China is about to run the largest influence operation in history. It will not have to run it. The world will download it.

EXPERT PERSPECTIVE -- Our research team at Vanderbilt spent months inside the internal documents of GoLaxy, a Beijing firm - with ties to the Chinese state - that built a machine for shaping opinion abroad. Using AI, it generates personas, amplifies narratives that are favorable to Beijing and buries narratives that are not. And it’s been busy. It was used in Hong Kong to combat dissent against the National Security Law. It was used in Taiwan to sway the island’s 2024 elections.

Now consider what happens when it does not need to be built at all. If Chinese open-weight models — the ones that anyone can download, modify and run on their own machines — become the foundation that the world builds on, then the Chinese Communist Party’s (CCP) framing of Taiwan, Tiananmen, Xinjiang and Beijing itself ships inside every product that sits on top. No personas. No campaign. Just the default answer, everywhere. Something like this would make GoLaxy look like a dress rehearsal.

And here is the part that should stop Washington cold. Chinese models are about to be everywhere, and American strategy could allow it to happen. Washington is deciding whether to let frontier development run while clamping down on powerful open-weight models (whose safeguards can be stripped away). Here’s the deal though: restrictions would not kill demand for a cheap model that a company can download and make its own. China is standing at the counter with exactly that.

Today, we talk about the AI race as if it has one finish line. But it has two. The first is for frontier capability: who builds the most advanced models. American companies lead the way today. The second finish line is for reach: whose models become the foundation on which thousands of products are built? Chinese firms may have the advantage on this one. The first brings concentrated scientific, economic and military power. The second decides whose systems become the workhorses of ordinary life, and that reach shapes what people know and will learn in the future.

American frontier models like Claude, ChatGPT and Gemini are closed, meaning you use them on the company's servers, and the company can cut off access. Chinese developers compete by releasing cheap open-weight models that companies can run on their own, with no provider to answer to. The babysitter has left the building.

This has already started. Airbnb relies on Alibaba's Qwen in its customer-service agent. Qwen, even briefly, powered a tool for searching proposed regulations on the Federal Register website. Amazon says thousands of customers have deployed DeepSeek through its cloud. In every case the interface is American. But the model underneath it is not.

Here’s something else to consider: Chinese developers must operate under Communist Party rules about what may be said. Those rules then shape which questions the models answer, which facts they omit and how they frame sensitive subjects. Open weights can be retuned, but scrubbing built-in defaults is expensive, and most companies will focus their efforts on addressing what matters to their business rather than check how a model handles every political subject. If a cheap Chinese model sits under thousands of products, its habits travel with it — into research tools, classroom software and fact-checkers — and the person on the other end never knows.

Beijing already knows about this risk. When Meta released its open-weight Llama models, Chinese regulators worried that a foreign model could "poison" China's AI ecosystem with information that the CCP censors. It seems to make sense that Washington should take seriously a vulnerability that Beijing recognized first.

None of this makes the open-weight safety problem smaller. In fact, just the opposite. Once a powerful open-weight model is released, its developer cannot recall it. Its safeguards can be stripped away and the model can be used for cyberattacks, the creation of biological weapons or worse. If we’re going to address this as a society, then testing requirements, liability rules and release restrictions are needed. But a Chinese open-weight model carries the same dangerous capabilities as an American one, and no American rule touches it.

If we constrain American developers and leave foreign weights untouched, demand will certainly shifts toward Chinese models. Theoretically, Washington could end up regulating the companies it can see while deepening its own dependence on the ones it cannot.

One answer might be to ban the Chinese models. But that means telling Americans which information technology they may use — and here lies the irony: the openness that protects Americans from domestic censorship may leave them exposed to systems built under Chinese censorship.

