What did she see?
asserted
she → see → What
The intelligence scramble to retrace an accused spy's footsteps
Investigators are combing through a decade of internships and government work
Several Western intelligence agencies were sent scrambling this summer to figure out what — if anything — of value an accused Canadian spy managed to access during internships at multiple agencies and government departments.
asserted
spy → retrace → agencies
Biwei Zhang, a Canadian intern at NATO military's headquarters in Mons, Belgium, was arrested by Belgian authorities in July on suspicion of espionage and communicating with a foreign crime entity.
asserted
Zhang → arrest → entity
She has been held in pretrial detention since being taken into custody and was this week denied an appeal for release.
asserted
She → hold → release
Belgian justice and security officials have released very little information and have even declined to name her.
asserted
officials → release → her
A CBC News investigation, in late July, identified her through open-source records and established that over the past decade, she had hopped between high-profile organizations.
asserted
she → identify → organizations
Zhang apparently worked as an economist for Statistics Canada, a systems engineer in satellite operations for the Canadian Space Agency and held positions at the European Space Agency in Italy and the World Trade Organization in Switzerland.
asserted
Zhang → work → Switzerland
Ottawa will look into screening processes amid NATO intern spying allegations
Court decision barring Chinese student sends message about espionage risk, experts say
Belgian authorities have not said who she might have been spying for, but European media outlets, citing intelligence officials, say it was China.
uncertain
it → look → officials
The Canadian Security and Intelligence Service (CSIS) confirmed it is overseeing a multi-departmental damage assessment.
asserted
it → confirm → assessment
"When security incidents of this nature arise, it is customary that departments and agencies conduct a review to identify and address the potential consequences," said Magali Hébert, a CSIS spokesperson, in a written statement.
asserted
Hébert → arise → statement
"CSIS can confirm that it is engaged with federal counterparts in that regard."
asserted
it → confirm → regard
CBC News spoke to several confidential sources — in the intelligence and diplomatic communities — about the fallout of the allegations against Zhang.
asserted
News → speak → Zhang
Kenneth Lasoen, who teaches intelligence at the University of Antwerp, said a "serious post-mortem" into her alleged activities would also be among the first order of business for a handful of European intelligence services.
asserted
mortem → teach → services
All of them are trying to build a picture of what access she may have had, what sort of damage might have been done and whether Zhang had a connection to a wider network.
uncertain
Zhang → try → network
Much of the public discourse about the case in Canada has focused on how the alleged spy received security clearance.
asserted
spy → focus → clearance
A House of Commons committee plans to convene hearings.
asserted
committee → plan → hearings
Intelligence services, however, are more concerned with the bigger picture of what she may have seen, what might have been done and whether there were accomplices.
uncertain
what → see → what
"I would think the most interesting part from the damage assessment would be — of course — to find out exactly who she works for, what the lines of communication were [and] how did she work for her handlers?" Lasoen told CBC News.
asserted
Lasoen → think → News
In the immediate aftermath of her arrest, NATO said none of its critical systems were compromised.
asserted
none → say → systems
The European Space Agency has focused its public comments on her security screening and how it was up to national authorities to conduct a deeper vetting.
asserted
it → focus → vetting
An official from the World Trade Organization (WTO) confirmed that Zhang worked at the organization for a brief period in 2023.
asserted
Zhang → confirm → 2023
'Are there still logs?'
Reconstructing her alleged activities in each of the other agencies, in Europe and Canada, would depend on how long they retain security data.
asserted
they → reconstruct → data
Are there still images on security cameras of her trying to get in or actually moving in parts of the office that she actually had no business being?" Lasoen said.
asserted
Lasoen → try → business
"I'm sure at SHAPE [NATO], because that's the most recent, they'll manage to reconstruct most of those things.
asserted
they → manage → things
But for the other places, the question is how long ago was it and what's their policy on how long they actually keep that sort of information."
asserted
they → keep → information
An expert in counterterrorism and cyber who has also acted as an instructor for certain European intelligence services, Lasoen said it's significant that Belgian authorities accused her of communicating with a criminal organization.
asserted
authorities → act → organization
Under Belgium's recently rewritten law, anyone who entices somebody to conduct espionage is considered a criminal organization.
asserted
who → rewrite → espionage
"But then that's where it gets a bit risky, as far as I would be concerned, diplomatically," Lasoen said.
asserted
Lasoen → get → ?
"If we're going to be calling the Chinese secret service a criminal organization, I'm sure the Chinese will have a certain opinion about that."
asserted
Chinese → go → that
Given that her arrest involved allegedly spying at NATO's military headquarters, the information she supposedly gathered or the activities she undertook would be of direct benefit to Chinese military intelligence.
uncertain
she → give → intelligence
The question being asked in intelligence circles is: Was she working for them directly, or a third-party criminal organization?
asserted
she → ask → them
There are documented third-party networks active in Europe who've allegedly co-operated with Chinese intelligence agencies, including Fujian community associations.
uncertain
who → be → associations
That's according to a ProPublica investigation in Italy and Spain.
uncertain
That → accord → Italy
Chinese overseas police stations are also a known source of intelligence liaison.
asserted
stations → know → liaison
While none exist in Belgium, France recently dismantled a chain of nine of them.
asserted
France → exist → them
Authorities in Brussels have contended with informal consular networks, which supposedly provide assistance to Chinese nationals in the country.
asserted
which → contend → country
In Canada, authorities would be combing through the departments to which Zhang had access, looking at the data she saw through a military or intelligence lens to determine what sort of value it might be to a foreign power.
For example, it has been reported publicly by The Globe and Mail that while at Statistics Canada, she tracked shipping data out of the Port of Montreal — information that's economically important but also militarily significant in the event of war.
uncertain
that → comb → war
Zhang's role as an IT intern is also potentially significant, said an expert in disruptive cybersecurity.
asserted
expert → say → cybersecurity
China has taken a decidedly different approach to cyber espionage than adversaries such as Russia, Iran and North Korea.
asserted
China → take → Russia
Whereas those nations and their proxies often focus on "smash and grab" types of attacks, stealing data ransoming companies and shutting down systems, China aims for stealth intrusions.
"They're going to use techniques that are low and slow, very methodical, very deliberate and virtually impossible to detect," said J Paul Haynes, CEO of Cinchy, a Toronto-based data access and governance company.
asserted
Haynes → focus → Cinchy
…and 6 more, not listed.
