While most scientists sent abroad by the PLA appear to be open about which institutions they come from, this report has identified two dozen new cases of PLA scientists travelling abroad using cover to obscure their military affiliations. In at least 17 of these cases, PLA scientists used cover to travel to Australia. These scientists use various kinds of cover, ranging from the use of misleading historical names for their institutions to the use of names of non-existent institutions.

Features of deception by the PLA

An article from 2002 on the website of a Chinese overseas study agency offers insights into the use of cover. In response to a question asking whether having graduated from a military institution would affect one’s ability to get an overseas visa, the company responded:

Many military colleges and military units externally have common names (民间称呼) that don’t reveal their military characteristics. NUDT, for example, is externally known as Changsha Institute of Technology. This is the best way [to avoid having your visa application rejected].56

The Changsha Institute of Technology was a PLA institution subsumed by NUDT in 1975.57 While the quote above doesn’t come from an official source, it at least indicates how these unsophisticated but nonetheless effective covers are understood as tools for hiding one’s military background.

Besides using non-existent institutions with innocuous-sounding names as cover, PLA members also claim to be from real civilian institutions in the same regions as their military units. New Zealand MP Yang Jian, for example, who taught intelligence officers at the PLA Foreign Languages Institute in Luoyang, claimed in his New Zealand residency application to have worked at Luoyang University.58 Before moving to New Zealand in 1999, Yang received an Australian Government aid scholarship to study at the Australian National University, earning a master’s degree and doctorate in international relations. During that period, he interned at the Senate Standing Committee on Foreign Affairs, Defence and Trade, and headed the Canberra Chinese Students and Scholars Association, which retains intimate ties to the Chinese Embassy to this day.59 Yang told media, ‘the system asked me to use the partner university,’ referring to Luoyang University.60

A number of PLA scientists using cover to travel abroad have created LinkedIn profiles using their cover institutions, which may have been used to shore up their claimed affiliations while overseas.61

The use of cover appears to be managed differently by each institution, some of which use cover far more often than others.62 Cover is also not used consistently within each institution. As described below, PLA Information Engineering University (PLAIEU) researchers have both used cover and openly stated their affiliation at the same conferences. It’s unclear whether this indicates that the use of cover is up to the discretion of each researcher or perhaps that it relates to the sensitivity of a researcher’s work or position in the PLA.

NUDT appears to no longer use the ‘Changsha Institute of Technology’ as cover, but it engages in a different kind of deception. A document published by NUDT for students hoping to study abroad advises them that, when providing documentation in their applications to foreign institutions, ‘military and political courses can be excluded’ from their academic records.63 This appears designed to mislead overseas authorities, universities and researchers by downplaying the extent to which NUDT is a military institution and to which these students are military scientists.

The Xi’an Research Institute of High Technology

Scientists from the PLA Rocket Force Engineering University (RFEU, 火箭军工程大学)64, a key research base for the PLA Rocket Force, claim to be from the ‘Xi’an Research Institute of High Technology’ (西安高技术研究所), which appears to only exist on paper.

At least five RFEU scientists claiming to be from the Xi’an Research Institute have travelled overseas as visiting scholars, including one of the PLA’s leading missile experts, Major General Hu Changhua (胡昌华), and three of his close associates at RFEU. General Hu (Figure 5), who heads RFEU’s Missile Testing and Control Simulation Experimental Teaching Centre, visited the University of Duisburg–Essen in Germany for four months in 2008.65 It’s unclear what he worked on in Germany, as he didn’t publish any papers while there, but his work for the PLA focuses on flight control systems and fault diagnosis for missiles.66

Two RFEU scientists who frequently publish with Hu, Zhou Zhijie (周志杰)67 and Wang Zhaoqiang (王兆强),68 were visiting scholars at universities in England; they claim in their English publications to be from the Xi’an Research Institute.69

Figure 5: Major General Hu Changhua, profiled by China Central Television’s military affairs channel in 2016:

‘Right now I’m a professor at RFEU and head of the Military Key Lab on Missile Testing and Control Technology.’

Figure 5: Major General Hu Changhua, profiled by China Central Television’s military affairs channel in 2016: ‘Right now I’m a professor at RFEU and head of the Military Key Lab on Missile Testing and Control Technology.’



Source: CCTV, 28 October 2016, YouTube.

Hu Xiaoxiang: a case study

Identifying the Xi’an Research Institute of High Technology as a cover institute helps shed light on the January 2015 expulsion from Norway of a Chinese scientist and his supervisor, a dual citizen of Germany and Iran. The expulsion came after Norwegian authorities determined that the work of the Chinese scientist, later named in court as Hu Xiaoxiang (扈晓翔), could be used to develop hypersonic cruise missiles (Figure 6).70

Figure 6: Hu Xiaoxiang

Hu wrote five papers with his supervisor at the University of Agder, all of which listed the Xi’an Research Institute as his affiliation. The papers focused on air-breathing hypersonic vehicles, which travel at over five times the speed of sound and ‘can carry more payload than ordinary flight vehicles’.71 Hu’s work was supported by a Norwegian Government grant for offshore wind energy research.72

Besides his affiliation with the Xi’an Research Institute, there’s a large body of evidence tying Hu to RFEU. The website of RFEU’s missile research centre states that Hu Xiaoxiang won an award in 2014 for his PhD thesis on hypersonic aircraft, supervised by General Hu Changhua.73 The website also says that in 2014 he received 250,000 renminbi (A$50,000) from the Chinese Government for a three-year research project on hypersonic aircraft (Figure 7).74 In 2016, he was described as a lecturer at the centre, which received 14 awards for missile research between 2010 and 2014.75 In some publications, Hu also listed the Harbin Institute of Technology, a civilian university heavily engaged in military research, as a second affiliation.76

Relations between China and Norway were put on ice when the Nobel Peace Prize was awarded to Chinese democracy activist Liu Xiaobo in 2010, and the Chinese Government was quick to attack Norway for Hu’s expulsion.77 Only in December 2016 did the two countries ‘normalise’ diplomatic relations. Public statements by Norwegian authorities didn’t explain the Chinese scientist’s military affiliation or mention the Xi’an Research Institute, as the information was likely classified.