TikTok offers a glimpse of the stakes. More than 170 million Americans use it, and tens of millions say they get their news there. Washington spent five years fighting over its recommendation algorithm, and the deal that kept it in the United States required a change to that algorithm. But an algorithm only ranks videos that people make. While that fight dragged on, AI models learned to make the videos themselves — realistic footage with synced audio, from a sentence, in seconds. Three months after the deal closed, TikTok upgraded its ad tools to ByteDance’s newest video model. No rule required anyone to ask whose model was making the videos.

Now, you can see why the United States is facing a trilemma. It wants to prevent the uncontrolled release of dangerous AI capabilities. It wants to preserve Americans' freedom to choose their technology and information. And it wants to avoid dependence on models that are shaped inside an authoritarian system. It cannot fully secure all three.

Honest regulation starts by admitting that. Before restricting an U.S. model, ask which model developers will pick first. Domestic and foreign models distributed in the United States should face the same tests and the same rules. And companies that build products on a foundation model should have to say whose model it is.

AI leadership combines two things: the capability of a country's best models, and the reach of the models embedded in ordinary life. AI risk also combines two things: what a powerful model might do, and what a ubiquitous one tells people is true. GoLaxy showed us what Beijing can do with a machine to shape a belief. Now, what are we going to do about it?

Mr. Goldstein and Mr. Benson are professors at Vanderbilt University who specialize in national and international security.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Beijing says artificial intelligence will give the state a visible hand to allocate capital. Here’s the rub: Washington’s economic authority sits in five places, and none of them is in command.

This column begins a four-week series ahead of The Cipher Brief Threat Conference on economic-warfare. The author is hosting a live session on this topic with former Commander of U.S. Special Operations Command, General Bryan Fenton (Ret.). Apply now to attend.

On September 26, the President answered the week's largest security question in just four words: "I'm rejecting their deal." Iran's offer to reopen the Strait of Hormuz within seven days, in exchange for lifting the blockade and waiving oil sanctions, had been on the table since September 24. It received its answer in public, from the one official authorized to give it, inside forty-eight hours.

The week's economic questions received no answer of that kind. The trade truce with China, and the pause on Beijing's rare-earth licensing regime tied to it, moved from November 10 to January 10 on the strength of a Treasury Secretary's statement; Beijing has yet to publish a matching notice.

The Russia sanctions act the President signed on September 18 requires determinations on the largest buyers of Russian energy by October 18, a deadline set by Congress rather than the executive, with waivers broad enough to let it pass unenforced. In February, the Supreme Court ruled six to three in Learning Resources v. Trump that the International Emergency Economic Powers Act does not authorize tariffs, removing the instrument the executive had used for its broadest tariffs.

This is important because Washington can decide a war in a sentence. But on the economic front, authority rests with Treasury, Commerce, the U.S. Trade Representative, Congress, and the courts. Each is competent. None is in command. The arrangement is by design and has served the country well for most of the last eighty years. But not anymore.

Beijing is now claiming a different design. In a recent lecture on Xi Jinping's economic strategy, former Australian Prime Minister Kevin Rudd, who has tracked Chinese ideology for fifty years, described a shift in the Communist Party's theoretical literature. Artificial intelligence (AI) and other "new quality productive forces" are portrayed not only as sources of productivity but also as "a superior macro-allocation mechanism for resources," driven by algorithms. Rudd says the literature now uses the term "the visible hand of the state," offered for the first time as a rival to the market's invisible one. He is careful about its status: the idea sits in the ideological literature, "not yet in the policy literature," and not yet in the behavior of firms. But in his reading, ideology in China is where policy begins.

The hand is already visible without the algorithm. The rare-earth regime now paused until January, the Ministry of Commerce's Announcement No. 61, applies to any product anywhere that carries more than 0.1 percent Chinese-origin rare-earth content by value. One ministry notice imposed it; one more can reimpose it. The capital moves the same way. Chinese households, burned by property and wary of equities, hold record savings in low-yield bank deposits, and the state draws on those deposits through local, provincial, and national loan instruments to fund its technology bet. Rhodium Group puts China's AI capital spending at 932 billion renminbi this year, double last year's, financed by state banks and equity placements rather than bond markets.

