Transcript of Fake Jobs, Real Spies: China’s Online Recruitment Machine | EYES ON GEOPOLITICS

Hey everybody, welcome to another episode of Eyes on Geopolitics. I'm joined today with Jonathan Hackett, and our special guest is Max Lesser. Uh, I'm gonna give you the official bio because that's what, like, professionals do, Max, so this is what I'm gonna do. Max is a senior analyst on emerging threats at FDD Center on Cyber and Technology Innovation. Max previously served as head of US policy analysis and engagement at Darktrace Federal, a cybersecurity company that specializes in AI. Max Research basically goes into forum-aligned influence, and it's been referenced by OpenAI and featured in the New York Times, the Wall Street Journal, and NBC News. And now he's hit the big leagues with Eyes on Geopolitics podcast. Max, thanks for joining us.

Thank you.

Also, I do have to say he's a Harvard guy, so him and Jonathan had a little bit— some words before we started recording. Because of course, Jonathan's a Yale guy. He doesn't stop reminding us. Max, I mean, you sent over some of your, like, some of your work and stuff like that. It's pretty incredible what's been going on over the last few years specifically. It's kind of like really scaled up, it seems, where essentially espionage has— there's like a new, new, like, domain of espionage. And it's like gig economy workers and getting people like, you know, it seems like the scale has increased dramatically, right? Like, it's not like an old crusty CIA case officer or MSS officer trying to recruit somebody in some European, you know, city or country. It's more online. And the key thing that I saw that was very interesting to me was back in February of 2025, when a bunch of like federal workers were doxxed essentially, You know, there was a bunch of, you know, a ton more people looking on the job market, obviously, after that. And it seems like China really did really put a lot of bandwidth into like trying to recruit those people as like consultants and then like, you know, maybe do a one-off kind of, you know, report and then like kind of ask for a little bit more.

That's a little bit sketchy and could be seen as you spying on your own country. So yeah, I mean, I don't even have a question. I just thought it was super interesting and stuff like that. If you want to get into it, Max, and give us like the actual informed, the informed, like, you know, you know what you're talking about. So just give us, give us what you got, essentially.

Yeah, no, I mean, there are so many different angles from which we could approach this conversation. I guess I'll start with how I started researching this. So like you mentioned, in February 2025, just coincidentally, that was when my wife started looking for a job, and she wasn't affected by layoffs or anything like that, and she was interested in geopolitical risk. So I was scrolling through LinkedIn trying to help her look for geopolitical risk consulting jobs, and I came across one that was offering good pay, seemed interesting. It was remote, which was obviously appealing. And I'd never heard about it before. And the LinkedIn presence was kind of sparse, right? Like there wasn't a lot on its profile. And I looked at the website and I was like, hmm, it just— there was just something that felt a little bit off about the website. Like my spidey senses went up. And as you mentioned, Dee, like one of my main focus areas when I started at the think tank where I now work, Foundation for Defense of Democracies, was foreign malign influence. So a lot of that's looking into covert networks on social media. But a huge part of it is also looking at fake websites, right?

Fake news websites and things like that. So I sort of knew I had reflexes built to know how to investigate these sorts of or any sort of suspicious website. And you can read this in my report. It's no big secret. They— whoever created this website was not super mindful of operational security because when I looked at its WHOIS information, which is sort of information that tells you about— tells you who registered a website, it showed that the registrant's country was in China.

Like, all—

most of the information was redacted, but you could see the that the registrant was based in China. And the consulting firm said that it was dual headquartered in Colorado, interestingly, and Singapore. So that didn't seem right. And that, you know, the investigation continued, the thread started unspooling, like, and it took me to a broader network of, I believe it was around 5 or 6 different websites. And this was a sort of rare occasion with even just with open sources, I was able to trace it back. to a Chinese internet company, which I pretty conclusively was able to determine created that network. And they, like you mentioned, Dee, they put up ads on Craigslist saying, you know, have you been— more or less, I'm paraphrasing here— have you been affected by the layoffs? You know, if so, like, we're going to help you out, right? So they were, it was, they were, you know, explicitly targeting people who were affected by the layoffs, interestingly, on Craigslist, which I'm not sure what federal employee is like. former federal employees up on Craigslist, but it was pretty funny. So that's just what got me started on this. I believe it was the first sort of open source intelligence report done by, you know, like a nonprofit, someone outside of government covering the topic, to my understanding.

And since then, you know, a lot of people have come to me with questions and I've done 6 you know, follow-up reports. I've done a lot of research on this topic, both investigative research and also just sort of piecing together the, you know, putting together all of the pieces when you look at government reporting and affidavits and things like that that have come out. So that's just sort of my story as how I started getting interested in this topic. And then, yeah, now we can really go from anywhere because, again, I've kind of looked at this from many different angles.

It's really interesting, Max, because you kind of bring together— there's like the wide net approach that some Chinese intelligence officers have, and then there's more targeted approach that others have depending on what the mission is. You know, I worked a long time ago, uh, on an industrial espionage operation. I was doing counterintelligence against the F-35 program, which back in 2010, the Marine Corps got its first shipment of F-35s. And immediately MSS had people physically in the United States gathering intelligence on the F-35 so they could build the J-31. of course, which is like an older story that was more targeted that they were doing. But I know they also do, especially against Chinese nationals or people with Chinese connections back to China that are in the United States. This is a typical target of theirs. And I know you worked on one research project for, I think it was Jun Wei Yu, who was recruited back in 2015 and then was run as a source throughout from 2015 to 2020. What do you see as why China would choose these Chinese nationals? You know, because like, for example, we in the United States, CIA and defense human intelligence, we don't really care what the nationality of the person is.

We care more about what's their placement and access, what is the susceptibility to their recruitment, what ways can we access them if we need to get to them or meet with them. You know, like, we're more kind of like pragmatic about the stuff they have and the stuff they can do, whereas it seems China is more interested in first, are they connected to China, and then they have more questions.

