There's one aspect of China's cyber efforts that's always stuck with me: the lack of a national technical intelligence agency. Current developments as I type this are set to test this arrangement.
The US, Britain, the Netherlands, France, Spain, Russia, Israel, and other countries have long ago made the decision to have dedicated technical intelligence agencies. In most cases, those agencies conduct cyber operations and other SIGINT.
China doesn't have that. The Cyberspace Administration or CAC is more of an Internet communications (including censorship) body with a cyber defense mission tacked in. China's national police, the Ministry of Public Security, is tasked with public order, of which cyber is but one of many missions. The military does have cyber capabilities but its ranks have been systematically purged, while PLA technical assets have reorganized twice - all inside a decade of the Xi Jinping era.
What's left? Everyone will rightly point to the Ministry of State Security or MSS. This is the agency responsible for the vast majority of Chinese APT-grade network intrusions around the world for the past two decades. However there are numerous qualifications to the notion that MSS = NSA/GCHQ/CNI/8200.
First, the MSS operations I know from both public and private reporting are traceable to provincial bureaus, and to the contract work those bureaus farm out, rather than a national command. We know due to leaks that this contracting ecosystem is poorly organized. Provincial cyber efforts are often duplicative and even competitive. Second, MSS operations vary in sophistication. Some are world-class, but others are not: their malware, vulnerabilities, spear phishing lures, and opsec get routinely exposed and neutralized. The variance itself is a sign of missing standards and coordination across contractors and provinces. Third: MSS has a larger mission than foreign offensive cyber: it acts as secret political police, pushes propaganda, conducts counterintelligence, and more. It is not a purely technical or SIGINT agency.
I bring all of this up in light of WeWorm. Just days ago there was a responsible vulnerability disclosure surrounding Weixin/WeChat, the single most important software in China. Made by Tencent and roughly equivalent to WhatsApp, Weixin is what everyone in China uses to talk to each other, hire various services, read the news, conduct transactions, and more. Using an undisclosed AI, a cybersecurity startup discovered a vulnerability in Weixin's Voice-over-IP (VoIP) code that, when exploited via audio call and combined with additional AI-developed exploits, enabled remote code execution (and therefore "full control of the device"). On top of that the exploit is wormable: it can automatically replicate the attack to the target's contacts.
Here's a little speculation. Both sides agree the US is ahead of China on AI frontier developments. Many on the US side are urging for bold suppressive action against Chinese AI labs to stop them from catching up to OpenAI and Anthropic's capabilities. In fact, this coming September 24, the two governments will meet to discuss bilateral relations, of which AI should be a major component. Whether a purposeful signal or not, the WeWorm incident communicates to China that US AI is capable of staggering damage to Chinese tech. It's a hell of a message to send, and to receive.
I have no idea whether the US will allude to this in the bilateral talks as some kind of negotiating or intimidatory tactic. But it's not even necessary: this emerging situation crystallizes how ahead the US is against Beijing not just in AI but also in deploying cyber assets. If a small company can deliver something of the caliber of WeWorm, one can only imagine what the NSA's arsenal looks like.
Of course China, and particularly the MSS, have successes in cyber to point to. My larger point is that the current provincial-contractor system is unlikely to compete adequately with what the US is fielding. A national security mission is not like industrial development, where it makes sense to multiply startups and investments so long as some of them achieve the objective. I wonder how it will play out. Maybe Beijing will continue to rely on the PLA Cyberforce + MSS and its constellation of contractors. Or maybe they'll come up with something new.