America's AI buildout is financed the other way. Its five largest builders raised a net $163 billion in debt in the first half of this year, compared with $90 billion in all of 2025, in a bond market where the ten-year Treasury has reached 5.18 percent, its highest since 2007. No ministry allocated that capital. The market did, and the market will reprice it.

Neither design is simply superior, and the distinction matters more than the verdict. A single allocator is fast and brittle. It can direct capital, licenses, and supply to a strategic target within a week, and it can misallocate at the same speed. The household savings now financing the AI bet were poured into a property boom that left many of those households with assets worth only a fraction of what they paid. A distributed system is slow and resilient. Its errors stay local, its capital carries a price, and no single notice can switch it off. In peacetime competition, resilience compounds. In economic warfare, tempo is the contested variable, and the side that can decide within the other's cycle sets the terms. Beijing has already shown what that looks like. It imposed its rare-earth regime by notice on October 9 of last year and suspended it by another on November 7, having collected in between Washington's agreement to delay its own rule extending export controls to the affiliates of blacklisted firms. Two notices, one month, one American concession.

This column has traced the same gap from the drone fleet to the power grid: the capacity exists, and the decision does not. The economic front shows it at national scale. Washington holds the reserve currency, the deepest capital markets, and the reach of the dollar system. What it lacks is a place to settle competing claims on those instruments and to make them binding on the timeline decided by an adversary.

October 18 is the first live test. The sanctions act's determinations are due that day, just sixteen days before the midterm elections. They will be imposed, waived, or deferred, and whichever it is will say more about the American economic hand than any strategy document published this year. Beijing will be watching the same date, holding a notice it can publish on any morning it chooses.

The question for Washington is who, when economic warfare requires a decision, is empowered to make it, and whether that decision can arrive before the adversary's action. Coordination assigns. Integration arbitrates.

Read more expert-driven national security insights in The Cipher Brief. Need full access to more content like this? Become a Subscriber+Member here.

In the years following the Soviet withdrawal from Afghanistan, much of the world treated the region as strategically peripheral - unstable, exhausted, and largely disconnected from the future of global security. Policymakers assumed the consequences of state collapse and civil war would remain regionally contained.

They did not.

The vacuum that emerged across Afghanistan and its surrounding region ultimately produced transnational terrorism on a scale that reshaped global security for two decades. By the time the world recognized the strategic implications of instability in the Heart of Asia, the consequences had already spread far beyond the region itself.

Today, another transformation is unfolding across the same geography. Once again, much of Washington views the region primarily through narrow lenses: humanitarian crisis, counterterrorism management, refugee flows, or strategic fatigue after two decades of war. Yet beneath the surface, a far more consequential shift is underway - the emergence of an interconnected architecture of surveillance systems, cognitive warfare capabilities, AI-enabled governance, and digital infrastructure stretching from Xinjiang through Central Asia, Afghanistan, Pakistan, and Iran.

This is not merely a story about Afghanistan or even about China’s expanding regional influence. It is the story of how authoritarian technological ecosystems are gradually reshaping one of the world’s most fragile and strategically important regions, and how the United States risks misunderstanding the implications until the consequences extend far beyond Eurasia.

The future threat emerging from the Heart of Asia may not resemble the threats of the past. It may not require large training camps, centralized organizations, or physical sanctuaries alone. Instead, it may emerge through digitally networked ecosystems built on AI-enabled surveillance, synthetic media, autonomous influence operations, predictive governance systems, and machine-readable societies operating across the gray zone between peace and conflict.

The region surrounding Afghanistan is increasingly becoming a laboratory for that future.

The Rise of Informational Gravity

China’s expanding role across the Heart of Asia is often described in economic terms: roads, railways, mining contracts, telecommunications infrastructure, and the Belt and Road Initiative. But this framing misses the deeper strategic transformation underway. Beijing is not simply investing in physical infrastructure. It is gradually building informational gravity across the region.