Yeah, I mean, so I think One of the things when we look at just specifically this sort of narrower tactic, which is, you know, virtual targeting and virtual espionage, one thing about the sort of like ethnic angle is they often like oftentimes like to pose as Singaporean consulting firms. And one of the people who was most famously involved was Dixon Yeoh, who is a Singaporean national, you know, who appears to be of, you know, ethnic Chinese descent. And I think they sort of realized that Americans might not be able to tell the difference between somebody from Singapore and somebody from mainland China, which, like anybody who's familiar, like there's significant cultural differences. You know, the Singaporean English dialect sounds nothing like, you know, a mainland Chinese English accent. But that's sort of the ethnic component. And then the broader topic, which you, which you mentioned, I mean, You know, it's hard for me to say exactly. I'm not in the mind of a PRC operative, but I do think something that the PRC is very aggressive about is like harassing, you know, family members or any connection that's in the mainland to try to coerce people who are overseas.

And they don't just do this for intelligence gathering. They do this also for transnational repression. Right. When we talk about foreign malign influence, which is sort of an adjacent and overlapping topic with espionage, there's a lot of cases I've seen where they will harass family members to try and get information or try and keep people from spreading information overseas. And sometimes even, I mean, they will literally just go after dissidents living overseas. Like there was one case that was written where I think they were like, harassing the daughter, like the teenage daughter of a dissident living in, I think, Canada. So obviously, like anytime when there's a mainland connection there, especially if there's like a family member or maybe financial interests that intersect with mainland China, that just gives them leverage. Right. So, yeah. So I think that definitely is a component. of, I think, their broader espionage strategy and transnational repression strategy for sure.

And that's like the kind of inner workings of an operation. And I actually, I'm sure a lot of listeners are a lot more familiar with Russian espionage, especially SVR and GRU, and they're more familiar with Iran just because it's kind of in your face today. But I think Chinese espionage is a little bit less understood, at least the nuts and bolts level in the West, because it kind of happens in a way that's very different than Russian or Iranian espionage. very different purposes. And for a long time, for example, the Russian intelligence priorities, if you looked at what was their number one priority, collection priority in any country, whether it's Argentina or Jordan or whatever, number one collection activity target, what is the US doing in this country? That was in every single country. That is Russia's top human priority, which is kind of fascinating that Russia's collecting on the US in these countries. And I'm curious if you have any insight on what are China's collection priorities, not just in the United States, but just kind of generally.

Yeah, I mean, again, so quickly, like, so I think there's— and I'm happy to discuss this— there are some experts out there who are like extremely well-versed in just the broader Chinese espionage threat. I feel like I've established a narrower expertise, which is more of like this sort of virtual targeting TTP, which I know super in-depth. But obviously I also studied the broader priorities. And I think Just to look at it from the angle from which what I'm studying, right, which is like firsthand, like when I look at these fake consulting companies, when I look at these job listings, when I look at the targeting profile in these campaigns that I'm studying, it's pretty fascinating, right? Like I've seen websites that are looking for people with expertise in psychological operations, right? So like more sensitive military you know, areas of the military. I've seen job listings looking a lot of times asking for people with expertise in, you know, the Indo-Pacific for obvious reasons. Taiwan is a huge one. I would say that another huge thing that I've seen is they'll just look for people who have experience at international organizations. Right. So any sort of broader foreign policy experience, when you look at the specific campaigns that have involved this, this virtual targeting dimension, I mean, it's not like it's really— that's a tactic or a TTP that can be used to pretty much achieve almost any objective.

Right. I mean, they've gone after everything from people with only peripheral access to government information, like people at think tanks. Right. To people who actually have hold clearances. Right. But I'd say, like, you would, you would think that maybe, oh, they're looking for classified information. And I would say, I think that is even too narrow of a scope in terms of what they're looking for. They're also looking for valuable forms of nonpublic information. So famously, Dickson Yeo, who was this Singaporean national who began working with, you know, the PRC, I believe, around 2015, he asked a State Department official to just give him a sort of profile of the personality of a member of cabinet, of the cabinet at the time. Right. So I think it's, it's really just sort of a broad spectrum of different collection priorities that are reflected in the campaigns that I have, that I have looked at firsthand. And I think it's also, I mean, I've seen a lot of interesting things and it's sort of hard to know what to make of it exactly. But I've even seen some of these websites that, you know, with a fairly high degree of confidence, I believe, are involved in this Chinese virtual targeting or virtual espionage opportunity, asking people for political expertise, asking for people to give insights into sort of elections or U.S. politics and to sort of look at elections.

So one could also suspect that maybe they're looking for people to provide them with information that would inform their influence operations. But again, like, it really is like, it's just, it runs the gamut from like, you know, everything from just like, hey, can you give me sort of gossip about what's going on in DC, right? To, hey, can you hand over information about the F-35 program, which Dickson Yeo, actually one of the most famous people involved in this type of activity, back in 2015, if you read the, you know, his, his guilty plea and everything, one of the first cases they highlight is, is somebody giving over information, which I believe is even public information, but writing a report about how Japan had purchased F-35s. Right. And one other thing I'd mention that I think is important, and I think especially if there's anybody listening who's a federal, you know, former federal employee or whatever, somebody who's you know, currently or previously had access to sensitive information is they'll sort of start by asking for less sensitive information and then they'll begin escalating. Right. Which isn't, I think, unique to the virtual targeting tactic. But I think that's something that if you read these cases, you see again and again and again is they'll just escalate and they'll escalate and they'll escalate.

So yeah.

Hello everyone, if you're hearing this, uh, you are not a member of the Patreon. You can get your hands on ad-free episodes that come out early, and you can ask us questions, maybe we'll answer them. You can also watch the Team House podcast completely ad-free and early, and you can also watch it live as we interview our guests. Um, and it's the best way to support the channel. So if you can, if you're open to it, you can go to patreon.com/theteamhouse. That link is in the description. We appreciate the supporters and we hope you would consider being one. So it's patreon.com/theteamhouse. Thanks, guys. John, I got a question for you, right? You're a counterintel guy, right? By trade, essentially. What happens?

I'll never tell.

Yes. What happens if a former federal worker, like, you know, establishes a relationship with a consulting company they've done a couple of, you know, benign reports about like something, you know, using open source, and then their client essentially asked them for more that they know that even for them starting to ring alarm bells, like, I don't know if I should fucking do this. What does somebody like that do?

