China's Espionage Challenge in Britain: From Fake Recruiters to Cyber Attacks

A Collapsed Spy Case Exposes Britain's Security Dilemma

The collapse last month of the prosecution of Christopher Cash and Christopher Berry has brought Britain's approach to China into sharp focus. The two men had been accused of spying for China under the Official Secrets Act. The Crown Prosecution Service dropped the charges after concluding that it could not prove, within the legal framework governing the case, that Beijing posed a threat to UK national security.

Cash and Berry walked free after a case that had been presented as a major breakthrough in counterespionage when it was announced in 2024. One of the men had advised MPs on China policy. Prosecutors reviewed classified evidence before deciding that they could not meet the statutory requirements needed to continue.

Lord Hermer, the attorney general, blamed outdated legislation for the collapse. Opposition politicians accused Prime Minister Keir Starmer of putting diplomatic relations with Beijing ahead of national security. The government denies that accusation.

The dispute reaches beyond the fate of two defendants. Britain faces intelligence activity that includes attempts to recruit people working around Parliament, theft of commercial knowledge, cyber attacks, collection of personal data and pressure on Chinese communities abroad. Each activity presents a different problem for investigators and policymakers.

The Official Secrets Act belonged to a world commonly associated with secret document exchanges, dead drops and microfilm. A dead drop is a place where information can be left for another person to collect without the two meeting. Today's threats also involve artificial intelligence, vast collections of data and attempts to influence political decisions. Britain must decide where legitimate contact with China ends and activity threatening national security begins.

Why the Embassy Is Only Part of the Picture

Sir Ken McCallum, the head of MI5, has warned against understanding Chinese intelligence solely through the familiar image of an intelligence officer working from an embassy. He described the limits of that picture in these words:

Try not to think too much just in terms of classic card-carrying spies based out of the embassy in the John le Carré mould.

China maintains traditional intelligence officers under diplomatic cover, meaning they operate while holding diplomatic positions. Its intelligence services are estimated to employ half a million personnel when domestic and international security operations are counted together. That scale allows Beijing to pursue information across a broad range of institutions and countries.

China's approach also connects intelligence gathering with economic strategy, political influence and the suppression of dissent beyond its borders. Government secrets are one target among many. Commercial processes, research findings, political contacts and information about individuals can also serve state objectives.

A deputy national security adviser described the breadth of that interest in a witness statement in the Cash and Berry case:

The Chinese Intelligence Services are interested in acquiring information from a number of sources, including policymakers, government staff and democratic institutions and are able to act opportunistically to gather all information they can.

Parliamentary offices, universities and businesses therefore face different versions of the same challenge: information that appears routine to its holder may be valuable to an intelligence service when combined with other material.

Fake Recruiters and the Gradual Search for Secrets

MI5 issued a rare visual guide to MPs in November 2025 warning about recruitment methods used by China's Ministry of State Security (MSS). The alert identified fake LinkedIn profiles posing as recruitment headhunters, including personas named Amanda Qiu and Shirly Shen.

Parliamentary staff, economists, think tank employees and geopolitical consultants were among the targets. The approaches offered substantial financial incentives for information that initially appeared to be of limited sensitivity. Targets could be asked to work as freelance consultants producing reports about international affairs.

The requests could then develop into demands for confidential information or insights gained through privileged access. The progression matters: a professional conversation and a paid research assignment can establish a relationship before the recruiter asks for something more sensitive.

Dan Jarvis, the security minister, told the House of Commons that the activity represented a "covert and calculated" effort to interfere in the UK's sovereign interests. Those interests include Britain's ability to make political decisions without concealed intervention by another state.

UK academics face similar approaches. MI5 has documented a steady stream of attempts to attract academic experts through professional networking sites, with the aim of obtaining technology that has both civilian and military uses. Such technology can support ordinary commercial work while also contributing to military capabilities.

Andrew Badger, a former US intelligence official and co-author of The Great Heist: China's Epic Campaign to Steal America's Secrets, described the economic stakes:

when core intellectual property and process knowledge leak, entire industries can be upended.

Intellectual property includes valuable inventions and technical knowledge. Process knowledge is the practical understanding of how to make something work or manufacture it successfully. Losing either can affect a company's position and the wider industry around it.

