Provincial governments play an underappreciated role in China’s cyber operations

The US Court of the Eastern District of New York in March 2024 indicted several Chinese nationals for cyberattacks against US officials and critical infrastructure. The NY court charged them with ‘conspiracy to commit computer intrusions and conspiracy to commit wire fraud.’ The case was linked to the Hubei provincial branch of China’s Ministry of State Security (MSS), the country’s top civilian foreign intelligence and counterintelligence agency. The Hubei MSS had created front companies for the hacking groups. Provincial governments and local intelligence agencies play a pronounced yet under-scrutinized role in China’s cyber operations.

Vested by China’s constitution

China’s highest administrative organ, the State Council, directs all state measures, regulations, decisions, and orders. In the 1980s, economic and constitutional reforms resulted in a reorganisation of China’s administrative bodies. This included defining the role of the State Council and giving more leeway to provinces and local offices to manage their affairs. 

With these new powers and resources, provinces and cities gained more autonomy to engage internationally. Provinces established special economic zones (SEZs), such as Guangdong’s Pearl River Delta Economic Zone, which includes the cities of Guangzhou and Shenzhen. This area has a more liberal economic system, similar to that of the West, and is located near Hong Kong, making it attractive to foreign investors and companies who want to operate in China.

Provinces proved they could advance their own foreign and economic policies while furthering the economic and political-military objectives of the central government. Yunnan Province, which shares borders with Myanmar, Laos, and Vietnam, formed the Greater Mekong Subregion Program. The programme underscores Yunnan’s ‘bridgehead’ status, promoting greater economic links between China and Southeast Asia. Meanwhile, the southern island province of Hainan serves as the key maritime base for China to assert its claims in the South China Sea. At the provincial level, Hainan even passed the ‘13th Five-Year Plan on Hainan Province’s Maritime Militia Construction’, establishing ‘systematic planning for missions, as well as guidelines, requirements, and measures for maritime militia building.’

Facilitators of cyberattacks and cybersecurity

Provincial MSS branches were another result of the re-ordering of the 1980s as personnel and resources from the Ministry of Public Security (MPS) and other departments were reallocated. Each MSS branch has unique skills, culture, and priorities. Regions develop specialisations based on their location and international connections ‘through trade, education and research, diplomacy, or diaspora communities.’ Shanghai MSS is known to use its proximity to consulates to collect intel against US and other Western officials. Guangdong branch has conducted operations against neighbouring Hong Kong as recently as 2020. 

Other provinces excel in attracting and training talent. Chengdu in Sichuan Province and Guangzhou in Guangdong Province are part of China’s ‘hack-for-hire’ ecosystem. They actively support hacking competitions and bug bounty schemes. They also work with civilian hackers and private contractors, allowing them to participate in espionage and offensive cyber operations. Hainan MSS branch also assisted the cyber espionage group known as Advanced Persistent Threat 40 (APT40) in cyberattacks against parties related to the dispute in the South China Sea. 

Provincial MSS branches carry out most Chinese foreign intelligence operations – more than the central branch –because they are more specialised and have more resources and personnel. Cyber espionage group APT10, which conducted computer intrusions and wire fraud globally, was linked to the Tianjin MSS branch. 

In parallel, provinces enhance China’s cybersecurity. Nineteen of 34 provinces are helping attract talent and develop cybersecurity skills by building ‘cyber ranges’, facilities to upskill personnel and test cybersecurity capabilities and critical infrastructure systems. Guiyang Province built a ‘smart city’, Guizhou, complete with cyber range facilities for training in new tools, attack tactics, defence of industrial systems, and cybersecurity evaluation. Sichuan Province has aligned its cyber strategy with ‘Xi Jinping Thought’, an ideological doctrine that enshrines, among other things, President Xi’s plans  to pursue ‘a holistic approach to national security.’ Xi wants to strengthen China’s position ‘over the internet and information technology sector, the mainstream public opinion in cyberspace,[…] and internet governance’.

Paradiplomacy meets cyberdiplomacy

These smart cities advance China’s overall cyberdiplomacy and digital economy. Bolstered by central and provincial administrations, smart cities were created to attract foreign investors, achieve ‘informatisation’ and digitisation through local initiatives, and establish information and tech conferences and exchanges. For instance, in addition to holding hacking competitions, Chengdu is the location of the Tianfu New Area, an ‘international gateway hub’, part of China’s Belt and Road Initiative (BRI) to improve connectivity with the rest of the world through infrastructure projects in 150 countries. 

Provinces use their smart cities to contribute to China’s diplomatic goals through ‘paradiplomacy’, the involvement of subnational units in state foreign relations. The epitome of this marriage between paradiplomacy and cyberdiplomacy is the Digital Silk Road (DSR). DSR is a component of the BRI. It is meant to promote digital connectivity and parallel BRI infrastructure projects, helping to realise China’s technological superpower ambitions. For example, the smart city of Shenzhen has positioned itself as a key partner of other global cities like Dubai and Abu Dhabi to contribute ‘positively to the China-UAE comprehensive strategic partnership.’

Part of the assessment

Provinces are vital actors in China’s state operations, a reality recognised in the cyber and justice sectors. Attributions and indictments consistently include provincial organisations. To truly understand China, academics and policymakers must also factor in the provincial element in the country’s foreign, economic, and military actions.