Telecommunications systems, Safe City surveillance platforms, AI-assisted facial recognition networks, smart-city technologies, digital payment systems, media ecosystems, and cross-border security cooperation are converging into a broader regional architecture that extends far beyond any individual country. Afghanistan is no longer the center of the story. It is one node within a wider system.

The clearest model for understanding this architecture exists inside China itself.

In Xinjiang, Beijing constructed what may be the most comprehensive AI-enabled population monitoring system in modern history. Facial recognition cameras, biometric databases, predictive policing algorithms, integrated behavioral tracking systems, and AI-assisted security platforms transformed the region into what many analysts now describe as a machine-readable society. The Integrated Joint Operations Platform (IJOP) aggregates enormous quantities of behavioral data - movement patterns, communications, social interactions, purchases, travel activity, and digital behavior - to identify perceived risks before they materialize.

What matters strategically is that the technologies, companies, governance concepts, and security logic developed in Xinjiang are no longer confined within China’s borders.

Across Pakistan, Chinese-built Safe City systems now monitor major urban centers through Huawei-supported command platforms, facial recognition systems, and expanding digital interception capabilities. In Iran, Chinese surveillance technologies have become increasingly integrated into domestic security and protest-monitoring systems. Across Central Asia, Chinese telecommunications infrastructure, smart-city ecosystems, and surveillance exports have become embedded within the digital foundations of multiple states.

Individually, these developments may appear disconnected. Collectively, they form something far more consequential: an emerging Ring of Control around the Heart of Asia.

Building the Ring of Control

This ring is not coordinated through a single master plan. Rather, it emerges through the convergence of multiple strategic interests. China seeks to secure Belt and Road investments, contain Uyghur militancy, protect trade corridors, expand the Digital Silk Road, and establish informational advantages across strategically sensitive regions. The result, however, is systemic. Telecommunications infrastructure, AI-enabled surveillance systems, media ecosystems, and cognitive-domain operations increasingly reinforce one another across borders.

Pakistan demonstrates how economic infrastructure and surveillance infrastructure merge into a single strategic ecosystem. Chinese-funded Safe City projects in Islamabad, Lahore, Karachi, and other major urban centers increasingly integrate population monitoring with economic-security priorities tied to the China-Pakistan Economic Corridor (CPEC). At the same time, internet-monitoring systems modeled on China’s own censorship architecture are gradually reshaping the digital environment through which information flows.

The implications extend beyond domestic governance. Surveillance systems originally justified as anti-crime or counterterrorism tools gradually evolve into mechanisms for political management, social monitoring, and information control. As these systems become normalized, governments gain unprecedented visibility into the behavior of their populations.

Iran demonstrates a different dimension of the model: how surveillance ecosystems evolve from security tools into political-control mechanisms. Chinese technologies have increasingly supported AI-assisted monitoring of protests, facial-recognition deployments, and population-management systems designed to maintain regime stability during periods of unrest. During waves of anti-government demonstrations, Iranian authorities increasingly relied on digital monitoring, internet restrictions, and AI-assisted identification systems to suppress dissent.

Central Asia represents perhaps the quietest transformation of all. Huawei telecommunications infrastructure, smart-city surveillance systems, and Chinese-built digital architecture now underpin significant portions of regional connectivity across Tajikistan, Kyrgyzstan, Uzbekistan, and Kazakhstan. Border-security cooperation near the Wakhan Corridor, expanding Chinese security facilities, and growing digital dependency further deepen Beijing’s structural influence.

What emerges is not traditional imperialism. It is infrastructural cognition.

Whoever controls the communications architecture, surveillance systems, digital ecosystems, and AI-enabled information environments of a region gradually acquires influence over how societies perceive, communicate, organize, and govern themselves. In the twenty-first century, power increasingly operates not only through territory or military presence, but through data flows, algorithmic visibility, and cognitive infrastructure.