Cyber Operations Reach Communications and Infrastructure

The UK confirmed in August 2025 that it had been affected by Salt Typhoon, a sophisticated cyber campaign compromising telecommunications companies around the world. Communications networks offer intelligence services access to information about who people contact and where they move.

The National Cyber Security Centre (NCSC), part of GCHQ, explained the potential use of the stolen information:

the data stolen through this activity can ultimately provide the Chinese intelligence services the capability to identify and track targets' communications and movements worldwide.

Salt Typhoon sits within a wider group of cyber operations backed by the Chinese state. Auburn University's McCrary Institute has identified several groups using Typhoon names, with different targets and purposes.

Volt Typhoon infiltrates critical infrastructure to prepare for possible disruption, rather than concentrating only on gathering intelligence. Critical infrastructure means the systems on which everyday life depends. Flax Typhoon targets Internet of Things devices for data collection. These are devices connected to networks, rather than only conventional computers.

The groups exploit zero-day vulnerabilities and use living-off-the-land techniques. A zero-day vulnerability is a software weakness for which a fix is not yet available when it is exploited. Living-off-the-land methods use tools already present in a computer system, making hostile activity harder to distinguish from ordinary operations.

The different purposes require different defensive responses. Protecting confidential communications addresses information theft. Securing infrastructure must also address the possibility that an intruder is preparing to interrupt services later.

Why Large Collections of Personal Data Matter

Western security officials are also concerned about Beijing's pursuit of bulk data: large collections of financial, personal and health information. The value comes partly from scale, because many records can be examined together to reveal connections and patterns.

Ciaran Martin, the former head of the NCSC, described China's interest in information about the British population:

China has been trying to collect population level data on British people. That may be useful to train artificial intelligence or to better understand the country or even influence opinion.

Artificial intelligence systems can use large datasets to learn patterns. Information gathered across a population can also help an intelligence service understand a country and identify people or groups it wishes to influence.

The breach of the UK Electoral Commission discussed in 2024 illustrated the concern about access at scale. Chinese state affiliated group APT31 was identified in connection with the cyber activity. Parliamentarians described in official assessments as "prominent in calling out the malign activity of China" were also targets.

Anne Keast-Butler, the director of GCHQ, has described the resources her agency assigns to China:

we now devote more resource to China than any other single mission,

Keast-Butler also set out GCHQ's assessment of the danger:

China poses a genuine and increasing cyber risk to the UK.

Her statements connect the scale of the intelligence response with the growing threat to British systems. The concern spans individual targets, public institutions and networks whose information can be collected in large quantities.

Pressure on People Who Have Sought Safety in Britain

Chinese intelligence activity also focuses on the Chinese diaspora and people opposing the Communist Party. Transnational repression means attempts to intimidate or control people outside the country whose authorities are pursuing them.

MI5 has warned that Hong Kong police have issued bounties against more than a dozen activists supporting democracy who are sheltering in the UK. Reports of harassment and surveillance against Tibetan campaigners and other minority groups have also increased.

The purpose connects to the Communist Party's priority of maintaining domestic stability. People living abroad can remain targets because of their campaigning, political views or connections with communities in China.

Some of this activity has been described as decentralised and amateurish. Provincial police departments can send small teams abroad with limited experience, rather than every operation being directed through a single, tightly controlled international network.

Members of diaspora communities may be recruited to trade information for favours back home. Such arrangements give local contacts a role in gathering intelligence. For the people being watched or harassed, a loosely organised operation can still create serious pressure and fear.

Trade, Technology and the Risk of Dependence

Britain's economic relationship with China creates another set of security decisions. China is the world's second largest economy and offers opportunities for trade, investment and growth. Access to its technology and supply chains can also create dependence.

The debate over Huawei's involvement in UK 5G infrastructure illustrated that tension. Chinese equipment was often cheaper and technologically superior, while reliance on it created concerns about coercion. If Beijing can cut off technology that daily life depends on, it gains power over British foreign policy choices.

Critical minerals, supply chains for electric vehicles and nuclear energy infrastructure raise similar concerns. The question is how to retain the benefits of economic engagement while protecting services, industries and political decisions from external pressure.

The National Security and Investment Act 2021 provides powers to block foreign acquisitions on national security grounds. The Procurement Act 2023 provides powers to exclude suppliers for security reasons. Applying those powers can be politically sensitive because decisions affect commercial relationships as well as security.

