China’s sprawling Ministry of State Security (MSS) presents difficult challenge for foreign counterintelligence and security services. Although the bureaucratic center of gravity may reside in the ministry’s Beijing headquarters, the ministry’s thirty-one major provincial and municipal sub-elements probably have most of the people and conduct most of the operations even if they perform mostly surveillance and domestic intelligence work. These state security departments and bureaus are almost like little intelligence services and often have wide latitude to pursue sources. Countering the MSS requires a broadly-based program that accounts for the ministry’s scale and compartmentation.

Such a program—or even effective risk management inside China—must account for variation across the MSS. Part of the mystery of Chinese intelligence operations is that, even within the same ministry, the quality of individual intelligence officers and operations, varies widely. They defy easy judgment and, unless specific units are referenced, reality will contradict general assessments. A sketchy consulting outfit with a few faked LinkedIn profiles and that does not own the domain it claims is as much a sign of the ministry as an MSS officer under diplomatic cover in a tailored suit with idiomatic English.

Fleshing this out requires looking at individual units when they can be isolated from the rest of MSS operations. The Shanghai State Security Bureau (SSSB) has surfaced in several U.S. espionage cases, most recently two weeks ago when the FBI arrested former U.S. defense contractor Kevin Mallory for selling classified documents to the SSSB. Mallory and the SSSB attempted to hide their contacts under the veneer of academic exchange or consulting. This is just the latest example of the SSSB’s pursuit of American sources, and, according to my interviews, it is one of the most active MSS units targeting the United States.

Although the SSSB was not one of the original MSS bureaus created in 1983, the ministry added the Shanghai office no later than 1985. Over the last thirty years, the bureau has grown along with Shanghai to include eighteen subordinate branch offices in every administrative division. It benefits from a recruiting pool that includes some of the best universities in China, including Fudan and Shanghai Jiao Tong. Shanghai’s universities, think tanks, businesses, and modern infrastructure draw a large, high-quality pool of foreigners from which the SSSB can recruit sources.

The SSSB leadership appears to come from within the bureau or at least the MSS, because of the absence of any public data on their careers. The current bureau director is Dong Weimin, who has run the bureau since 2015. Unlike the Beijing State Security Bureau’s leadership, the SSSB probably does not provide upward mobility to other parts of the ministry. The directors of the SSSB’s Beijing counterpart regularly move into the MSS party committee and become vice ministers. The most notable among these are Qiu Jin and the now-disgraced Ma Jian. The only example of an SSSB director promoted upward in recent memory seemingly is Cai Xumin. Cai ran the SSSB from 2000 to 2004, when he was promoted to MSS vice minister, and he later returned to Shanghai as the city’s deputy procurator in late 2006.

The limited evidence available gives little doubt the SSSB is responsive to the global needs of the MSS and China’s central decision makers. A job announcement that accidentally circulated publicly around Shanghai universities in 2015 encouraged students who spoke English, Japanese, German, French, Russian, Taiwanese, or the languages of China’s recognized minorities to apply to the SSSB. The languages are suggestive of foreign-intelligence targets, counterintelligence coverage of foreigners inside China, and domestic intelligence work for monitoring the party-state’s internal enemies.

The tasking in the espionage cases amplify this point. In the Claiborne case, SSSB officers requested information on U.S. economy policy deliberations and internal State Department reactions to talks with China. Separately, a freelance journalist focused on Asian affairs received SSSB requests for short, interview-based papers related to U.S. policy in Burma, U.S. contacts with North Korea, and U.S. talks with Cambodia related to the South China Sea.

The SSSB also recruited a young American student, Glenn Duffie Shriver, in the mid-2000s to apply to the State Department and the Central Intelligence Agency. Though their Shriver project became a counterintelligence operation, the SSSB’s original intent clearly was to acquire a steady stream of reporting on U.S. foreign policy, only some of which would have been directly related China or even Asia.

Other sources’ tasking illustrates the SSSB is constantly looking for opportunities to collect foreign intelligence. The SSSB blackmailed a Japanese code clerk at the consulate in 2003 and 2004 over his relationship with a prostitute. The relationship supposedly began at a karaoke parlor that may have been owned by the SSSB and that catered to Japanese diplomats and businesspeople. They requested background information on the Japanese diplomats posted to the consulate and the schedule for diplomatic pouches going back to Tokyo. In another case involving South Korean diplomats in Shanghai that has some of the hallmarks of the SSSB, a Chinese woman solicited phone and contact information for senior South Korean government officials. In addition to trading sex for government documents, she also helped Chinese individuals get expedited visa approvals to South Korea.

In collecting foreign intelligence, the SSSB uses a wide variety of cover platforms. In the most recent case involving Mallory, the bureau approached him under the cover of the Shanghai Academy of Social Sciences according to the affidavit. Local academies of social science, like unnamed numbered offices in provincial or municipal governments, are commonly used by MSS units across the country. Claiborne’s handler ran an import-export company with a spa and restaurant on the side. The journalist received two separate requests from “a private[ly]-owned consulting company engaged in policy analysis and strategic assessment.”

The SSSB also clearly uses open source research to buttress what it gains from the foreign sources it develops and recruits. In the Claiborne case, the SSSB officers told her that her reporting on U.S. economic policy was “useful but it is also on the Internet. What they are looking for is what they cannot find on the Internet.” In the email exchanges with the journalist, the SSSB officers made references to program managers who would do the open source research so that he could focus on working his contacts for information. The recently-passed intelligence law decrees “[combining] open work and secret work” in intelligence operations, so the capabilities of the SSSB likely go beyond human-intelligence operations to include computer network operations. The aforementioned job announcement highlighted skills in information security, computer software programming and telecommunications as being desirable. One of Shanghai’s (and China’s) most prestigious universities, Shanghai Jiaotong University, has been linked to military thefts in cyberspace, so it seems within the realm of possibility that these students also might find work with state security. Admittedly, the job announcement did not describe whether such skills were required in technical support or operational positions.

Like other state-security elements, the SSSB places counterintelligence at the forefront of its priorities. When the bureau blackmailed the Japanese code clerk, the SSSB reportedly asked him to name all of the Chinese contacts of the Japanese consulate in Shanghai. The SSSB also extends counterintelligence coverage over Chinese corporations and state economic interests. In 2009, Chinese press announced the SSSB detained four employees of the Australian mining giant Rio Tinto, including its China office director, Stern Hu. Rio Tinto’s trading and negotiations on iron ore forced Chinese steel companies to pay more than 700 billion renminbi (approximately $102 billion) over the six years preceding the arrest. Some controversy emerged over whether the SSSB and other Chinese authorities actually found evidence of Rio Tinto’s complicity in economic espionage. Those facts, however, are less important than the point that the company’s trading cost the Chinese state money and the MSS looked into Rio Tinto.

China’s opacity about intelligence and security issues lends a mystique to Chinese intelligence. That secrecy was on display with the June 27 passage of the intelligence law. Despite being a law to clarify intelligence authorities, the law does not name a single intelligence agency. But this is not reason to let the mystique stand. As Premier Zhou Enlai told Henry Kissinger during their July 1971 secret meetings when the latter opined about China’s mysteriousness, “You will find it not mysterious,” Enlai said. “When you have become familiar with it, it will not be as mysterious as before.”

Peter Mattis is a fellow in the China Program at The Jamestown Foundation, and author of Analyzing the Chinese Military: A Review Essay and Resource Guide on the People’s Liberation Army. He is the coauthor of a forthcoming handbook on Chinese intelligence to be published through Naval Institute Press.

Image: A projection of cyber code on a hooded man is pictured in this illustration picture taken on May 13, 2017.