media recruitment, and systematic intelligence gathering while maintaining operational security through encrypted communications and gaming platforms.

The Scope of the Operation

Two Chinese nationals, Yuance Chen, 38, and Liren "Ryan" Lai, 39, have been charged with acting as agents of China's Ministry of State Security (MSS) without proper notification to the US Attorney General. Chen, a legal permanent resident living in Happy Valley, Oregon, and Lai, who traveled to Houston on a tourist visa in April 2025, were arrested on June 27, 2025, by the FBI.

The operation systematically collected intelligence on US Navy facilities and personnel through multiple sophisticated approaches:

Hungarian Police Arrest DDoS Suspect Targeting Independent Media as Global Attacks Surge
Major Breakthrough in Media Freedom Case Hungarian police have made a significant arrest in their investigation of prolonged cyberattacks against independent media outlets, apprehending a 23-year-old Budapest resident suspected of orchestrating distributed denial-of-service (DDoS) attacks against news organizations both domestically and internationally. The arrest, announced on Monday, represents a crucial

Intelligence Collection Methods

Naval Facility Surveillance Chen was tasked to visit a U.S. Naval installation in Washington State and a U.S. Navy recruitment center in San Gabriel, California, where he obtained photographs of a bulletin board containing the names, programs, and hometowns of recent Navy recruits, the majority of whom listed their hometown as "China".

Personnel Information Gathering Chen traveled to San Diego, California, to meet with a Navy hire and tour the USS Abraham Lincoln, an aircraft carrier. Photos included in the affidavit show a visitor's badge as well as Chen posing with the employee and their child on top of the aircraft carrier's deck.

Recruitment Intelligence Chen received instruction from the MSS on what to say to potential recruits regarding potential payment that could be made by the MSS, preferred Naval job assignments for potential recruits, and methods for minimizing Chen's risk of exposure.

Major Breakthrough: Four Arrested in £440M Cyber Attacks on UK Retail Giants
NCA Makes Significant Progress in Investigation into Attacks on M&S, Co-op, and Harrods Bottom Line Up Front: Four young people, including a 17-year-old and three individuals aged 19-20, have been arrested by the UK’s National Crime Agency in connection with devastating cyber attacks that cost major retailers up to

Operational Methods and Security Protocols

The $10,000 Dead Drop Operation

While in Guangzhou, China, in January 2022, Lai and Chen worked together to facilitate a dead-drop payment of at least $10,000 on behalf of the MSS, working with other individuals located in the United States to leave a backpack with the cash at a day-use locker at a recreational facility located in Livermore, California.

The FBI affidavit reveals the real-time coordination of this operation:

  • Chen's wife traveled from Portland to San Francisco with a backpack containing $10,000 in cash, which she placed inside a locker at a bowling alley in Livermore, California. Surveillance footage shows her and an accomplice with the backpack
  • The operation included detailed logistical planning, with Chen directing his wife via encrypted messaging to scout multiple locations when initial lockers were full
  • FBI surveillance captured the entire operation, including communications between Chen and MSS handlers as they modified the plan in real-time

Communication Security

The MSS demonstrated sophisticated operational security awareness:

Encrypted Channels: The MSS used COVCOM tools for sensitive communications while reserving email for scheduling

Gaming Platform Communications: Texts show Chen discussing the operation with a person who the FBI believed was an MSS officer using code words like "go shooting" for continuing communications using online video game platforms

Security Briefings: Chen received instruction from the MSS on methods for minimizing his risk of exposure

Spanish Cyberterrorism: 19-Year-Old Student Arrested for Massive Political Data Leak Targeting Prime Minister Pedro Sánchez
How a computer science student from Gran Canaria orchestrated one of Spain’s most significant political data breaches from his parents’ home, exposing thousands of high-profile figures in what authorities are calling an act of cyberterrorism Breaking News: Unprecedented Political Data Leak Rocks Spain In a dramatic turn of events that

Recruitment and Asset Development

Targeting Strategy

The PRC government seeks blue-water naval capabilities as part of their effort to modernize their navy and establish hegemony in the South China Sea region. The PRC government also seeks to collect intelligence on adversary military targets, particularly the U.S. military.

The operation focused on specific recruitment targets:

  • Personnel with Chinese Heritage: The majority of recruits listed their hometown as "China," which he appears to have transmitted to an MSS intelligence officer in China
  • Strategic Naval Positions: The MSS provided guidance on preferred Naval job assignments for potential recruits
  • Social Media Outreach: Chen began contacting a Navy employee over social media and provided information about the employee to the MSS

Financial Incentives and Operational Support

Texts show Chen discussing potential $15,000 payments to the recruits and whether or not they can pass a polygraph test. The MSS also demonstrated awareness of US security procedures, instructing assets to avoid mentioning Chinese financial sources during psychological evaluations.

