Getty Images / China Photos / Stringer

China’s government is on a digital giving spree. Over the past five years, the government has donated computers and equipment to governments in over 35 countries around the world. These gifts have been gratefully accepted by parliaments, political parties, government departments and even police agencies from Africa to the Pacific, from South East Asia to Eastern Europe and the Caribbean.

At the same time, Western nations are taking extraordinary measures to keep Chinese-made devices out of sensitive areas of their governments and militaries. Security agencies from Canada, Australia, the US and the United Kingdom have warned that Chinese-made devices could be used for spying by Chinese intelligence services.


Allegedly, some of China’s previous digital gifts have turned out to be Trojan horses for cyberespionage. This year, for example, it was reported that a computer system given to the African Union by the Chinese government was secretly sending data back to servers in Shanghai in the middle of the night. The Chinese government has denied the reports.

So far, there is no evidence that China’s digital generosity towards smaller nations is being used for espionage. In the face of the state’s rising ambitions on the world stage and against the drumbeat of warnings about its cyber capabilities, however, the question is – are there some gifts it might be better to refuse?

Read next Trump’s TikTok battle heralds the ugly birth of a new splinternet Trump’s TikTok battle heralds the ugly birth of a new splinternet

Knowing whether China’s many digital gifts to governments around the world are being used for espionage purposes is complicated, because most of the countries receiving gifts do not have the cybersecurity capacity to find out – countries which need to be given computers as gifts are, almost by definition, unlikely to have advanced cybersecurity capabilities.

Take Tonga. The tiny island nation received computers, printers and other devices from the Chinese embassy for its Ministry of Information in 2014, a time when it effectively had no national cybersecurity capacity – no official cybersecurity unit, no policies, no strategy, nothing. It wasn’t until 2016 that Tonga established a national Computer Emergency Response Team, the first in the Pacific.


Despite this extremely slow start Tonga is still ahead of some other recipients of China’s donated computers, like Malawi, whose Ministry of Trade and Industry was given $760,000 worth of equipment in 2018. China has been accused of exploiting the African nation, which ranks amongst the poorest countries in the world and does not have a national cybersecurity body. (China has denied all accusations).

What is clear, however, is that China’s gifts follow its economic, political and geostrategic interests. In 2017, for instance, the Pakistani parliament received 330 pieces of equipment as a gift from the Chinese embassy, including laptops, computers, scanners, printers and projectors. At the handover ceremony, Chinese ambassador Sun Weidong reportedly “expressed the hope that the two sides continue making joint efforts to push for the construction of the China-Pakistan Economic Corridor so as to better benefit the people of the two countries.”

China’s children are its secret weapon in the global AI arms race Long Reads China’s children are its secret weapon in the global AI arms race

Read next China is rapidly building a world-beating wind energy revolution China is rapidly building a world-beating wind energy revolution

Risks in the supply chain

The risk to national security from cyber espionage by the Chinese government, and from prominent Chinese technology companies such as Huawei, ZTE and Lenovo, is considered serious enough that normally secretive Western intelligence agencies are breaking their silence to warn against it.


The UK’s National Cyber Security Centre has said that the use of equipment made by Chinese company ZTE poses “national security risks… [which] cannot be mitigated.” The US Department of Defence has banned the sale of phones manufactured by Chinese companies Huawei and ZTE on US military bases. A Pentagon spokesperson said the Chinese-made phones “may pose an unacceptable risk to the department’s personnel, information and mission.” Despite this president Donald Trump has struck a deal to save ZTE and lift sanctions imposed on the firm.

The Australian Defence Department is also “phasing out” Huawei and ZTE phones. As far back as 2012, Australia stopped Huawei from entering a tender to construct its National Broadband Network, and is considering banning Huawei’s involvement in building 5G mobile networks in Australia. Three former directors of Canadian national security agencies have publicly warned their government that Huawei poses a risk, particularly in relation to the development of 5G technology. The Five Eyes intelligence agencies have reportedly had an unofficial blacklist against Lenovo devices for many years.

“If you think about how electronic components are manufactured on one side of the Pacific, assembled on the other side, packaged somewhere else and then shipped everywhere else, there are lots of points along the way to embed, alter, or add to a device,” says Brian Vosburgh of Interos, a company which specialises in supply chain risk management, and recently produced a report for the US-China Economic and Security Review Commission on supply chain vulnerabilities in US federal ICT equipment from Chinese-made products.