Well, first of all, this is a classic elicitation technique or campaign, which is a collection of tools used to gain information that a person is not aware is the information that's desired. And the technique they use is something called the hourglass technique, where they start out very, very broadly. There's usually 1 or 2 small bits of information that are actually relevant that they want from you that they won't ask obviously upfront, maybe not even the same first conversation, maybe not even conversation number 5. And what they're doing is slowly building trust and also distracting you from what is the core information they want so that when they do get that information, if you were debriefed afterward, you wouldn't even remember that that's what they asked you about or what you said. And people tend to remember questions they were asked but not statements that were said to them. And a lot of these elicitation techniques, not just Chinese but in general espionage, if you're good at elicitation, you will not ever ask the question about the information you want. Instead, the person will almost be like erupting with a desire to tell it to you.

That's good elicitation, right? And I just want to like put that out there because it's not like there's some super smart people and then there's dumb people and like the dumb people are the targets. No, good elicitation targets the smartest people. And sometimes those are the people that are the best targets because they think they're smart enough to avoid elicitation and they'll never know that it's actually happening to them. And that's really key is to be very careful about These contacts because they do start really slowly. There's a classic example of Sergeant Lone Tree in Russia in the 1990s. He was a Marine Corps embassy guard who had top secret security clearance in Moscow, and he met a girl at the bar. She was in a red dress. She was attractive. You would not use that adjective to describe him. She basically developed him over time and really actually drove a wedge between him and the United States because he was a Native American. She kept pulling on this thread that you know. Other people in America look down upon you and like you could be part of something bigger and so on and so on.

Never asked him a question. And then one day they were in the hotel room together and there's a knock at the door and it's Uncle Miro and Uncle Miro wants to talk to him. But by then it was too late because the elicitation had already worked and he had already given information about the embassy, like unwittingly. Then he went and told the embassy about it. And this is getting to your question, D. He went to the embassy and told them about it, but it was too late. He had already broken the law, and he did go to jail and serve time in prison for this. And this is a classic example that we teach at the counterintelligence course. We a lot of human intelligence courses teach this case because it's classic. Like you don't realize it's happening to you; it's too late by the time you notice. Like you know what? That special access program radar system is a special access program. I shouldn't have been discussing that. You know, but the piece you discussed was so off of what you were thinking that it's like. Damn, it's too late. So basically people sign nondisclosure agreements both when they first have their clearance and then when their clearance is taken off and in an active status.

And, but they're beholden in that national— in that nondisclosure agreement to never ever say that stuff. So even if it's like 50 years later and they're in a rocking chair and they're on Facebook and an MSS guy contacts them, it's like, you know, wants to reminisce with them about the old days. back when they were a pilot. You know, as you've seen, there's been some American pilots who were recently implicated in Chinese espionage activity with US aircraft and sharing information. That's how these things start. It's people that are gone. They've left their job, and— but the information's still in their brain, and they're walking around as like this juicy tomato that the MSS officer wants to just pluck. And the person just needs care and feeding. They just need water and sunlight.

Yeah.

And eventually that tomato will be ripe enough to pick and the person won't even realize it.

Yeah. Wow.

I mean, it's funny, John, as you mentioned that I haven't seen this directly, but I'm wondering because you see this in influence operations, well, they'll, they'll like the profile photos of the Twitter pages will be like, you know, all of these sexy ladies. I'm like, is there going to be like virtual targeting via catfishing or something like that? Like, You know, there is already. Yeah, I'm sure that already happens a lot. I mean, I know that like, um, in, you know, the Russia, you know, the Ukraine war, like, I know that Ukraine has apparently used tactics like that, um, like catfishing to like get Russian soldiers to reveal their information on dating apps and things like that. But yeah, that isn't something I've— maybe I should create some burner accounts on Tinder or something so I can start, uh, exploring how they're using that tactic. But that's not something I've looked at directly. But it is interesting, like what you're saying, like that classic example you just described, how could that be implemented in the virtual sphere? I'm sure there's just like tons of opportunity. And I'm, I'm, you know, I'm pretty sure that stuff like that is probably already happening.

But again, I haven't been able to do an open source investigation into it.

Back in the day, actually, there's a PLA unit, 61398. I'm not sure if you're familiar with that. But they do a lot of signals intelligence and some offensive cyber activity. And they were, they were helping to enable another Chinese intelligence entity to do source meetings inside of World of Warcraft.

Oh, wow.

And they were, they were meeting with their assets in there and they were using World of Warcraft gold to pay their assets because that gold actually has a real tangible value in the real— like you can sell that gold on eBay, for example, or could back in the day that had, it had value. So they were actually able to do all of that without any detection outside of the server of the game, right? So since we know it, since I am talking about it, it is now known. But for a while it was not, uh, totally like an obvious thing. And it was a very, uh, kind of creative way to use the cyber environment a long time ago. This is not now, um, a long time before any of us were talking about this, you know, like on podcasts and stuff like that. It's kind of fascinating.

Wow, that is fascinating. I haven't, uh, I haven't dived into this myself, but I've read that like I think there was literally like Russian propaganda on Minecraft or something like that. So I mean, there's just a whole new world here of interesting activity that's happening for sure.

So talk about new activity. I don't know if like, if you guys have noticed, I know, I don't know if John, you're an Instagram guy or Max, you're an Instagram guy. But if you scroll through Instagram long enough, you start getting like, you know, cute like animal videos. And it always has like, it's a Russian influencer, right? And with Russian, like a Russian caption and stuff like that. And I don't know if it's an info, like an op or whatever, but it's to like, make Russians look like normal people. Like, you know, we're not like totally, you know, homicidal maniacs that invade, invade, you know, sovereign countries. But I've noticed it more and more that there is a ton of like, Russian influencers coming to the top. And it's like, it's not like, you know, OnlyFans girls or like girl like influence. It's more like wholesome kind of content with like, I look at my Sphinx cat that loves wearing turtlenecks or whatever, you know, like, I have noticed that more and more over the last probably 6 months on Instagram specifically.

Yeah, I don't— I mean, I feel like maybe my algorithm is different than yours. I am a cat owner and cat lover myself, but I'm not necessarily getting cat videos on the top of my feed. But to your point, Dee, I, I haven't looked into this myself and I would be interested, like, I think somebody could do a study where they create different profiles and see like how quickly, uh, until, you know, you start getting content that looks like propaganda that comes up. And I've thought about doing that before because usually when I look at influence operations, I'm looking kind of like from the outside in. Right? Like, I'll find a network and I'll expand the network, and I'm not usually looking as much from a user's perspective. But I did notice, so like, I recently, I'm like not the biggest personal consumer of social media, honestly. I like mostly consume it in a work context. But I recently created a sort of Instagram account to, you know, because one of my friends was making music. And this friend was sort of a more more sort of like alternative, you know, artists. It was more sort of on not experimental, but, you know, not mainstream.

