Wang Liqiang: Chinese Defector, Fraud or Both?

 

One of the biggest stories in Asia is the subject of this op-ed by former American senior intelligence official Nick Eftimiades. For an intriguing perspective on this, check out this China Daily “editorial” on Wang. Read on! The Editor.

This month, the People’s Republic of China and its intelligence services again made headlines in the world press for authoritarian and repressive practices. However, this time the activities were not targeted at the Uighur minorities in Xinjiang province nor political dissidents but at legitimate democratic movements in Hong Kong and Taiwan.

Self-proclaimed defector Wang “William” Liqiang emerged in the Australian media claiming he worked for China’s military intelligence apparatus in Hong Kong.

Former CIA counterspy master James Angleton characterized counterintelligence as a ‘Wilderness of Mirrors’.  So when a defector requests asylum in a country, officials and the media wonder whether or not he (or she) is lying. Intelligence Officers, on the other hand, wonder exactly how much the person is lying.

The psychology and motivations of a defector are complex. While defectors to the West often claim to have had a change of heart, and a belief in freedom and democracy, the true motivation to leave one’s family, employment, and country can be quite different.

Motivations for defection range from being caught in corruption or criminal acts to professional rivalries to illicit love affairs. Infighting between rival political factions in Chinese Communist Party politics has driven many officials to defect to safety. Defectors often exaggerate his importance or claim to know more than she really does.

Lastly, defectors sometimes alter their description of events by shielding people they like and exaggerating the actions of former enemies or rivals. Given these behavioral characteristics it is likely that the Australian Security and Intelligence Organization (ASIO) is busy working with allies to confirm or refute the details of Wang’s stories.

There is considerable public discussion about whether Wang’s defection is genuine and his reported history accurate. If he wanted asylum in Australia. Wang would probably only have needed to attend a few Hong Kong pro-democracy demonstrations and then provide pictures along with a story about how the police were looking for him. That simple story would probably have been enough to grant him asylum.

Instead, in his 17 page statement to the Australian authorities, he provided in-depth information identifying media outlets, financial transactions, business firms, and individuals he claims are involved in espionage and covert action against Hong Kong, Taiwan, and Australia.

Questions about Wang
There are several interesting aspects of the Wang case that have yet to be resolved. Wang has spoken publicly about his experiences. Public release of information generally does not occur without good reason. Perhaps the Australian government has doubts about him. Making his story public, true or not, would all but assure Australia would not return him to China or Hong Kong.

China claims and produced video footage seeming to prove that Wang is a criminal and was convicted of fraud in Guangze County, Fujian Province in 2016. Wang describes being in Hong Kong since sometime in 2014. He cannot have been in two places at the same time. And, when Wang applied for an Australian visa in 2018, China told the Australian government that he did not have a criminal record.

The video footage produced by China’s Public Security Bureau could not be located in a Wayback Machine search of Wang’s case on the Internet archive of the China Judgments Online website. Google and Baidu search engines also did not find his case in archive files. This is not necessarily conclusive evidence it does not exist but it could not be located via the normal archival search engine in the court system.

If even just some of Wang’s stories about operations are true then he is a low level defector. He was not an actual intelligence officer, nor did he receive training in clandestine intelligence tradecraft. He knows nothing of the intelligence services’ organizational structure and processes beyond his immediate work environment.

By his own description, he appears to have been some type of office assistant, one of the hundreds of thousands of people worldwide that Beijing’s intelligence apparatus recruits. The US Intelligence Community identifies these people as support agents (or co-optees) depending on the nationality and specific job functions.

Alias Identity Documents
According to Wang, the Information Centre of National Defence University in Hunan Province issued him alias documents on May 14th, 2019. The documents were issued under two alias names. Wang provides no information on source of his digital passport photos for these documents.

Wang was issued a South Korean passport under the alias name Wang Gang. The South Korean passport has a number of security features which make it difficult to reproduce even for the best of criminal organizations. Those features include laminate page cover fluorescent printing, photos, micro-printing, a ghost photo and the Machine Readable Zone with biometric data. The Machine Readable Zone is two 44 character lines with the following information: name, passport number, nationality, date of birth, sex, and passport expiration date.

There are three entries in this passport that raise questions on the quality of the forgery and its intended operational use. Why use the name Wang Gang? Wang is a very common Chinese name but very rare for Koreans. The year 2000 South Korean Census listed only 23,447 individuals with the name of Wang (Hangul: 왕). Picking such an unusual name for a South Korean only draws unwanted attention to the passport bearer. The only logical reason for using this name is that the individual looks Chinese and that an appropriate cover name is necessary. An in-depth cover story and support documentation should have been developed but was not.

Wang does not speak Korean, therefore the issuance of this passport for anything other than ‘flash’ purposes is a poor operational choice. Crossing an international border carrying a passport in a language one does not speak is extremely risky.

The Korean name on the passport in the lower right area is completely different from the English name listed. Obviously, this is a glaring error and it indicates the counterfeiter producing the passport did not read Korean and was unaware the name of the original bearer was printed on the exemplar document. It should be noted that it is quite likely that some number of Korean passports have been forged and issued to Chinese intelligence operatives (or criminals) and that they could contain the same mistake of including the incorrect name in Korean (Hangul).

