JD'S Memes

Researchers believe a suspected Chinese intelligence operation has tried to recruit former U.S. federal employees and public policy experts through fake websites and job postings, according to findings first shared with Nextgov/FCW.

One of those firms, Foresight and Strategy, posted a job in May seeking a remote policy analyst that would be paid upwards of $8,500 a month, according to Max Lesser and Maria Riofrio at the Foundation for Defense of Democracies. The opening sought individuals with experience in “policy research, preferably within international organizations, government agencies or think tanks.”

Foresight and Strategy has been the most recently active, though it shares the same website infrastructure and the same dedicated email server with two other sites, International Affairs Review and Institute of International Studies, which the FDD research also assessed as fictitious.

All three websites were registered in China, according to Lesser and Riofrio’s analysis, which cites internet domain records. Foresight and Strategy was registered in February 2022, while the other two sites were registered in December 2021, suggesting that the network first capitalized on the COVID-19 pandemic and its effect on spurring global remote work, according to the research.

Two other sites, Asia Pacific Political Review and Global Strategic Outlook, could also be a part of the network, the findings suggest, given various digital breadcrumbs available about the pair of sites, which can no longer be accessed.

Nextgov/FCW couldn’t determine if the websites were linked directly with the Chinese government and its intelligence agencies, nor could the FDD researchers measure how successful these websites have been in recruiting targets.

A spokesperson for China’s embassy in Washington, D.C., said they were not familiar with the network of websites and said the nation opposes “any smear and attack on China with so-called ‘spy risks’ without factual basis.”

Attempts to reach the sites’ overseers were largely unsuccessful. The majority of email addresses associated with the pages bounced back when Nextgov/FCW attempted to send emails.

An email address tied to Foresight and Strategy’s job openings, run by an individual listed as Keven Lee, did not return a request for comment. Foresight has posted job opportunities on sites like Craigslist and Arena Careers. One posting popped up in Colorado Springs, one of the nation’s largest military hubs that’s home to multiple Space Force bases and the Air Force Academy.

Lesser and Riofrio discovered the network of firms, dubbed the Foresight Network, while investigating a separate but related nexus of fake consulting companies, which were first reported by Reuters.

The recruitment efforts appear to have picked up steam amid Department of Government Efficiency-fueled departures and terminations of government employees over the last several months, Lesser, an emerging threats senior analyst at FDD, said in an interview with Nextgov/FCW.

The English-language writing on many of the sites sounds awkward, unnatural or poorly put together. For instance, a testimonial on Foresight and Strategy’s website reads, “I can’t believe it took us this long to make a change. So happy that we did. Numbers don’t lie.” The quoted individual is listed as John Doe, the CEO of an unnamed company.

In another case, the Institute of International Studies site features headshots of its partners that appear to be taken from elsewhere online. Reverse image searches link them to WordPress templates sold by a third-party vendor, suggesting they came directly from template demos, the research shows.

But Lesser said that, despite the unpolished presentation of these websites, the efforts can still have repercussions. Last week, a State Department official was sentenced to 48 months in prison for transmitting classified national defense documents to Chinese intelligence agents. Court filings say the official communicated with two individuals who identified themselves as employees of international consulting firms, mirroring techniques observed in the FDD research.

“It shows that this type of activity has consequences, even though it appears crude,” Lesser said. “[People] might think, ‘how could somebody ever be duped by this?’” he added, but these feigned recruitment networks “only really need the thinnest veil of cover for that initial approach.”

Many of these sites don’t have affiliated registered organizations, Lesser said, citing the FDD findings, which included queries of public company databases. “You don’t even have to create a shell company. You just have to create a low-effort website,” he said.

The Foresight research was also reported to law enforcement, Lesser said.

In a statement to Nextgov/FCW, the FBI declined to comment on the specific network of websites observed, but said it’s aware of foreign adversaries using employment sites and social media platforms to identify knowledgeable individuals who are targeted for recruitment.

“Often those targeted have security clearances and access to classified information. But our adversaries also are looking for experts in business and academia with technical expertise,” the bureau said, adding that it’s been working to provide education to organizations about the schemes.

“We also advise people to report suspicious profiles and postings to the FBI and their employer’s security officers,” the statement added.

Chinese intelligence entities have deployed online efforts to recruit unwitting current and former federal employees, the National Counterintelligence and Security Center said in April. In March, CNN reported that foreign adversaries, including China and Russia, accelerated efforts to recruit disgruntled federal workers in national security roles, citing people familiar with U.S. intelligence on the matter.

“Given the amount of federal workers looking for new employment, this tactic shouldn’t surprise anyone. Job seekers — and lucrative offers that are too good to be true — are a dangerous combination.” said Brian Harrell, a former assistant secretary in the Department of Homeland Security. “While this adversarial tactic isn’t new, you now have more eyeballs in the market who might be willing to inquire, so due diligence and some professional curiosity goes a long way.”
 
You must log in or register to reply here.
Back
Top