And I'm not even joking, like on Instagram, I started getting like videos of people playing sort of like experimental folk music in China. And like, this kept happening. And I was like, this can't just be like, why is it just China over and over again? Like, this can't just be a coincidence. So I have— I, you know, this is just speculation, but I guess, you know, this is a place to speculate and things like that. I think that— and I've always known this to be true, but it's hard to know, like, I, you know, the stuff that I research and investigate and publish on, like spamouflage, which is sort of this classic long-running persistent Chinese influence operation that's very spammy and on social media, like, I really think that's the tip of the iceberg. And John, you might know the specific numbers, but when you look into like the amount of money that, that, you know, China or Russia is pouring into information warfare and influence operations, like, I think the stuff that we catch is, again, just a small fraction of it. So I wouldn't be surprised if what you're saying is true and that if there is something deeper going on, that's harder to detect.

And that would honestly be difficult for me as an open source investigator. to say definitively this is nation-state-backed activity, but I wouldn't be surprised if that's going on.

That's exactly the problem with COVID influence is that the very definition of COVID is that the sponsor is concealed. So we could be like, the activity is public or can be public, but the person who sent the stuff to happen is not public or is obfuscated or is misattributed on purpose. And that's kind of interesting to think about how many things do we see, especially on social media or other electronic means that we think is from X, but it's actually from Y, and Y is China, and X is, let's say, Belgium or some musician. And you're like, oh, that's so nice, but actually that was intentionally put there in front of you by somebody else, not by the person that you thought it was. And actually that kind of goes toward my thought about the crossover between the real world and the virtual world. And for a long time, China has had the Confucius Institutes, They've had student organizations. There's a China center here that has— it's actually got funding from China, has students from China in it that are promoting Chinese ideals and some other things. And there are reading groups that focus on specific Chinese literature that is very much aligned with what is the party line in China, and it's bringing in non-Chinese students to hear it and all this.

And I'm curious, where do you see that? Do you see that bleeding over into the virtual space that you're looking at?

I mean, 100%. And again, like, it's funny, I have a former intern who became my research assistant, and she's like, I guess I'm technically Gen Z, like I'm on like the cusp, right? But she's like, I've heard there's like Gen Z1 and Gen Z2, and she's like Gen Z2. So she's like on social media, and I feel like that just gives her like a level of skill and talent and awareness and all of this that I lack, right? So it's hard for me to say because again, like, I feel like, you know, because I study this, I'm like, oh my gosh, this is so toxic. It's like, I don't want to be putting this into my own brain, you know what I'm saying? But like, the thing is, is like, yes, 100%. And it's funny, like what you mentioned, John, about like the Confucian Institute and stuff like that. And it's like, you know, like I before, before, like, you know, it was really, I think, during like the first Trump administration when I think like people who weren't in sensitive spaces started becoming more aware of the China threat, right? Like, I remember like growing up, like, you know, it was like the sort of idea, at least that I had and that everybody had, you know, like I learned Mandarin for like 6 years in school.

And it's like, I feel like we were all like, oh, like China is like a great business opportunity, right? And like, we weren't necessarily seeing it as like fear competition or, you know, like a threat to U.S., you know, economic security, our way of life, things like that. But yeah, totally. I mean, they, they invest heavily in online influence operations and like, you know, it really depends like how deep you want to go. Right. And this is a topic that people don't talk about as often now. But just to sort of bring this back up again, just for people to look into, I'm, you know, there was a study put out by a group called the Network Contagion Research Institute. It was a few years ago. And this is just the study, right? This isn't me making any claim about anything. This is me just communicating what the study is to the best of my understanding. They looked at the time TikTok had transparency features, which I think would allow you to see like some breakdown of content. I forget whether or not it was by hashtags or whatever, but like anybody who was like advertising or doing digital marketing on TikTok would have access to this tool, right?

Because they would want to know like what are trending topics, right? And Instagram had a comparable tool and they looked, um, at, uh, you know, topics that were sensitive to the CCP and like, you know, like Uyghur genocide, right? And even things like, you know, like Tibet freedom and whatever. And even some more like interesting stuff, like I think like Kashmir independence, like Stuff that's like kind of very niche. And it was like dramatically less likely to be happening on TikTok than it was on Instagram. Like it wasn't trending on TikTok in the same way that it would on Instagram. Right. And you could read their report to get more of the details. And I know there were some critiques like about the methodology of it and things like that, which I haven't investigated myself, so I can't say. But I believe if I'm remembering correctly, that TikTok responded by taking away that transparency feature, like almost like the next day, right? So it's like, regardless of whether or not you, whatever you think about that study, which I think it was a fantastic study and a fascinating study, if you just look at the response from TikTok, that should tell you, okay, that's very concerning, right?

Like if there was nothing to hide, why would they do that? So it's just an interesting point, right?

Actually, the why is that concerning or is that concerning question is very interesting to me always to ask that, like, why should we care about this? Because a lot of Americans I talk to that are not in the intelligence community and not in the government, they're like, well, why does it matter that TikTok retains all my data and sends it back to China? Why does it matter that Little Red Book, back when TikTok was temporarily offline, why is it bad for me to use Little Red Book? Why is it bad for me to have WeChat on my phone, for example? maybe, maybe you can help some listeners who are less familiar with the China-specific issue. Why should they be concerned as private citizens?

Yeah, I mean, so I mean, there's the data privacy issue and, and that, and it's like sometimes hard to sell people on that because like, you know, as we know, I'm not trying to make a political statement here, but like when you see these stories about like how, you know, everything is constantly spying on you, you know what, like your smart TV is spying on you, your iPhone is spying, like it's like, okay, like Yeah, I guess that's kind of a hard sell, right? Like consumer, you know, whatever they call it, like surveillance capitalism or whatever. Like most people will be like, okay, I gave up, you know, the personal privacy thing a long time ago. Obviously trying to sell them that, look, when that information is in the hands of a hostile adversary, that is a different conversation. Granted, if somebody is not, you know, speaking out against the CCP or whatever, then maybe that's not a concern. But I always try and tell people, is from a broader perspective, like, you know, like John, you might— and or Dee, you guys might know more about this. This isn't something I've looked into too deeply myself.