Regular Compensation: Chen traveled to Guangzhou and met with MSS intelligence officers in April 2024 and March 2025 in order to discuss compensation and specific taskings

Industrial Espionage and International Justice: The Arrest of Xu Zewei Exposes Ongoing Threats to Critical Research
Bottom Line Up Front: The arrest of Chinese national Xu Zewei in Italy for alleged COVID vaccine espionage highlights the persistent threat of state-sponsored industrial espionage targeting critical U.S. research, demonstrating both the international scope of these operations and the effectiveness of cross-border law enforcement cooperation. The arrest of

The Network Structure

Handler-Asset Relationship

Lai recruited Chen to work on behalf of the MSS in or about 2021, establishing a classic intelligence handler-asset relationship where Lai served as the primary conduit between Chen and MSS headquarters in Guangzhou.

Operational Coordination: Chen served as a relay, waking up MSS officers at 3:32 AM Guangzhou time to report his wife's progress finding suitable combination locks

In-Person Meetings: Chen made multiple trips to China for face-to-face briefings with MSS intelligence officers, maintaining the personal relationships crucial for espionage operations.

Cover and Deception

Lai traveled to Houston, Texas, in April 2025, claiming that the purpose of his visit was related to his business as an online retail seller, and that he would be staying in the Houston area for two weeks. However, on May 9, 2025 – more than four weeks after his arrival in the United States – Lai traveled by car with a companion from Houston to Southern California.

This extended and undisclosed travel pattern suggests Lai was conducting operational activities beyond his stated business purposes.

Insider Threats in the U.S. Government: The Arrest of a Pentagon Employee and Broader Implications
Introduction The recent arrest of Pentagon employee Gokhan Gun has highlighted the persistent and evolving threat posed by insider threats within the U.S. government and military. Gun, a U.S. citizen born in Turkey, was charged with possessing and transmitting classified national defense information. The case underscores the critical

Counterintelligence Success

FBI Investigation and Arrests

Chen and Lai were arrested on June 27, 2025, by the FBI in Happy Valley, Oregon, and Houston Texas, as part of a coordinated counterintelligence and law enforcement operation across multiple states.

Multi-Agency Coordination: FBI San Francisco led the investigation, with collaboration from FBI offices in Portland, Houston and San Diego, as well as the Naval Criminal Investigative Service

Chen and Lai are charged with violating Title 18, United States Code, Section 951, which makes it a crime for a person to operate or agree to operate within the United States as an agent of a foreign government without notification to the Attorney General of the United States.

If convicted, the defendants could face up to 10 years in prison and a fine of up to $250,000.

Official Response and Broader Context

Government Statement

"This case underscores the Chinese government's sustained and aggressive effort to infiltrate our military and undermine our national security from within," said Attorney General Pamela Bondi. "The Justice Department will not stand by while hostile nations embed spies in our country – we will expose foreign operatives, hold their agents to account, and protect the American people from covert threats to our national security."

Cyber Retaliation Unleashed After Telegram Founder’s Arrest: French Organizations Under Siege
#France - Threat Actors Retaliate After Durov’s Arrest Pavel Durov, the founder of TelegramPavel Durov, the founder of Telegram, has recently been arrested in France as part of an investigation into alleged criminal activities on the Telegram platform and a lack of cooperation with law enforcement. Despite his arrest,

Ongoing Threat Assessment

The case is one in a series of prosecutions concerning Chinese intelligence-gathering, including concerning the military. Last year, for instance, the Justice Department charged five Chinese nationals with lying and trying to cover their tracks, more than a year after they were confronted in the dark near a remote Michigan military site. And in 2023, two Navy sailors were charged with providing sensitive military information to China.

Key Takeaways

This case reveals several critical aspects of modern Chinese intelligence operations:

  1. Systematic Approach: The four-year operation demonstrates MSS's patient, methodical approach to penetrating US military institutions
  2. Operational Security: Sophisticated use of encrypted communications, gaming platforms, and dead drops shows advanced tradecraft
  3. Financial Resources: Regular salary payments and operational funding indicate substantial MSS investment in long-term operations
  4. Cultural Targeting: Focus on personnel with Chinese heritage reveals MSS's strategic use of ethnic and cultural connections
  5. Technology Integration: Combination of traditional espionage methods with modern digital communications platforms

The successful FBI investigation and arrests demonstrate the effectiveness of US counterintelligence efforts, but also highlight the persistent and sophisticated nature of foreign intelligence threats to American national security.

Major Cybercrime Forum Takedown: XSS.is Administrator Arrested in Ukraine
International law enforcement operation dismantles one of the world’s most notorious Russian-speaking cybercrime marketplaces after four-year investigation In a significant blow to the global cybercrime ecosystem, Ukrainian authorities arrested the suspected administrator of XSS.is, one of the world’s most influential Russian-speaking cybercrime forums, on July 22, 2025. The arrest,

#China #NationalSecurity #Counterintelligence #FBI

Read more