Afghanistan’s Cognitive Vacuum

This transformation becomes even more significant when paired with the collapse of independent information ecosystems across parts of the region.

In Afghanistan, the destruction of independent journalism following the Taliban’s return created an enormous cognitive vacuum. Hundreds of journalists fled the country, media outlets collapsed, and independent reporting networks deteriorated under political pressure and economic collapse. Into that vacuum moved state-backed narratives, sponsored media relationships, and externally influenced information ecosystems.

Chinese state media expansion and narrative-management initiatives increasingly operate in environments where alternative information infrastructures have largely disappeared. Similar pressures exist elsewhere across the region, where fragile media systems increasingly compete against state-backed digital ecosystems supported by far greater resources and technological capacity.

Surveillance infrastructure and narrative infrastructure reinforce one another. Data shapes messaging. Messaging normalizes surveillance. Together, they create environments where behavioral monitoring and information management become mutually sustaining systems.

This matters because modern authoritarian influence no longer depends solely on censorship. Increasingly, it depends on shaping the informational environment itself — determining what populations see, what narratives dominate, and which voices disappear from public discourse.

The result is a region where governance, surveillance, and information control are becoming increasingly integrated through digital systems powered by artificial intelligence.

AI and the Future of Gray-Zone Conflict

This is where the region’s future intersects with broader global security concerns.

The world after 9/11 was shaped by physical sanctuaries: training camps, insurgent safe havens, ungoverned territory, and militant mobility across borders. But the emerging threat landscape of the coming decades may look fundamentally different.

Artificial intelligence lowers the cost of asymmetric influence.

AI-assisted propaganda, synthetic media, autonomous disinformation networks, digitally coordinated extremist ecosystems, predictive behavioral analysis, biometric governance systems, and drone-enabled proxy operations no longer require the same physical infrastructure that earlier generations of transnational threats depended upon. Influence operations can now scale globally through digital ecosystems that transcend geography.

The next sanctuary may not train hijackers in remote camps. It may train algorithms, autonomous systems, and synthetic narratives capable of shaping perceptions, destabilizing societies, and amplifying conflict far beyond the region itself.

This is particularly important because modern gray-zone competition increasingly operates through cognitive pressure rather than direct confrontation. China’s Three Warfares doctrine, Russia’s concepts of Reflexive Control and Active Measures, and broader state-backed influence operations all reflect a strategic understanding that future competition will target perception, trust, decision-making, and societal cohesion as much as physical infrastructure.

The Heart of Asia is becoming one of the environments where these concepts are converging operationally.

The convergence of AI, surveillance systems, and cognitive warfare creates a new strategic reality. States no longer need to occupy territory physically to shape political outcomes. Influence can increasingly be exercised through algorithmic visibility, digital dependency, and information dominance.

That transformation carries implications far beyond the region itself.

Washington’s Strategic Blind Spot

Yet Washington still tends to analyze terrorism, artificial intelligence, surveillance technology, regional instability, and great-power competition as separate categories. The emerging architecture across the region suggests adversaries increasingly view them as interconnected systems.

That strategic blind spot carries risks.

The lesson of the 1990s was not simply that Afghanistan became a sanctuary for terrorism. The deeper lesson was that strategically ignored regions can evolve into generators of global instability when major powers fail to recognize transformations early enough.

Today, the transformation underway is different - more technological, more cognitive, and more structurally embedded.

The long-term risk is not merely the expansion of authoritarian influence across the Heart of Asia. It is the gradual emergence of interconnected machine-readable societies whose surveillance systems, telecommunications infrastructure, media ecosystems, and behavioral data environments become increasingly interoperable across borders.

In such an environment, the distinction between domestic governance, cognitive warfare, and strategic competition begins to blur.

The consequences may not remain regional.