But like, you know, the Chinese police station that was in the United States and again, like transnational repression, like I think the concern is that if let's say you were a private citizen and if China were to sort of increase its repression apparatus, I don't think it's so far-fetched. They already do this to a lot of Chinese dissidents who are living overseas. I've heard even some cases anecdotally of them doing this to non-Chinese people who are speaking out against the CCP. Right. But like, to what degree will they use your personal information to harass you? Would they even use your personal information to dox you in the future? Right. I wouldn't be surprised about that. We've seen nation states engaged in doxxing type activity as a form of information operations. Right. I wrote a report with a colleague of mine named Ari Ben-Am about an Iranian operation that was targeting Israeli Air Force personnel, and they essentially doxxed them. Right. Or they like— they were actually not really doxxing them. They were kind of more just like taking public information and treating it as if it was doxxing. But yeah, you see like hacktivist groups engaged in doxxing campaigns often and things like that.

So that's one thing. But I think Just to answer your question, John, like, why should people care more than just the sort of data privacy issue or the espionage issue? Because like, yeah, your average person isn't necessarily going to care about that per se, or they might not think that they're going to be a target of that. But I think the broader conversation, when we think especially about influence operations, which is really like one of my main areas of focus, it's just a question of like cognitive sovereignty, right? Like if you frame it not— it's like, I'm not trying to tell you to you should vote Democrat or vote Republican, or that you should be pro-China even, or anti-China, right? Like, that's not what I'm trying to tell you, because people will have different opinions about all of those things. I myself have my own strong opinions, right? But it's like, I'm not even— this— that's not even the conversation. Just in a question of cognitive sovereignty, like, do you understand who is shaping the way you think, feel, and behave? Right. And I'm not saying that there's some pure, like, you know, uncontaminated space where one can like where those things can be shaped just like in, you know, you go to Yale and those things are being shaped by different people and different people with different agendas.

Right. Not just the CCP, but, you know, like we at FDD, you know, my think tank has written, you know, really heavily about Qatari money and Qatari money in higher education and how they're trying to shape people's views. Right. But I think— It's very hard, right? Like, my entire job is essentially— a huge part of my job is trying to break the operational security of COVID campaigns, right? And there are different ways that I can do that, right? Sometimes if I get lucky, there's a clear indicator that something's based out of China, even though they're posing as an American. Sometimes there's just sort of indicators of coordinated behavior and indicators of inauthenticity, right? Like, oh, this isn't saying what it says it is. and it's also coordinated. And then I can sort of make, make a sort of low-confidence assessment that it might be aligned with the objectives of the CCP or Iran or whatever based off of the narratives. Right. Like sometimes it can be, it can be pretty clear when you just look at the narratives that it's advancing CCP interests. But there's so much that we will never catch. Right. And that's the thing.

Right. And that's like Dee brought this up and that's a great point. Like, Are those cat videos with Russian subtitles a Russian op, or is it something more innocent? Like, I don't know. Right. And I don't know if we will ever know. And like, hopefully, you know, one day the US government will take this issue more seriously and, you know, doing it in a way that protects free speech and protects, you know, the privacy of, of, you know, of American citizens and stuff. Hopefully they'll look into those cat videos, you know, and they'll look into all these other things and actually try and get a holistic picture about what's going on. But there's so much that we will never know. And I think that's just why, like, again, people should be aware that this type of stuff is happening. Like, you know, Dee, obviously you are dramatically more informed than the average citizen, so your spidey senses go up when you see something like that. Like, I study this issue for a living. So like when I created the Instagram to follow my friend's music and I started seeing, you know, all these like, you know, folk artists like on the streets in China, I was like, Okay, this is something that's maybe not so innocent, but I think people just need to be aware of it to begin with.

Like, that is already going to cause people to have, again, their spidey senses up and maybe be a little bit less susceptible to that. Those types of like really like very covert and hard to catch campaigns, which I and other researchers will likely never catch.

Yeah. Talking specifically to the Instagram stuff, it's weird. I don't know if it's maybe algorithm hacking or whatever. But like a lot of the, a lot of viral videos of anything really, their captions are completely different to what the actual video is about. A lot of times also it's in a different language, sometimes Chinese. It's interesting to see, you know, I guess people don't really pay super a ton of attention to the captions at the bottom of the videos. Because like, if you're just scrolling through reels, like you're not going to stop and look at the caption really. And if you do notice it, like there's a lot of captions that are almost exactly the same. And a lot of the times have nothing to do with what the video is about. And a lot of the times also, it's like, you can kind of tell it's like spit out like AI, like an AI summary of something. It's, it's interesting. My guess is that's likely More just like people trying to hack the algorithm, I think. But it could— I wouldn't be surprised if it was some Chinese operation or Russian operation just trying to be like, no, see, we're great people, you know, like, you know, it's okay that we're bulldozing Ukraine.

I wanted to ask you a question about the Dixon, you know, operation, right? That was back in 2015, right? So 10 years, 10 years earlier. That seemed to be a lot more like, I guess, what's the best word to say, like targeted. These are obviously the new, the new version of stuff is obviously pretty targeted as well. But like, I think the big difference is like scale, right? Because you're talking like this is being proliferated pretty quickly. And is it like the only difference in this is just like the, you know, AI becoming a thing and like making it a lot easier to like make fake websites, make fake posts, make fake companies and like get it out there as much as possible, blanket it? And see what we can reel in?

Yeah, I mean, D, that's a great question. And yeah, AI definitely plays a part. I think recently, the most recent websites that I published on, I saw that they were created with Lovable. Are you guys familiar with Lovable or no? It's like an AI website generating platform, right? So it like uses AI to help you create a website very quickly. And I've seen AI tools used for web development in other similar websites in the past. It might not be as obvious as Lovable, but there'll be little signatures in HTML and stuff, or the backend of the website that shows that it was likely created using AI. I think it's hard to say. I've been focusing on this issue for several years, as I mentioned. Moreover, I'm an open-source researcher, so everything I do is in the open source. Do I have the most holistic picture about every single website that's ever existed? And that's a Chinese targeting website. And, and can I like sort of create that map to show the scale increasing? No, not necessarily. But what I can say is like the scale now is like huge. I'm talking like at least hundreds of websites, if not more, if not thousands, quite frankly.