This includes the kind of devices which people might not normally think could be used for espionage. “Seemingly innocuous equipment like a keyboard still connects to another device and contains hardware that can mask keylogging functionality that could transmit login credentials,” says Vosburgh.

Read next The colossal scale of China’s coronavirus censorship on WeChat The colossal scale of China’s coronavirus censorship on WeChat

“In [cyber]security, if you can touch it, you can own it,” says Adam Meyers, VP of intelligence at CrowdStrike, a cybersecurity company which monitors and protects against global cyber threats. “Software supply chain attacks have long been associated with nation-state espionage operations. In 2017, this technique really appeared to spread alarmingly.”

“The infection of software update processes was observed in criminally motivated and destructive campaigns, in addition to likely state-sponsored activity across the globe. It’s a real threat to national security for public organisations, but also in terms of the impact on the running of key economic sectors.”

According to Meyers, it’s hard to even detect if a supply chain attack is happening in the first place. “For years security researchers have warned about attacks against embedded systems,” he says. “For example, years ago it was demonstrated that malicious code could be embedded on chips in network cards and other devices that interact with the computer hardware underneath the operating system. These types of implants would be extremely difficult to detect.”

CrowdStrike has been tracking Chinese activities in cyberspace for a decade, and has watched them grow in scale and sophistication. “Threat intelligence has demonstrated Chinese involvement in many covert cyber data acquisitions, and given what is known about China’s economic, military, and political goals, it’s reasonable to assume that efforts to secure data on people, enterprises, governments, and intellectual property will continue indefinitely,” says Meyers.

The UK's Kaspersky warning is a reminder: data ignores borders Russia The UK's Kaspersky warning is a reminder: data ignores borders

Read next Banning WeChat will destroy a lone bridge between the US and China Banning WeChat will destroy a lone bridge between the US and China

Red flags in Africa

The rapid expansion of China’s overseas economic interests is perhaps most visible in Africa, where China is now the single largest source of foreign investment, ploughing billions into infrastructure and resources across the continent, including many millions of dollars in gifts to African governments and political parties.

Allegedly, however, some of these gifts have turned out to be more than they appeared. In January 2018 French newspaper Le Monde published an explosive report claiming the Chinese government had been spying on the African Union’s (AU) headquarters for years. China built and gifted the building in Addis Ababa to the AU in 2012.

According to the report, which was based on information from unnamed AU officials, in 2017 IT staff noticed unusual spikes in activity on the servers of the building’s computer systems – which were also made and gifted by China – between midnight and 02:00. After investigating further, they allegedly discovered that two backdoors had been built into the system, and were being exploited to send confidential data to servers in Shanghai.

The Chinese government immediately rejected the report, denouncing the claims as an attempt to interfere in the relationship between China and the AU. The AU’s response was rather more intriguing.

After initially declining to comment on the allegations, when an official rebuttal finally came it was from an AU official standing next to the Chinese Foreign Minister in Beijing, and was curiously qualified by an argument that China would not want to spy on the AU.

Read next Chinese hackers targeted major UK companies as coronavirus raged Chinese hackers targeted major UK companies as coronavirus raged

“The African Union is an international political organisation. It doesn’t process secret defence dossiers. We are an administration and I don’t see what interest there is to China to offer up a building of this type and then to spy,” head of the African Union Commission Moussa Faki Mahamat said. “So these are totally false allegations and I believe that we are completely disregarding them.”

The idea that intelligence operations are only about accessing top secret information is flawed, says Peter Mattis, a fellow in the China Program at The Jamestown Foundation. “People always screw up when talking about intelligence as the issue being the acquisition of classified material. It's not,” he explains.

“Intelligence is about getting information that's slightly better than what you've got. That could be classified material. It could be unclassified but inaccessible material, like emails. All of these could be potentially valuable, and so even if they're not necessarily breaking into closed networks, anything which is better than what they've got or anything better than the newspapers is potentially very useful.”

In other words, any information which can be used to boost China’s negotiating position or give it an edge over its rivals is potentially of interest to Chinese intelligence agencies. And, lately, China has been negotiating a lot of deals.