The next phase of instability emerging from the Heart of Asia may not arrive through conventional terrorism alone. It may emerge through AI-enabled cognitive operations, synthetic media ecosystems, autonomous influence architectures, and digitally amplified disorder operating at a scale that previous generations of extremist or authoritarian movements could never achieve.

Afghanistan is no longer merely a battlefield of territory.

The wider region surrounding it is becoming a contested frontier of cognition, surveillance, infrastructure, and machine-driven influence — and the strategic consequences of losing that contest may not remain confined to the region for long.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Andy Burnham was a few weeks into the job as the new Prime Minister of the UK when he found himself exchanging messages with someone claiming to be Susie Wiles, the White House chief of staff. The exchange, first reported by Politico last week, was brief and apparently trivial. Burnham grew suspicious, stopped replying and told the right people; the British embassy in Washington quietly informed the White House, which confirmed that Wiles’s own devices hadn’t been touched. No harm done, officially.

Embarrassments like this are becoming more common. The FBI warned last year about impostors using AI to mimic senior officials, after someone posing as Wiles contacted senior Republicans and business figures. The State Department later chased a fake Marco Rubio who reached three foreign ministers. And every one of these approaches lands on a habit “Signalgate” already exposed: when one wrong contact card could add a journalist to a strike-planning thread, the name on the screen was the only authentication in the room. If you want to see what this security weakness looks like run as a nation-state campaign look at a case that closed quietly in Taipei last month.

In July, prosecutors in Taipei’s Shilin district wrapped up proceedings against two local businessmen, Li Hualun and Chen Mengsen, who had spent months registering accounts on LINE (the messaging app nearly everyone in Taiwan uses), each tied to a real Taiwanese phone number. They leased the accounts to Xiamen Empress Information Technology, a mainland firm Taiwanese investigators say works under the direction of the Chinese Communist Party’s cyber forces. The going rate was about 1,100 RMB per account, call it $160.

A working exploit for a major platform costs millions on the gray market. A trusted local identity cost less than a decent dinner, and it did something no technical exploit can do.

The operators used the fake accounts to become journalists. In the approach that eventually unraveled the scheme, one of them even dressed up a leased account in the name and photo of Chen Yishan, editor-in-chief of CommonWealth Magazine, and began courting an aide in a legislator’s office. Interview requests, invitations to contribute articles, the ordinary traffic of political journalism followed.

There was no malicious link in the first message, or the tenth. Investigators found the operators worked on targets for months, sometimes close to a year. Any counterintelligence officer would recognize the rhythm. It was the patient cultivation and recruitment of an agent run through a chat app.

The eventual ask was small and reasonable-sounding. Journalists use encrypted tools to protect their sources, so would the contact mind installing a secure communication app to keep talking? The app was in fact malware. The MO turns a decade of good security advice inside out. The more someone knew about how careful reporters actually operate, the more normal the request looked.

Researchers at Citizen Lab and the International Consortium of Investigative Journalists, whose reporting the Taiwanese prosecution now corroborates, counted more than a hundred malicious domains behind the wider campaign, and found errors in the phishing messages suggesting the attackers were using AI to draft them and to pick targets. The people on the receiving end were lawmakers and their staffs, defense think tanks, semiconductor companies, dissidents at home and abroad. Taiwanese media reported that even the island’s overseas missions were probed.

Through all of it, nothing technical failed. The networks held and the patches were current. The attackers went around the security stack entirely, and the thing they spent, their actual operational currency, was the credibility of a free press. Every fake interview request makes the real ones a little harder. This cost never shows up in an incident report.

The two men who supplied the accounts got deferred prosecutions and payments totaling a bit under $6,000. That is the current legal price, in a frontline democracy, for renting identity infrastructure to a foreign intelligence service. It isn’t a deterrent. It’s barely a business expense.