I've myself uncovered hundreds of websites, right? And there's, there's probably more. And what I would say is this, like, you know, just to sort of bring this back to, like, you know, what John said earlier, like, why does this matter? So there's a couple of things I would say here. First of all, like, you know, the FBI recently seized 13 internet domains that were associated with suspected Chinese espionage operations. And, you know, like, I think this is good, right? Like, I think when, when the US government identifies these or, you know, comes to its own determination that this is likely a suspected espionage operation, they should totally do that. But the thing is, is like 13 domains is like a drop in the bucket, right? Like, I mean, really, like, it's not putting a kibosh on this type of activity. And it's the exact site. It's like the exact— sorry, John, did you want to say something about that really quickly or no? It's like the exact same issue that we see with like influence operations, right? It's like, and even in cyber and, you know, more conventional cyber attacks as well, right? You take down malicious infrastructure.

Well, I mean, malicious actors are just going to recreate that infrastructure, right? So I think it's like this. It's a broader problem where it's just like, you know, the scale, like you said, I believe is likely increasing because of AI and because you must assume, I don't know, but you must assume that the reason they're doing this, this is another important point, is that it's working, right? Like, why would they be doing this so much if it wasn't working? And you can see, like, if you look at different, you know, sentencings and arrests and things like that in cases, cases involving this specific TTP, you can see people who've been arrested over the past few years who were, they targeted via a fake consulting company or via LinkedIn or via, like you mentioned at the beginning, the gig working platform, right? Like Upwork or whatever, right? Or even like weirder niche ones that I've seen. So like it's, it's, it appears to be working and like, look, just seizing 13 domains isn't going to make a huge difference. But to be honest with you, even if they were to like take down every single domain tomorrow, What's going to stop these services from creating new ones?

And I've become more tight-lipped over time about how I identify these because I don't necessarily like in the beginning, it's sort of hard, right? Because I do public research. I don't have the authority of the US government when I say this is what I think it is and I have to prove my work. Right. Which is why I will show things like, oh, this is how I identified it. This is why I think it is what it is. But I've, you know, I've become a little bit more tight-lipped now because also when you find them and even look, even if I weren't to say how I discovered it, they can still do their own assessment. Oh, this got taken down. Where were our operational security lapses? Right. So it's just like there's just going to be more and more created. This is just the reality of the internet, right? Like it is an open environment. People can create things. People can create websites, right? Like You don't necessarily need to show somebody your Social Security number to create a website, right? Different providers have different know-your-customer practices. And that's also interestingly why you sometimes see them going back to the same hosting companies because they have sort of broken their know-your-customer or their know-your-customer might be more relaxed.

It's sort of a long conversation which I can go on, but like, look, you're not going to stop them from creating these websites. LinkedIn can really crack down, but it's not only LinkedIn, it's also Craigslist. It's also Upwork. Like, What are we going to like? Are all of these platforms going to crack down? I mean, maybe, maybe not. Right. And there's only so much that they can always do, too. Right. Like, you can also use stolen identities, like some of the domains that were seized by the FBI. They were registered using stolen identities. Right. And obviously, we know there's a huge black market for, you know, identity theft and things like that. So that's why I really think it's like the same thing with, you know, like when we think about influence operations, It's a very similar thing with these sort of virtual espionage operations, like raising awareness. Like, that is like the, the first line of defense, right? Like, that is, and that is maybe the most that you, one of the most powerful things you can do because they're gonna keep recreating the infrastructure. The infrastructure is gonna get harder to detect over time.

You know, I'm gonna keep building my skills. I'm gonna keep looking at it. I know there's other researchers who are looking at this who are even more skilled than I am, right? Like, we're all gonna keep looking at this, but they're going to keep refining their tactics and getting harder. I think that's why, like, this podcast is really important and, like, conversations like this are really important so that people know, you know, because not every— I know, like, you know, clearance holders get counterintelligence training and things like that, but not everybody might know about this specific tactic. And, like, honestly, like, you don't have to— you don't, you don't need to be a malicious person to be susceptible to this, right? I do think there are general genuine, like, unwitting victims who, like, why? Yeah, like, say you're a former State Department person. Let's say you were unexpectedly laid off by Doge or whatever, right? And like, yeah, like, maybe you're in a, like, a seriously, genuinely hard time. And if you get this benign request for somebody to tell you about, hey, can you, like, tell us about the geopolitical implications of, you know, the, like, you know, Russia-Ukraine conflict and whatever, why not?

Right.

So it's just like, I under— I think that, like, you really just have to raise awareness here because, like you said, the scale is just going to keep increasing. And I think also it's shocking sometimes, like, how poor quality these operations are, right? Where people will be like, how— well, how is an intelligence service doing this? Because it's so sloppy. Like, John, I don't know if you know, and I don't know how much you can speak about, but it's like sometimes, like, I heard somebody say recently, like, like PRC operations, whether they be influence or espionage, can be remarkably sloppy. which is also why they're really fun to study and investigate. But it's like, they're going to get better eventually, probably, and they're going to just keep happening. And there's no, I think, real way to stop the flood and stop the deluge. So people's awareness is really their first line of defense.

Yeah, actually, that casting a wide net has been an MSS strategy for a very long time where We see a lot of the sloppier stuff, but there's a lot of not sloppy stuff that we don't see. And it's almost an intentional sloppiness because we get distracted by the easy cases, and that takes resources away from the harder cases. So there are these more complex, deep, long-term ops going on that we just might never know about because it was so difficult to notice any indicator in the first place, even if we were not paying attention to the simpler, lower-hanging fruit. But because there's so much low-hanging fruit, you can't ignore it. I mean, especially if you're in a law enforcement capacity like Department of Homeland Security or FBI counterintelligence, you have to stop what you see. You know, if there is an illicit activity going on, you're either going to exploit it or neutralize it. Those are your 2 options. Ignoring it is not an option. So you have to throw resources against a smaller thing like the, the handing off of a USB thumb drive in a parking lot, which is the old way, or the newer way, which is talking to somebody on LinkedIn and sending them a research paper that you wrote.

About a weapon system that's completely open source and it's okay, but it's not okay. The FBI has to pay attention to that too. And now you've only got so many counterintelligence officers that are running around and they cannot focus on this bigger thing. They won't even notice the subtle tiny indicators that are kind of sparkling around in the ether on that deeper issue.