Belts, roads and routers

China’s most ambitious foreign project is the Belt and Road Initiative. Announced by president Xi Jinping in 2013, the policy calls for a vast Chinese investment in infrastructure to build trade routes connecting China’s less-developed border regions to Europe, with a land route passing through Central Asia, and a sea route passing through Southeast Asia, the Middle East and northern Africa to reach the Mediterranean. This enormous initiative is seen by many as being as much about China’s strategic and geopolitical goals of expanding its global influence and countering American dominance as it is about economic interests.

Read next Inside Huawei's 5G implosion Inside Huawei's 5G implosion

Supporting the Belt and Road Initiative has been a particular focus for Chinese cyber activities, claims CrowdStrike’s Adam Meyers. “China has a particularly well organised and funded nation state [cyber] programme, and much of this is designed to support high-priority projects for the 13th Five Year Plan, such as the Belt and Road Initiative,” Meyers says. “Because investments into these projects span the globe, targeting has been observed in widely diverse regions, such as Belarus in Eastern Europe and Cambodia in Southeast Asia.”

As it happens, Cambodia’s National Election Committee has received over $12 million in gifted equipment from China, including computers, surveillance cameras and printers, while Huawei has been rapidly expanding its presence in Belarus.

China has not released a complete official list of either the projects or the countries involved in the Belt and Road Initiative, but it includes: Pakistan, which received 330 pieces of equipment as a gift from the Chinese embassy; Serbia where IT equipment has been donated; Sri Lanka, where China gave the parliament $290,000 in computing equipment in 2017, and Laos, where China has donated office equipment to the Ministry of Defence. Nigeria, Mauritius and the Seychelles have also received equipment.

Are China's intelligence activities following its economic push? “Yes, or one would have to assume so,” says Mattis. “The way the Chinese government defines intelligence is that it's information which supports decision-making. So if they're pushing out and engaging in a lot of different economic activity, or expanding their footprint in a lot of countries overseas, then of course the intelligence services are going to follow, of course there's demand for more information.”

Big data meets Big Brother as China moves to rate its citizens Long Reads Big data meets Big Brother as China moves to rate its citizens

Read next Banning Huawei’s 5G tech in the UK was the easy bit. Now it gets messy Banning Huawei’s 5G tech in the UK was the easy bit. Now it gets messy

Warships and the web in the Pacific

Economic interests aren’t the only issue at stake for China – military interests, particularly in the Pacific and South China Sea, are also high priorities. China has been lending heavily to the nations of the Pacific, funding massive infrastructure projects and extending billions in credit which the small island states can ill afford.

Countries from Vanuatu to Samoa have found themselves caught up in a web of power, politics and above all, money. This so-called “debt trap diplomacy” has seen Papua New Guinea’s cost of servicing debt to China increase 13X in just five years, whilst Chinese debt and political influence is seen as a key factor in toking the current turmoil in the Maldives (the Maldives’ Ministry of Foreign Affairs received a computer system from the Chinese embassy in 2014).

The growing dominance of China is sparking tensions with other major powers in the region. The stand-off has at times gone beyond diplomatic jostling. At the peak of the political crisis in the Maldives earlier this year China dispatched eleven warships to the region, much to the alarm of India.

As China and its rivals eye each other warily across the seas, the tiny Pacific nations in the middle risk finding themselves caught up in a geopolitical tug of war in which their every move will be watched – perhaps more closely than they realise.

Taking gifts or taking risks?

The ability of small governments to defend their nation’s interests depends on how well they can dance the difficult diplomatic tango with larger powers. Keeping their information networks secure is a crucial element of national security.


There is no conclusive proof that the thousands of digital devices and networks which China has given to other governments in recent years are being used for intelligence gathering. Given the very limited cybersecurity capacity of the countries receiving them, it may be unlikely that such activity would be detected if it were taking place.

What can be gleamed, however, is that this gifting of devices appears to be a pattern of behaviour targeting strategically sensitive areas of governments in developing nations by a rising super-power with well documented cyberespionage capabilities, almost unmatched resources and strong motivations.

In the highly charged context of China’s global rise to power, and against the long history of Chinese cyber operations, perhaps governments should be asking themselves whether such gifts are really free – or if there might be some Trojan horses better left outside the gates.