Which brings us back to Downing Street. A prime minister with the full apparatus of British intelligence behind him replied to a stranger because the name on the screen looked right. Nothing in either story depends on LINE, or Taiwan, or Westminster.

Swap in WhatsApp or LinkedIn; swap the fake editor for a fake recruiter or a fake chief of staff. Aged, locally registered accounts are already a commodity in criminal markets. All the model requires is a person who handles something worth stealing and a persona they have no fast way to check.

That last part is fixable, though not by the security team alone. Organizations that handle sensitive work should treat identity verification as a counterintelligence habit. Platforms need to treat the account-rental trade Taiwan uncovered as the national security problem it has become rather than a terms-of-service nuisance. And legislatures need to punish collaboration with foreign intelligence services at something above a traffic ticket.

Mostly, though, the people likeliest to be approached — the legislative staffer, the fab engineer, the think-tank fellow, the human rights activist, apparently the occasional head of government — need to become more educated on how foreign intelligence cultivation and targeting actually works: slowly, warmly, and with no suspicious link in sight until the very end. The adversary in this case looked at hardened networks and vigilant software and made a rational choice. Building a fake trusted persona was cheaper — $160 a head – than spending millions on a sophisticated cyber exploit. We need to start defending the credibility of verified, trusted identifies the way we defend our networks: as the attack surface it already is.The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Western universities and laboratories are on the frontlines of a battle over talent and technology. This assertion may seem like scaremongering, but when cold hard facts are considered, it is unfortunately true. The Chinese Communist Party (CCP) is undertaking an unprecedented assault to obtain scientific and technical research from the west. The broad CCP assault requires an equally broad response that must now include vetting for insider threats at universities and laboratories to bolster research security.

Spies Among Friends

In the present context, insider threats can be most usefully understood as existing on a spectrum, from fully paid-up agents (a spy in popular parlance) to research collaboration that could benefit a hostile foreign power.

There is a long history of hostile states exploiting academic freedoms at western universities. A hundred years ago, because the Soviet government had few diplomatic relations with foreign governments, it relied on intelligence officers without diplomatic cover, known as illegals. One of the earliest known illegals entered MIT as a student in 1938, Semyon Markovich Semyonov (codename TVEN). He was tasked with collecting scientific and technical research. It was, however, in the other Cambridge, in England, where Soviet intelligence had its greatest success. The Cambridge Five – Kim Philby, Guy Burgess, Donald McClain, Anthony Blunt, and John Cairncross – were all recruited at or soon after leaving Cambridge University in the 1930s. The Cambridge Spies were each motived by communist ideology, shaped by their intellectual discussions at Cambridge. During World War II, they became hugely damaging Soviet agents inside the British government. Some of the most important intelligence they gave to Moscow was the activities of codebreakers at Britian’s Bletchley Park.

The greatest Soviet insider threats occurred at an American top secret wartime laboratory to build the world’s first atomic bomb. The MANHATTAN Project was fully penetrated by Soviet agents. The Soviet agent, Klaus Fuchs, a brilliant physicist working at Los Alamos National Lab, provided Moscow blueprints and calculations for the atomic bomb. He was motivated by his communist ideology and the belief that nuclear weapons should not be held by one power alone. Fuchs later said that he divided his mind into two compartments: one for his friends and colleagues, the other for his communist beliefs, with the latter always superseding the former. It was, Fuchs said, a kind of controlled schizophrenia which allowed him to betray his friends and colleagues. Soviet espionage at the MANHATTAN Project accelerated Soviet development of Moscow’s own atomic bomb. Accelerating research and development is the essence of what espionage can achieve. The intelligence provided by Fuchs and other agents at Los Alamos meant that when the Soviets detonated their first atomic bomb, in 1949, it was an exact replica of the weapon the US dropped on Nagasaki four years earlier.