The proposed Chinese embassy at London's former Royal Mint site has become a focal point for this debate. Critics fear that the location could allow access to underground data cables. Some security officials downplay that concern because China already has demonstrated capabilities to gain access remotely through cyber operations.

As of February 7, 2026, the decision on whether to approve the embassy remained pending. The proposal has become a test of how the government weighs diplomatic needs against concerns about intelligence activity.

New Laws and a Disputed Registration System

The National Security Act 2023 created new espionage offences and established the Foreign Interference Registration Scheme (FIRS). The scheme requires people acting at the direction of foreign powers to register political influence activities.

Registration is intended to make the foreign direction behind those activities visible. It addresses a different part of the problem from laws governing the theft of secrets: who is acting for another state when seeking to influence political life.

Russia and Iran have been placed on the scheme's enhanced tier, while China remains on the standard tier. That choice has attracted criticism from MPs, including former Conservative leader Sir Iain Duncan Smith.

The dispute over China's position in FIRS sits alongside the Cash and Berry case. Britain has introduced new security legislation while continuing to confront the limits of the legal framework used in that prosecution.

The main developments span several years:

• 2021: The National Security and Investment Act introduced powers to intervene in foreign acquisitions on security grounds.
• 2023: The National Security Act created new espionage offences and FIRS. The Procurement Act provided powers to exclude suppliers on security grounds.
• 2024: The prosecution of Cash and Berry was announced, and Chinese cyber activity involving the Electoral Commission and parliamentarians became a major security concern.
• August 2025: The UK confirmed that it had been affected by Salt Typhoon.
• November 2025: MI5 warned MPs about fake recruitment profiles associated with the MSS.
• Early 2026: Starmer's team used temporary communications equipment during his China visit, while the collapsed prosecution continued to generate political controversy.

Security Precautions Follow Ministers to China

Starmer's team used burner phones, fresh SIM cards and temporary email addresses during his visit to China in early 2026. The precautions were intended to prevent spyware from being installed on devices carrying sensitive information.

Burner phones are temporary devices used for a limited purpose. Together with new communications accounts and SIM cards, they reduce the exposure of the equipment and accounts normally used by officials.

Security officials say such precautions have been standard for at least a decade. Sensitive conversations in Beijing must be confined to the secure compartment within the British embassy.

Former prime minister Theresa May was advised during a visit in 2018 to dress under her duvet to avoid concealed cameras. That advice illustrates how security concerns extend beyond documents and digital networks to the privacy of officials travelling abroad.

Engagement and Security Must Be Managed Together

Britain cannot simply sever its relationship with China given the importance of trade, investment and research cooperation. Collaboration includes areas ranging from climate technology to artificial intelligence. Those same connections can create opportunities for intelligence gathering and concealed influence.

The United States' increasingly aggressive stance towards Beijing adds pressure on London to align its policies with Washington. British ministers must weigh access to Chinese markets and technology alongside relations with allies and protection of domestic security.

McCallum has described the breadth of the response needed to address China:

whole-of-system challenge that needs a profound whole-of-system response.

His description points to responsibilities extending across government, Parliament, universities, businesses and security agencies. The threats described in recruitment warnings, cyber assessments and reports of intimidation reach institutions with very different day to day work.

The government's promised China audit remained unreleased, leaving a gap in public documentation of its red lines. Institutions need to understand which relationships and activities carry security risks while continuing legitimate international engagement.

MI5's head has reported a 35% increase in investigations into state threat activity over the past year. That increase adds urgency to decisions about laws, institutional protection and how Britain conducts its relationship with Beijing.

Key Points

• The Crown Prosecution Service dropped the charges against Christopher Cash and Christopher Berry after concluding it could not meet the legal requirements concerning China's threat to UK national security.
• MI5 warned MPs in November 2025 about fake LinkedIn recruiters, including personas named Amanda Qiu and Shirly Shen, targeting people with access to political and research information.
• Salt Typhoon compromised telecommunications networks, while other cyber operations target infrastructure and connected devices.
• British security concerns include bulk personal data collection, commercial knowledge theft and pressure on activists living in the UK.
• China remains on the standard tier of FIRS, while Russia and Iran are on the enhanced tier.
• As of February 7, 2026, the Royal Mint embassy decision was pending and the government's promised China audit remained unreleased.
• Britain faces continuing choices about how to protect national security while maintaining trade, diplomacy and research cooperation with China.