Figure 7: A paper published by Hu Xiaoxiang shortly after his expulsion from Norway, stating an affiliation with RFEU in the Chinese version of the abstract but the Xi’an Research Institute in the English version.

A few months later, in September 2015, a court overturned the expulsions. Hu’s lawyer stated after the trial that ‘there is no evidence in the case that my client is part of research collaboration on missiles and weapons with China.’78 The University of Agder lauded the decision as a win for academic freedom.

The Norwegian Government later successfully appealed the overturning of Hu’s supervisor’s expulsion. However, it’s unclear whether any appeal was made in Hu’s own case, which hasn’t been made publicly available.79 Neither the Xi’an Research Institute, Hu Changhua nor RFEU was mentioned in the judge’s ruling on the German-Iranian supervisor’s case or any coverage of the expulsions.

The Zhengzhou Institute of Surveying and Mapping

Among the 40 Chinese military scientists listed as presenting papers at the 9th International Symposium on Mobile Mapping Technology, nine claimed to be from an institution with no apparent military affiliation.80 Most of the other 30 military scientists at the conference, hosted by UNSW in December 2015, were openly from NUDT and a research institute of China North Industries Group Corporation (also known as Norinco Group), China’s largest arms manufacturer; the rest came mainly from the PLA Information Engineering University.

The nine claimed to be from the Zhengzhou Institute of Surveying and Mapping. This institute, which was officially known as the PLA Institute of Surveying and Mapping, no longer exists, having been subsumed in 1999 by PLAIEU—itself a major player in cyber operations and a key training ground for signals intelligence officers.81 The Zhengzhou Institute appears to live on as cover for PLA scientists interacting with foreigners. Nearly 300 peer-reviewed papers have been published by authors claiming to be from the institute.82

The use of the Zhengzhou Institute of Surveying and Mapping as cover doesn’t stop at international conferences. Numerous examples of visiting scholars claiming to be from there have been uncovered for this report. They include Zhu Xinhui (朱新慧), a lecturer at PLAIEU specialising in navigation technology, who visited UNSW from 2015 to 2016.83 In numerous journal articles and in the program of the mobile mapping conference mentioned above, however, she is described as being from the Zhengzhou Institute of Surveying and Mapping.84

Guo Jianfeng (郭建锋), an associate professor at PLAIEU, visited Curtin University for a year in 2014. A specialist on navigation system data processing, Guo was described on the website of Curtin University’s Global Navigation Satellite Systems Research Centre as being on ‘sabbatical leave from the Department of Geodesy of the Institute of Surveying and Mapping, Zhengzhou, China’.85

The Zhengzhou Information Science and Technology Institute

Another cover institute, the Zhengzhou Information Science and Technology Institute (ZISTI), which appears to exist only on paper, has also been widely used by PLAIEU scientists to publish research and travel overseas. More than 1,300 pieces of peer-reviewed literature have been authored by individuals claiming to be from ZISTI.86

One paper in a Chinese-language journal by a PLAIEU researcher, which includes an English version of the abstract and author information, clearly shows that ZISTI is a cover institute (Figure 8). The paper’s Chinese text describes the first author as affiliated with PLAIEU, but the English version describes the

same author as affiliated with ZISTI.87 Nearly all of the authors sampled who claimed an affiliation with ZISTI could be shown to be working at PLAIEU.

Figure 8: Chinese and English versions of a paper published by a PLAIEU scientist, demonstrating the use of the Zhengzhou Information Science and Technology Institute as cover.

Scientists claiming to be from ZISTI have attended international conferences both inside and outside China. For example, seven researchers affiliated with ZISTI are listed in the program of a conference on signal processing at the Gold Coast in Australia in 2014. Experts from American, Australian and Korean

defence research agencies were also in attendance.88

As with the Zhengzhou Institute of Surveying and Mapping, ZISTI has been used as cover for PLA scientists travelling overseas as visiting scholars. For example, Zhu Yijun (朱义君) is an associate professor at PLAIEU specialising in signals engineering.89 Claiming to be from ZISTI, in 2011 he visited Canada’s McMaster University, where he worked on wireless communications technology with wide-ranging military applications.90

PLAIEU scientists claiming to be from ZISTI have also travelled to the US as visiting scholars and for conferences.91

Espionage and intellectual property theft

In addition to their overt activities, PLA researchers, especially those who haven’t been forthcoming about their military affiliations, may engage in espionage or steal intellectual property while overseas. The PLA engages in such high levels of espionage that in 2014 the US Government took the unusual step of publicly indicting five Chinese military hackers.92 Military scientists abroad who regularly communicate with superiors in China, receive visits by superiors while overseas and return home in the middle of their time abroad for ‘remedial education’, as described in the examples outlined above, offer safe and convenient channels for Chinese intelligence agencies to access sensitive information from overseas.93

Amateur collectors with STEM expertise have been implicated in a high proportion of intellectual property theft and espionage cases involving China.94 Scientists and engineers involved in military research projects, while they might not have received formal training as spies, are uniquely qualified to identify and exfiltrate valuable information to overcome specific hurdles in the development of new technologies.