Yeah, John, that's like a fascinating point. And it's hard for me to say whether or not this is intentional or not. sometimes one might think, right? But there is a case— I know we keep switching back between like espionage and influence operations, and those are distinct things. I know they're sometimes overlapping in the tactics, which is like what we're describing, which is fascinating, especially like, you know, in the, in the online space. But to go back to the influence operations space, there's something known as Operation Overload, which is a very well-researched, you know, operation. You can read a lot about it. It's a Russian operation, and they The whole point of this is to intentionally overload the capacity of fact-checkers and influence operations researchers, which is also funny because there's not a lot of us, right? It's a small niche community. There's some private sector organizations that do this, but the sort of private and nonprofit sector of people who do this type of research is not huge, right? And there was this operation they would send, they would like create bogus stuff and then they would send it to researchers to say like, oh, like, can you look into this?

Can you look into this? Like, and journalists too, right? Because journalists do their own investigative work and they do their own debunking and they do their own, you know, they expose operations too. So like, yeah, like definitely I could, I could imagine that there could be a similar dynamic at play, John. Hopefully we're not giving anybody a bad idea here. But like, you know, where like they're looking to overwhelm the capacity of not just like nonprofit researchers who are looking at influence operations, but even just like a country's own like counterintelligence, you know, capabilities. And I think the other thing is it's like, okay, like I don't think like a country that is invested in its own reputation and not being seen as an espionage threat would do this, right? Like, but I think the thing with China is it's like they just— I don't really think they care. Or maybe they do care. Like, they're certainly on some level, like, they're very sensitive about reputational stuff. That's why they, like, you know, go after, like, Falun Gong and why they, like, go after all these dissidents. And it's like they're extremely, like, sensitive about their reputation.

So I guess maybe I wouldn't say that that isn't a fair characterization to say that they don't care. Like, when I've shared information with journalists, sometimes they get responses from the embassy and they, like, They sound pissed. I mean, I don't know if that— they just feel like they have to do that. But the thing is, is that it seems like— I don't know why, but they just don't have the same risk calculus that we do.

Right.

They aren't— Russia certainly doesn't care. Russia doesn't care if its influence operation gets exposed. They've actually deliberately done— it's sometimes called perception hacking, where they will deliberately try and make it seem like they corrupted an election through influence operations because they want people to fight each other. Right. And they want, you know, like, I remember there was like, I think it was like a midterm election, like after 2016. And that got a lot of, you know, the troll farms and everything got a lot of attention. And then I think the Internet Research Agency, which is like the famous troll farm that was created by Putin's chef, Prigozhin, I believe, if I remember correctly, they created a website specifically like saying like, oh yeah, we're the IRA and we like, we compromised your election and like, it's all bullshit. And like, you know, like your guys' election is invalid, right? So like, you know, Russia doesn't have the same risk calculus. Obviously Iran doesn't. I mean, and I say oftentimes I feel like they don't really have much to lose at this point. Like they don't even need to be covert. Like, you know, you look at the Lego videos, like nobody was questioning that that was coming from Iran.

But, you know, if they said things that they felt like Americans would be sympathetic sympathetic towards. They thought that it would make them sympathetic towards the regime. But with China, and specifically, again, my sort of area of expertise, which is, again, admittedly somewhat more narrow, which is like these virtual targeting operations, like, I have literally exposed— like, the second report I wrote on this, I exposed a website, I exposed a domain, right? This somebody who was claiming to be associated with the same website, the same company, Reached out to, like, I think of either a current or former State Department official. Like, they don't— the infrastructure, they're going to keep using the same infrastructure, the same front companies, even after it's exposed. So I just don't know, again, like, what actually is the calculus, their risk calculus? Do they actually care? How much do they care? And are they sort of flooding the zone intentionally to try and distract counterintelligence officials or distract researchers, nonprofit researchers, different, you know, whatever. Who knows? It's just speculation. But I really wouldn't be surprised if that was part of the whole strategy here.

And actually, so we talked about Iran and Russia, but we haven't mentioned North Korea. And I'm curious, in your work, have you seen any kind of like joint work or at least like adjacent work with North Korea and China? Because North Korea has been in the news recently, if people are reading the right news, about, um, using these North Korea-based workers that are remote workers that are working and then generating income and then bringing that money to North Korea, which is kind of an interesting use of America's capitalist system that they're very much against.

Yeah, I mean, I, I haven't seen any, um, sort of collaboration or evidence of things like that. I'm not saying that's not happening, it's just not anything I've come across. One of the most interesting things I saw, to your point, John, And this brings up another point, which I'll get to in a moment, about something Dean mentioned earlier. But I remember, like, at the beginning of, you know, the, the current, you know, the ongoing war with Iran, I would— at the time, I don't— people don't use this term as much, but when they called it Operation— what was it— Epic Fury. And right at the beginning of that, I found these accounts that were posing as Chinese. Like, it was sort of weird. It was sort of ambiguous. Like, there were Twitter accounts that were posing as, like, Chinese accounts, like official accounts or like Chinese newspapers, Russian accounts, and North Korean accounts. And they were saying, like, if you keep bombing Iran, we're going to nuke you. Right? Like, again, like, I was like, okay, is this like some— like, and it's— this is your point, Dee, is it's like there's always this ambiguity.

Right. And especially when I, you know, again, I'm an open source researcher about like, well, who actually is doing this? And this one, like we saw that they were based in Western Asia, but like, that's very vast. That could mean the accounts were based out of Turkey or that they were based out of Yemen or that they were based out of like, you know, Iran. Right. Like in Facebook's transparency features, people can switch. So instead of showing the specific country, it shows the region, right? That's not a secret. That's something that's well known, right? And so if you're a savvy actor, well, if you're a really savvy actor, right? And this is obvious things, so I don't feel like I'm making, you know, making people's lives harder here, but it's like you just use a VPN, right? But like, if you're not that savvy, you might just use, you know, this thing to mask your true location. So we knew it was coming out of Western Asia. We don't fully know where in Western Asia it was coming from. But the question, like you said, Dee, like, Was this a commercial actor? Was this just somebody trying to make a buck?

Right. Was this just somebody like trying to get the clicks or was this a, a nation state? Right. Was this Iran? And was this somebody in Iran like working for the IRGC or was this just a concerned Iranian citizen who was, you know, trying to support the cause? Like, it's not always clear. And also, I don't always think it matters. Right. Like, it doesn't really always fully matter. Like, if it's— if you're seeing some sort of malicious or deceptive activity, it doesn't really matter if it's somebody working in like their equivalent of a SCIF, like, you know, like whatever. Does it matter if it's just like an aligned cyber actor who's politically aligned? Does it matter if it's a, you know, a commercial actor who's just trying to make money? Or maybe it's a commercial actor who's politically aligned or a commercial person who's being contracted, right, by a foreign— like, obviously, in terms of enforcement and in terms of, like, you know, sanctions or, like, legal proceedings, like, that can matter. I'm not saying that doesn't matter. But in terms of, like, the effect that it's having in the information environment, the effect that it's having on people's understanding, I don't think that it always necessarily matters, like, who's doing it.

If it's deceptive, right, if it's advancing the interests of an adversarial country, I think that is enough grounds to warrant attention, which is why even though I didn't have clear attribution as to who was doing this, I still published on it because it was deceptive activity and it was fascinating activity. But to go back to your original question, John, that was an interesting place where I saw somebody posing as North Korea and posing as China to sort of— it's this somewhat crude attempt to have deterrence, like cognitive deterrence. maybe to like scare Americans, you know, to think like, oh dang, like, you know, are we going to get nuked because of this war? Do you know what I'm saying? Yeah.

Yeah. It's incredible. I mean, it's incredible to see how this is going to continue to like evolve. Max, where can people find you?

Yeah.

If you want to be found.

So yeah, I, I mean, I have a public profile on FDD. My LinkedIn is not public. I should create a Twitter eventually. I might eventually. But again, I'm just like, I'm kind of— have you guys— did you guys ever see— what was it called? Like The Social Dilemma, I think it was called back in the day. Like, yeah, I just— I pulled out of like social media for personal use a long time ago. But yeah, I mean, you can, you can follow, you can check out my, my FDD profile. But yeah, I mean, I— yeah, that's where I post a lot of my research. My colleague— I publish on my colleague's blog often. You guys should check this out too, if you haven't already. It's called Memetic Warfare Weekly, and he publishes a lot about cyber activity, influence operations, Chinese espionage, things like that. And I publish on there from time to time. So yeah, those are some places where you can read my work.

Cool. Yeah, I'm gonna put some of the links down in the description. You guys can check it out. Check out some of Max's work. Jonathan Hackett, we know you, we love you. All his books and all his links are down in the description as well. Max, before we go, anything you want to leave us with?

I'll say, if, if Harvard is Coca-Cola, then Yale is Pepsi. No, just kidding.

We don't drink those low-class drinks here.

No, I'm just kidding. But yeah, no, I mean, I mean, just like, I mean, look, you guys, your listeners are like, I would assume more informed, right? And they like know what's up. But so for the people who know what's up, like, tell other people what's up. Do you know what I'm saying? Like, I mean, I cannot tell you, like, and it's pretty like remarkable, like, people who I knew from like past lives, right? Like people who I knew from like college, even people who I knew from high school. Like, I've sat across the table from people who say, like, I remember when the war broke out in Ukraine, like, oh, this isn't— this isn't Putin's war. This is Biden's war. Like, people I know, like, and these aren't people who are dumb. These aren't people who are like, you know, it's a much broader conversation as to like, why are people susceptible to foreign propaganda and things like that? And it's like, it's very complex, right? Like, it might be somebody's identity. Right. They might like be anti-American for various reasons, or they might not even be anti-American, but they just want a sort of hot take or like a sort of differentiated view, or they want to feel like they're like they're a seeker, you know, which is funny if you see like, you know, RT, which is like Russia's flagship state media thing, they'll like say like, oh, like we're here for the seekers or something like that, right?

Like they'll sort of appeal to people like, oh, are you a free thinker? Then like, then listen, then like, this is all NATO's fault, right? But like, just because, you know, I know your listeners know what's up, but it's like, you know, and it's hard because it's like hard to have this conversation, right? Like, you know, somebody you don't want to be like, you know, John, like, oh, like me, like, you know, Yale, a Yale man. I'm going to teach you how to think, right? Like, I mean, that's obviously like a really not, not probably going to go very far, but like, just sort of like framing it like, oh, hey, have you like seen this research? Have you like, There's a lot of great reporting out there. There's a lot of great research out there, right? Like I mentioned the TikTok report from a few years back. Like there's tons of stuff coming out often, like just sharing it around with people. Like now it's like my family members, like when they see something about foreign influence or what, like they'll share it with me. Like they're aware of the issue now. Obviously for them it's like more personal because it's like what I study, but like just sharing it around with people who, you know, like Again, like the people who know what's up, like your listeners, I think it's sort of incumbent upon us to share it with the people in our circle of trust who maybe aren't as tuned in.

And like, it doesn't mean that they're dumb and it doesn't mean like they're busy working on their lives and they have important things that they need to focus on. They need to feed their families and whatever. But I think it's like incumbent upon all of us to sort of spread the word that, hey, like this is what's happening. Especially in like the influence space and like, again, like, you know, people like John or whatever, like people who are connected to, you know, people who come from the government space. I think they're like, you know, also just sharing information about these tactics. Right. Because it's like, you know, people do try and do the best job they can. Like Five Eyes, the Five Eyes put out an advisory earlier this summer about this tactic. Like, you know, the US government has put out different things like, but I just don't think that people can be reminded enough. Right? Because there could just be that one moment when somebody has a lapse and they don't realize what's happening, or there could be a moment of weakness where they're like, oh, I really need the money. You know, I don't know it's China, blah, blah, blah.

Like, people should just be warned, like, yo, like, this is like a— this is a don't touch this with a 10-foot pole. Do you know what I'm saying? And also, you know, people should have an understanding that, like you said, John, like, there could be serious consequences. even for information that isn't even classified, right? Or controlled unclassified information, which is another thing that people can get in trouble for sharing. But even stuff that's just completely public— or sorry, not completely public, but non-public, but also just something that isn't classified— that could also be a challenge as well. Even just your insight as a former defense or intelligence person, even your just public take on the war in Ukraine, you don't necessarily want that getting into the hands of like a PRC operative, right? So I think it's just, again, the last thing I'd say is, yeah, people who know what's up, try and share it with people who don't know what's up so that we can all build collective resilience here.

Yeah, well said, Max. A pleasure, man. Thanks again. Let's do this again soon.

Okay.

Yeah, thanks, John.

Thanks, D. Cheers.