The issuance of this document shows poor operational tradecraft despite the technical proficiency needed to  reproduce the security features. Once in-country, how is the individual expected to rent rooms, office space, establish bank accounts, wire money, etc. holding a flawed passport in a language that the bearer does not speak? How was the operative expected to buy anything unless they had a credit card with the same name? Yet this was the supposed plan for Wang’s travel and residence in Taiwan.

Criminal organizations normally steal passports and then match the physical characteristics to buyers to cut down on required alterations. That often leaves only the photo to substitute and the person then travels under the assumed name. Alternatively, with sophisticated graphics programs and expensive printing capabilities, the entire bio page with security features can be copied and reproduced with new data.

The forgery of this passport was most likely done by a sophisticated Chinese government or criminal entity despite the poor choice of country, poor operational use plan, and amateurish mistake in naming the holder. If it was done in support of Chinese intelligence operations then it represents poor tradecraft unless it was used only for “flash purposes”. I base this conclusion on the ability of the forger to reproduce the document’s extensive security features (many of which are visible in the single page provided.

Chinese Passport and Hong Kong Identity Card

The Information Centre of National Defence University in Hunan Province also issued Wang a PRC passport and Hong Kong Identity Card in the alias name of Wang Qiang. The Chinese passport already contained a French visa and entry/exit stamps dated May 26, just 12 days AFTER he received these documents. According to Wang he was issued these documents while in Hong Kong. Although the year is not stated he makes reference to the upcoming trip to Taiwan which was to take place on May 16th, 2019.

Who produced the passports?
The PRC alias passport used the same digital photo of Wang as was used in the Korean passport. This fact plus the as yet undisputed statement that both documents contained French entry/exit stamps indicates they were produced by the same issuing organization. They were likely produced and issued at the same time as Wang states, but could have been done at different times if the issuing organization maintained his digital photo on file.

Obviously, the PRC can produce its own passports and Hong Kong identity cards. These documents are often used as cover for operational activities by intelligence agencies. The French visa and entry/exit stamps are also indicative of a professional counterfeiting operation.

Upon arriving in Hong Kong, Wang states he was met by XIANG Xin, CEO of China Innovation Investment Ltd. as well as China Trends Holdings Ltd. Wang claims Xiang leads collection operations and covert action campaigns in Hong Kong for the People’s Liberation Army, General Staff Department. Wang states that after working together for some time Xiang confided in him that his true name was Xiang Nianxin, but he was required to change it when he moved to Hong Kong to begin his intelligence work. This practice of changing names is characteristic of many Chinese intelligence operations. Note that this name change was recently confirmed in the media by Taiwan authorities.

Wang describes Xin Xiang as his boss in Hong Kong and as one of the General Staff Department’s key figures in suppressing pro-democracy activities there. He also identifies Xiang’s wife Gong Qing as an intelligence officer. On November 24th, Xiang and his wife were arrested in Taiwan on national security charges while trying to depart the country from Taipei’s Taoyuan International Airport.

Wang described his role at China Innovation Investment Ltd. as follows:

• Infiltrate Hong Kong Universities to gauge and alter student opinions.
• Suppress democracy advocates in Hong Kong
• Collect military information, purchase and steal weapons technology
• Infiltrate Taiwan and manipulate elections.
• Support rendition activities against dissidents in Hong Kong at the direction of the CCP leadership. According to Wang, this was only done in the case of the Causeway Bay book sellers, a very widely reported event.
• Embezzle public funds through corporate espionage

Wang detailed his work in Hong Kong and Taiwan in each of the above mentioned categories. He identifies (in some detail) the following organizations, select personnel, and their activities.

There are several problems with Wang’s many stories on his activities in Hong Kong and related to Taiwan. The information is actually easy for the Australian government to verify as it relates to travel, residency, and employment. Each of these functions leave a trail of documentary evidence and are verifiable aspects of someone’s life in a city like Hong Kong.

Conclusion

With the amount of data Wang has provided, at least some aspects of his story could be verified. It seems unlikely he made up a story including dozens of names and organizations with dates, individual names, their corporate positions, and locations of events. This is especially true when it would have been easier just to request asylum as a member of Hong Kong’s democracy movement. In any case, with his story public he will not be returning to China.

If some of the information provided by Wang is verified — which appears to be the case — then he is little more than a low level company employee who acted as a co-optee of China’s intelligence establishment. Such relationships and operational activities are quite common in Chinese intelligence operations.

It is common practice for defectors to inflate their level of access or knowledge to make themselves appear more valuable to a country. If Wang asserted himself as a higher level operative it is probably because of his lack of knowledge of intelligence operations.  Excitement and feelings of importance are often factors used to recruit persons whose lives and jobs otherwise seem mundane.

Such inflated beliefs of importance are common among recruited agents and co-optees who find themselves engaged in the great game between nations.

Nick Eftimiades, a former senior intelligence officer, is a lecturer at Penn State Harrisburg‘s School of Public Affairs. The views expressed here are those of the author and do not reflect the views of the university. Nick authored what is considered perhaps the definitive book on modern Chinese espionage, all done using open sources.