After the end of the Cold War, in the 1990s, Chinese espionage replaced Soviet intelligence at Los Alamos. At the end of that decade, Chinese intelligence was discovered to have obtained nuclear secrets from the New Mexico laboratory. 9/11 interrupted and distracted the US response to Chinese intelligence at Los Alamos.

Vetting

The penetration of the Cambridge Spies and agents like Klaus Fuchs, represented one of the greatest failures of western security in modern time. They were able to inflict their damage thanks to inadequate vetting by the British government. At the time, British vetting relied on a cross check on MI5 records. There were no proactive investigations into applicants’ backgrounds. The obvious flaw in the system was that if a candidate distanced himself or herself from communist associations there would be no traces in MI5 records. The Soviet recruiters of the Cambridge Five skillfully got them to do exactly that: breakaway from all communist groups. Thus, the Cambridge Five were able to slip through the British security net. Only later did MI5 obtain records of the Cambridge University socialist club, which contained names of the Cambridge Five and which could have provided important clues to their true motivation.

After the identification of the Cambridge Spies, beginning in 1951, the British government belatedly introduced positive vetting – in which there were intrusive investigations into a candidate’s background. Today the process is known as Developed Vetting. As the recent scandal of Lord Mandelson’s appointment to British Ambassador in Washington shows, the process of Developed Vetting is purely advisory. The decision to employ an applicant is up to the employing body itself.

In the CCP Crosshairs

The CCP has a strategy to exploit western research and development. The CCP has instigated a number of talent programs, by which Chinese researchers are sent to western institutions, but are then required to return to China, bringing the fruits of their research with them. A variant of CCP talent programs is to exploit Chinese diaspora scientists at western institutions, often by blackmailing them through family members and China itself. Such talent programs are part of the CCP’s national rejuvenation program by which it seeks to replace the United States as the world’s leading economic and military power. The CCP demands that any research and development that cannot be delivered from homegrown talent must be obtained from overseas. As well as talent programs, the CCP also exploits research collaboration with western universities and laboratories. There is in principle nothing wrong with this, as long as such western institutions appreciate that the CCP will try to steal any intellectual property produced by such collaborations. The problem arises when western scientists hide their connections to Chinese entities, as was the case with former Harvard professor of chemistry, Charles Lieber.

Frequently Chinese researchers are not forthcoming about their continued affiliation with the Chinese military. For example, open-source data obtained and analyzed by a private sector strategic intelligence firm, Strider Technologies, shows that since 2020 over 8,000 STEM publications have involved collaboration between Chinese military entities and more than 100 UK institutions. The Chinese – UK research collaboration includes dual use technology – those with civilian and military application – such as hypersonics and antijamming communications.

Russia is also pursuing research collaborations with western institutions, with the aim of obtaining dual use technologies[CW1] .

A new approach

There will always be a need for traditional vetting for sensitive positions in western governments involving national security. It would, however, be mistaken to think that such vetting is comprehensive.

In the past, vetting required full state-backed resources. Today, that is no longer the case. Private sector companies are now able to use AI driven open-source data to reveal insider threats which, in some cases, western governments have missed. In 2022, for example it was revealed that a group of Chinese scientists working at none other than Los Alamos returned to China bringing with them research into defense technologies like hypersonics. The perversity of this situation cannot be overstated: US national defense research was benefiting the principal US adversary.

Bold action is needed. Western governments would be well advised to establish oversight bodies to identify vulnerabilities in research with military or dual use application. All such research positions can and should be vetted by open-source private sector providers. A subset of academics and civil libertarians will inevitably denounce this as unduly invasive. The fact that such vetting would be based on open-source data should, however, ameliorate those concerns. Furthermore, incase there are concerns about racial profiling, the vetting would pertain to the research positions not researchers themselves.

Ultimately the issue at stake is about western economic security – the intellectual property that will provide western economic prosperity. Think of western AI frontier laboratories. The question is whether the west is prepared to allow the secrets of this century’s technologies to be transferred to the west’s principal strategic adversaries, China and Russia.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief