CHINA AND CUBA
AND INFORMATION WARFARE (IW):

SIGNALS INTELLIGENCE (SIGINT),
ELECTRONIC WARFARE (EW)
AND CYBER-WARFARE

By Manuel Cereijo *
La Nueva Cuba
October 9, 2006

China is actively and extensively engaged in the whole realm of signals intelligence (SIGINT), electronic warfare (EW) and cyber-warfare activities.  It ranks as the leader in Asia, at least according to some more quantitative measurements, in some important information warfare (IW) areas.  China maintains by far the most extensive SIGINT capabilities of all the countries in Asia.  It has more SIGINT ground stations.  Most of these were obtained from the Soviet Union in the 1950s, such as the large Krug circularly disposed antenna array (CDAA) and the Moon systems used for strategic SIGINT and HF DF operations, although many of them have been considerably up-graded in the subsequent decades.  China probably now has more facilities for intercepting foreign satellite communications than any other country in Asia.  It has the most SIGINT collection ships, and rivals Japan for the largest number of SIGINT aircraft.  It has more tactical/battlefield ELINT/EW systems than any other country, reflecting the magnitude of its conventional forces.  Again, these are mostly based on systems supplied by the Soviet Union in the 1950s, such as the Watch Dog Electronic Support Measures (ESM) system installed aboard many Chinese Navy ships and submarines, the Stop Light ESM system used on the Whiskey-class submarines, the HF DF loops on numerous ships and submarines, and the Sirena radar warning receivers installed on the Air Force's MiG-19, F-4 and F-6 fighters.[1]

During the 1980s, the People's Liberation Army (PLA), including its Navy (PLAN) and Air Force (PLAAF) branches, began to deploy a wide range of new SIGINT and EW systems of indigenous design (although derived from the Soviet systems).  The defence modernisation program which began in the early 1980s under Deng Xiaoping, guided by the strategic policy of 'People's War under modern conditions', emphasised the importance of both command, control, communications and intelligence (C³I) and EW capabilities.[2]  Chinese strategists began to consider the development of doctrine and operational concepts for IW, with the first book called Information Warfare being published in 1985 (and excerpted in the Liberation Daily in November 1985).[3]  New tactical SIGINT, EW and electronic counter-measures (ECM) units were formed by the PLA, equipped with truck-mobile ELINT, DF and jamming equipment, and trained to disrupt 'the enemy's radars and radios' and to destroy 'the enemy's command system'.[4]  The sustained, rapid growth in China's defence budget, involving double digit increases every successive year since 1988, amounting to more than 200 per cent over the last 15-year period, has provided extensive resources for the continued modernisation of the PLA's SIGINT and EW capabilities, especially airborne and naval capabilities.

An energetic round of new thinking, doctrinal change and organisational reform concerning IW operations was prompted by the performance of US forces in Operation Desert Storm against Iraq in 1991.  The Chinese military leadership was very impressed by the US operation, and especially 'the ease with which [the US forces] destroyed Iraq's largely Soviet and Chinese equipment'.[5]  The intelligence and EW aspects of the Gulf War were closely monitored by a special SIGINT unit located in Kashi, 1,700 miles from Baghdad, that intercepted large amounts of US and Allied military communications.[6]  Special SIGINT units in the Chinese Embassies in Turkey and Iraq also intercepted communications and collected electronic intelligence on US and Allied military activities.  (For example, these units reportedly intercepted intelligence that the ground phase of the war was about to start five days beforehand.)[7]  Chinese defence analysts quickly appreciated both the Revolution in Military Affairs (RMA) and its IW dimension.[8]  There was a spate of publications by senior military officers concerning IW published in 1993-95.[9]  Implementation of an IW plan began in 1995, and since 1997 the PLA has conducted several exercises involving cyber-warfare activities.  The Ministry of State Security and other civil authorities have also become well-versed in cyber-warfare, partly through their attempts to establish a 'great firewall' around China's computer networks and to strictly control Internet usage,[10] and because China is home to the most virulent non-governmental computer hackers in the world.

Chinese strategists and military planners thoroughly analysed the NATO air war against Yugoslavia in March-June 1999 (Operation Allied Force), which forced the Serbian forces from Kosovo, and were again impressed by the efficacy of precision air strikes, often targeted with real-time intelligence (including imagery and SIGINT provided by UAVs), against the Yugoslav C³ISR (command, control, communications, intelligence, surveillance and reconnaissance) systems, and by the uselessness of the Soviet-made air defence systems against NATO's EW capabilities.  A special 'high-tech electronic espionage unit' was reportedly established in the military attache's office in the Chinese Embassy in Belgrade to collect electronic intelligence on US and Allied military activities (until it was bombed by the US on 7 May).[11]

Chinese strategists also closely monitored the war in Afghanistan (Operation Enduring Freedom) in 2001-2002, appreciating the potency of network-centric warfare, with integrated (or networked) command, control, communications, intelligence, surveillance, reconnaissance and electronic warfare (C³ISREW) systems, as well as the susceptibility of network-based forces to cyber-warfare.

The Third and Fourth Departments
of the General Staff Headquarters

The Chinese national-level SIGINT agency, responsible for managing China's strategic SIGINT capabilities and operations, is the Third or Technical Department of the General Staff Headquarters of the Central Military Commission.[12]  The Third Department was established in the early 1950s, with equipment supplied by the Soviet Union, primarily to provide strategic communications for the General Staff.  However, it very soon acquired the responsibility for strategic SIGINT operations.  The first SIGINT stations were established along the eastern provinces across the Formosa Strait and in the northeast, to monitor signals from Taiwan and from US forces stationed in South Korea and Japan ─ e.g., at Nanking and Shenyang.  Through the 1960s, however, stations were established in the north and west to monitor signals from the Soviet Union, with particular emphasis on Soviet strategic missile developments and deployments ─ e.g., at Lanzhou, Julemutu, Hami, Urumqi and Lop Nor.  Other stations were established in the south and southeast to monitor signals from India, Burma, Vietnam and elsewhere in Southeast Asia ─ e.g., at Chengdu and Guangzhou.

The headquarters of the Third Department is located at Zianghongqi, in the Haidian District of Beijing, about 8 km from the Summer Palace, on the northwest outskirts of Beijing.  The Department's SIGINT net control station is located at Xibeiwang, about 5 km northeast of the headquarters.  The Department's principal SIGINT collection and processing stations are operated by the Third Bureaus attached to the headquarters of each of the Military Regions – i.e., Beijing, Shenyang, Chengdu, Guangzhou, Lanzhou, Jinan and Nanjing.  These Bureaus also control several subsidiary SIGINT stations in each of their respective Regions.  It was estimated in the late 1990s that the 3rd Department had a staff of about 20,000 personnel.[13] The head of the Third Department is a powerful figure in the Chinese political/military/intelligence structure. 

In 1990, a Fourth or Counter-Electronic Warfare Department was established, at the same level as the Technical Department and the Second (or Foreign Intelligence) Department, reflecting the upgrading of China's tactical SIGINT and EW capabilities over recent years.  (EW was previously the responsibility of a Branch in the Second Department.)  The headquarters of the new Counter-Electronic Warfare Department was initially co-located with that of the Third Department (and that of the Second Department) at Xianghongqi, but in 1991 it was transferred to new facilities at Tayuan, southeast of the Summer Palace.

The Fourth Department has two major Special Detachments located at Xibiewang and Yangfang, which are responsible for the electronic warfare (EW) defence of key state and military headquarters and facilities in Beijing.  In addition to these two Special Detachments which are run directly from the Fourth Department headquarters, units of the Department manage and direct SIGINT and EW operations for the Army through Military Region to Divisional levels.  There are, for example, several Counter-Electronic Warfare Department units in the Beijing Military Region, including a major unit at Xishan in the western mountain area which has a general responsibility for the EW defence of the Beijing region.  The Department also manages and directs SIGINT and EW operations for the Air Force and Navy.

The SIGINT ground stations

There are several dozen SIGINT ground stations deployed throughout China, concerned with monitoring signals from Russia, the central Asian states of the former Soviet Union, Japan, Taiwan, Southeast Asia and India, as well as internal communications.  The two largest SIGINT stations are, first, the main Technical Department SIGINT net control station at Xibeiwang on the northwest outskirts of Beijing;  and, second, a large complex near Lake Kinghathu in the extreme northeast corner of China.[14]  Another large SIGINT station in the Beijing area is in Nanyuan, just south of the urban area.  There are also the Counter-Electronic Warfare Department's stations at Xibeiwang, Yangfang and Xishan in the Beijing area.

The large ground stations operated by the Third Bureaus of the Third Department and attached to the headquarters of the seven Military Regions have different functional and geographic responsibilities.  For example, the Third Bureau's station at Lanzhou is responsible for monitoring Russian signal traffic, and has the critical mission of providing strategic early warning of Russian missile attack;  the station at Shenyang covers signals from Russia, Japan and South Korea;  the station at Changdu controls Third Department SIGINT operations against India, and also has geographic responsibility for covering Pakistan, Tibet, Burma and some Vietnamese traffic;  the station at Nanking monitors Taiwanese signals;  and the station at Guangzhou covers Southeast Asia (including part of Vietnam) and the South China Sea.

In addition to these stations, a large station is located in the very northeast of the country, near Jilemutu, across from the Sino-Soviet border;  another is near Erlian, just off the Sino-Mongolian border;  another is near Hami, just south of the Mongolian border;  and there are several other stations in the northwest (e.g., at Urumqi, Zhaosu, Kashi and Lop Nor) which are evidently concerned with monitoring signal traffic in Russia, Kazakhstan and some of the other central Asian republics of the former Soviet Union.  There is a large complex near Kunming, north of Indochina.  There is also a large SIGINT complex on Hainan Island, which is mainly concerned with monitoring the South China Sea and the Philippines (especially when the US bases were operational).  There are at least two major SIGINT stations in Shanghai, one of which is operated by the Navy and is concerned with monitoring naval traffic in the Yellow Sea and the East China Sea.  Other SIGINT stations are located in the Jugian and Guangdong Military Districts opposite Taiwan.  The Chengdu station, which controls SIGINT operations against India, is assisted by a sister station at Dayi, some 50 km west of Chengdu, and numerous posts along the border with India itself.  Several stations are also located in the area along the border with Vietnam.

A large ELINT intercept station was built at Tachiu in the 1960s.  The station is situated on a headland at 25°25'N and 119°37W, about 140 km from Taiwan, and consists of an operations area atop a 1,368-feet-high coastal area and a support area located at the base of the hill.  In January 1969, there were 42 antennas in the operations area, including one VHF rhombic system, two Yagi antennas, eight discone antennas, 12 'mattress' arrays, seven solid parabolic dish antennas, six other parabolic dish antennas, one cut parabolic antenna, and two vertical arrays.[15]

Many of them were expanded during the 1990s.  For example, the large SIGINT complex at Lingshui, which monitors signals from the South China Sea, Vietnam and the Philippines, was 'vastly expanded by 1995'.[16]  This SIGINT complex, where more than 1,000 SIGINT analysts work, is located about 1.5 km west of the Lingshui military airfield where the US Navy's stricken EP-3 SIGINT aircraft landed on 1 April 2001.[17]  Two large stations in Xinjiang – one at Dingyuanchen, used for monitoring communications in Russia and the Central Asian states, and the other at Changli, near Urumchi, used primarily for intercepting satellite communications – were expanded in 1999-2000.[18]

In 1978, the US reached tentative agreement with China to 'set up, install, man, equip and service a series of SIGINT sites along that country's border with the Soviet Union'.[19]  In April 1979, Vice Premier Deng Xiaoping indicated that these stations would have to be operated by China and that the data collected would have to be shared with China.[20]  Final agreement was reached in January 1980 to construct two stations, at Qitai and Korla in Xinjiang, and actual operations began in late 1980.  The stations were constructed with equipment provided by the CIA's Office of SIGINT Operations (OSO), whose personnel trained the Chinese technicians that operate the stations, and who periodically visited the stations to advise the Chinese operators and to service the equipment as required.[21]  Technicians from the Technical Department were trained at a SIGINT training centre in Silicon Valley near San Francisco under the agreement relating to the operation of these two stations.[22]  The equipment originally installed at Qitai and Korla was designed to intercept telemetry from Soviet missile tests and space launches conducted from Tyuratam near the Aral Sea and anti-ballistic missile (ABM) and nuclear weapons tests in the Sary Shagan/Semipalitinsk area, but other COMINT and ELINT activities are also undertaken at these stations.  It is believed that the US ceased its involvement in these stations in the early or mid-1990s.

Outside China, a SIGINT station was established on Rocky Island (Shi-tao), near Woody Island (Lin-tao) in the Paracel Archipelago in the early 1980s;  the site is one of the highest points in the area, and provides good coverage of signal activity in the northwestern part of the South China Sea.[23]  In 1993-94, China began to construct military structures on Mischief Reef in the South China Sea.  These structures, including communications facilities, have been substantially expanded over the past decade.  The communications systems include a small satellite communications dish and several HF and VHF antennas;  the HF and VHF systems are capable of intercepting communications in these bands.  It is also likely that the station is equipped 'to intercept radar signals'.[24]

In 1991-92, Chinese technicians constructed a large SIGINT station at Great Coco Island, a Burmese island located just 50 km north of India's Andaman Islands, on the western side of the entrance to the Straits of Malacca.  The station, which is operated by the Chinese, provides intelligence on air and naval movements in the eastern Indian Ocean, and is able to intercept telemetry associated with Indian ballistic missile test launches over the Bay of Bengal.[25]  (The Indian Defence Minister, George Fernandes, described it as a 'massive electronic surveillance establishment … which is monitoring everything in India' in an interview in May 1998).[26]  Chinese technicians also assisted with the construction of six electronic surveillance stations along Burma's coastline, which monitor shipping between the Indian Ocean and the Straits of Malacca.  These stations are located at Ramree Island, southeast of Sittwe, off the coast of Arakan;  Hainggy Island, in the estuary of the Bassein River;  Monkey Point, on the southeast side of Rangoon;  Kyaikkami, south of Moulmein;  Mergui;  and Zadetkyi Kyun (or St Matthew's Island), off Burma's southernmost point, Kawthaung (or Victoria Point).[27] 

Three SIGINT stations were established in Laos in early 1994.  The stations are in the southern province of Champasak, and monitor communications in Cambodia and Thailand.[28]  (The first Chinese SIGINT facility which is known to have been established outside China itself was a station near Sop Hau in Laos, in the mountains about 150 km west of Hanoi, which China maintained through the 1960s and into the early 1970s.)[29]

In early 1999, following an agreement signed between China and Cuba in February 1998, Chinese personnel began operating two SIGINT stations in Cuba.  One is a large complex at Bejucal, just south of Havana, which has ten SATCOM antennas, and which is primarily concerned with intercepting telephone communications in the US.  A 'cyber-warfare' unit at the station focuses on computer data traffic.  The second is located northeast of Santiago de Cuba at the eastern-most part of the country and is 'dedicated mainly to intercepting U.S. military satellite communications'.[30]

Interception of satellite communications

China has developed extensive SATCOM SIGINT capabilities for monitoring international satellite communications.  In December 1968, for example, it was reported that China had established 'a ground station for intercepting signals transmitted through the US and Russian communication satellite systems', together with an associated decryption capability, on Hainan Island.[31]  The station is situated at the Lingshui SIGINT complex.[32]  A second SATCOM SIGINT station is located outside Beijing.  On 4 June 1989, for example, Chinese authorities intercepted unedited video relating to the Tiananmen massacre which was transmitted by the American Broadcasting Corporation via satellite (and which was then used by the Chinese authorities to track down and arrest one of the leading dissidents).[33]  A third station is located at Changli, in western China, for monitoring satellite communications in central Asia.[34]  China has also established a SATCOM SIGINT station at Santiago de Cuba, at the eastern end of Cuba, to intercept US satellite communications.[35]  A satellite tracking and control station at Kiribati, which sits astride the equator in the central Pacific, is also capable of intercepting selected (S-band) satellite communications in the mid-Pacific.[36]  In addition, the four Yuan Wang and the Shiyan space event support ships (AGMs)/AGIs are also equipped with extensive SATCOM monitoring equipment.[37]

China has also developed limited capabilities for jamming satellite communications, especially those in the lower (e.g., UHF) SATCOM frequency bands.[38]  In addition, the PLA also has some capabilities for jamming transmissions from other sorts of satellites, including radar satellites (such as the US Lacrosse system) and navigation satellites (NAVSATs).  For example, the PLA has reportedly recently acquired a capability for jamming US and Russian GPS and GLONASS global positioning/NAVSAT signals, evidently based on a jamming system purchased from the Russian company Aviaconversia.[39]

Listening from space:  SIGINT satellite programs

China has evinced a limited interest in development of an ELINT satellite capability, and has experimented with several systems, although it still does not have an operational system.  A 1,108 kg ELINT satellite was launched from the Shuang Cheng Tzu Missile Range (SCTMR) in the Gobi Desert on 30 August 1976.  It decayed from orbit on 25 November 1978.[40]  On 19 September 1981, three SJ-2 satellites were launched on a single booster from the SCTMR, providing a capability for determining the location of radio and electronic emitters as well as for recording the emissions.[41]  The doublet DQ-1 launched on 3 September 1990 could have involved ELINT applications.[42]  It is also likely that ELINT packages of various sorts have been launched aboard subsequent Chinese photographic intelligence (PHOTINT) and/or communications satellites.  In 1999, the Heritage Foundation reported that China has an 'advanced electronic intelligence (ELINT) satellite program' in the development stage.[43]  According to another report, an ELINT satellite project was revived in the late 1990s under the Shanghai Academy of Spaceflight Technology and the Southwest Institute of Electronic Equipment, which produces ELINT pods and equipment for larger ELINT aircraft.[44]

The Chinese Air Force has more than 20 dedicated ELINT collection aircraft – several HD-5s, at least one EY-8, eight HD-6s, and five Tu-154M aircraft.

Airborne SIGINT capabilities

The HD (Hong Dian, or 'bomber electronic') – 5 ELINT aircraft, which entered service in the early and mid-1980s, are modified versions of the H-5 light bomber (based on the Soviet I1-28 Beagles, designed in the 1950s).  In addition to ELINT collection operations, some HD-5s were configured for EW missions, including the provision of ECM support to the PLAAF's bomber fleet.  However, it has not been a satisfactory system – it has limited range, and its EW equipment is old (mainly analogue).[45]  More than a dozen HD-5s were probably converted to the ELINT/EW role, but they are being phased out as further HZ-6 and Tu-154M ELINT aircraft enter service.

In the late 1980s, at least one EY-8 ELINT aircraft was produced.  (The Y-8 four-engined turboprop is an indigenous development of the Soviet An-12 Cub.)  It was equipped with a BM/KZ-8608 ELINT system, developed by the Southwest China Research Institute of Electronic Equipment (SWIEE) in Chengdu, Sichuan, which is able to monitor the frequency spectrum of 1 to 18 GHz.  It is designed to detect, identify, analyse and locate land-based or shipborne radar emitters with a high probability of intercept, and with high sensitivity (-100 dBW) and accurate measurement of parameters.  Frequency measurement is accurate to 5 MHz;  and bearing accuracy varies from 5º for the 1-8 GHz range to 3º for the 8-18 GHz range.[46]

The HZ-6 SIGINT aircraft are converted H-6 bombers (the Chinese version of the Tu-16 Badgers), with a range of some 4,300 km and an endurance of nearly six hours.  They are reportedly equipped with the EL/L-8300 SIGINT system, produced by Elta Electronics Industries in Israel, and which consists of several elements:  the EL/L-8312A ELINT section, the EL/K-7032 COMINT section (covering the HF, VHF and UHF communications bands), the EL/L-8350 command and analysis station, which fuses the COMINT and ELINT and reports to a ground station (EL/L-8353) in real-time, and an EL/L-8352 post-mission analysis station.[47]

The Air Force currently operates four Tu-154M Careless long-range transport aircraft modified for SIGINT collection.[48]  The first two of these were based at Nan Yuan

Table 1

Chinese SIGINT aircraft

airfield, south of Beijing.[49]  Another Tu-154M SIGINT aircraft is operated by China United Airlines (CUA), the commercial arm of the Air Force;  it uses civil markings (CUA B-4138), but was equipped in 1995 with a synthetic aperture radar (SAR) as well as COMINT and ELINT equipment for covert SIGINT operations.[50] 

The development of PLAAF SIGINT systems is the responsibility of the Sixth (Telecommunications Technology/Intelligence) Research Institute, which is functionally subordinate to the PLAAF's Scientific Research Department but is administratively subordinate to its Second (or Intelligence) Department, and which is located in northern Beijing.  The primary missions of the Sixth Research Institute are development of telecommunications equipment for SIGINT collection, including both ground-based and airborne systems.  A division within the Institute is specifically responsible for the development of equipment for PLAAF SIGINT ground facilities along China's borders.[51]

Unmanned aerial vehicles (UAVs)

China already has an operational UAV capability, including ELINT and EW systems.  The Chinese Air Force's primary long-range UAV is the WZ (Wu Zhen, or unmanned reconnaissance) -5, better known as the Chang Hong-1, based on US reconnaissance drones shot down over China in the 1960s.  Production began in the late 1970s, and some were used in the Sino-Vietnam border conflict in 1979.[52]  The latest version of the Chang Hong is a prospective ELINT platform.[53]  In addition, according to a report by the US Department of Defense, 'China already has a number of short-range and longer-range UAVs in its inventory for reconnaissance, surveillance, and electronic warfare roles', and has 'several developmental UAV programs underway related to reconnaissance, surveillance, communications, and EW'.[54]  The Army has equipped a version of its ASN-206 UAV for EW missions 'that could include SIGINT or jamming'.[55] In early 2000, China Aviation Industry Corporation (AVIC) released a photograph of a 'concept stage' UAV configured for ELINT and EW missions.[56] 

In July 2002, it was reported that the PLA had begun deployment near the Taiwan Strait of the HARPY anti-radar hunter-killer UAV acquired from the Israeli Aircraft Industries (IAI).  The HARPY is a small rocket-launched drone equipped with VHF/UHF radar receivers and a 48-pound warhead, and designed to monitor pre-programmed radar emissions and destroy the emitting radars..  It can loiter for two hours at a range of 400 km, and its mission is evidently to attack Taiwan's radar systems.[57]

Naval SIGINT Activities

In addition to equipping some of its frigates for SIGINT operations, in the mid-1980s the Navy laid down a series of new vessels for dedicated SIGINT missions.  The first of these new SIGINT ships became operational in 1987-88.  There are now more than a dozen of them, constituting the largest SIGINT collection fleet in Asia.  They include the Xiangyang Hong 09 (V 350) 'oceanographic research' ship;  the Xiangyang Hong 10, which is equipped with several large log-periodic antennas usable for COMINT purposes;  the Xiangyang Hong 14;  the Xing Fenghan (V 856);  the Dadie class No. 841, which displaces some 2,300 tons, and which has been used to monitor US-South Korean Team Spirit exercises;  the Yanbing (pennant number 723);  and the three armed Yanha (pennant numbers 519, 721 and 722) which were completed in the late 1980s and which operate in the North China Sea.[58]  Several 'trawlers' have also been configured for SIGINT operations (e.g., AGI 201).[59]  In addition, the four Yuan Wang and the Shiyan space event support ships are capable of collecting missile and satellite telemetry and monitoring satellite communications.[60]

Table 2

Chinese intelligence collection ships (AGIs)

One especially noteworthy naval SIGINT operation was the use of the Xiangyang Hong 09 (V 350) and an accompanying 'environmental research ship', Xiangyang Hong 05, in preparations for the Chinese actions in the Vietnamese-occupied area of the Spratly Islands in the South China Sea in March 1988.  In October 1987, the two vessels began a careful survey of the Yongshu (Fiery Cross) Reef, and by the end of the year had obtained all the data needed for the pre-emptive seizure of the reef in March 1988 before Vietnamese forces could react.[61]

Since 1999, Chinese spy ships have regularly been probing the waters off Japan.  (According to the Japanese Foreign Ministry, the number of instances in which Chinese spy ships intruded into Japanese waters, approaching to within 30-40 nautical miles of the coast, increased from four in 1997 to 30 in 1999).[62]  There have been numerous deployments of 'oceanographic research' ships to the area around the disputed Tiao Yu Tai Islands, as well as the waters around Okinawa. [63]  In May 2000, the Yanbing AGI (No. 723), in an unprecedented move, passed through Japan's two most important straits, the Tsugaru Strait between Honshu and Hokkaido and the Tsushima Strait off Kyushu.  (The vessel did not violate Japanese territorial waters in passing through the Straits.)[64]  In August 2000, a Chinese spy ship 'equipped with sophisticated electronic monitoring devices' penetrated inside the 12-mile limit during a Chinese Navy war game.[65]

There are almost continuous SIGINT collection operations around Taiwan.  For example, the Ziangyang Hong 14, which 'operates in the Taiwan Strait all year around', was found in Taiwanese waters and driven away by Taiwanese warships on three occasions in 2002.  In May, during Taiwan's Hankuang ('Han Glory')-18 military exercise, it was spotted off Chinpeng naval base.  On 9-10 October and 3 November, it was chased away from Lanyu ('Orchard Island'), 60 km southeast of Taiwan proper.  The vessel is believed to 'intercept Taiwan's communications'.[66]

Electronic warfare

Since the mid-1980s, the PLA has significantly enhanced its mobile, battlefield ELINT capabilities.  In August 1987, it was announced that the Central Military Commission had implemented a large-scale restructuring of the PLA, which included the formation of new electronic countermeasures (ECM) units.  These units were evidently elements of six new combined group armies (CGAs) – the 39th and 64th Armies in the Shenyang Military District, the 38th Army in the Beijing MD, the 63rd in the Taiyun MD, the 67th in the Jinan MD, and the 12th in the Nanjing MD.  They were evidently equipped with truck-mobile ELINT, DF and jamming equipment,[67] and had the task of 'disrupting the enemy's radars and radios, and of destroying the enemy's command system'.[68]

An example of the PLA's tactical SIGINT and EW capabilities was given by the Deputy Commander of the Chengdu Military Region in early 1986, when he recounted incidents from recent fighting on the Sino-Vietnamese border.  In these incidents, the PLA SIGINT/EW units had been able to intercept and read Vietnamese Army radio transmissions, and to both isolate and jam the radio net of the particular Vietnamese Army headquarters.[69]

The establishment of the Counter-Electronic Warfare Department in 1990 reflected a further enhancement of the PLA's tactical SIGINT and EW capabilities.  As a result of Chinese assessments of the Gulf War in January-February 1991, the Department received additional funding and skilled personnel.

The PLA has several different types of indigenously-produced ELINT and EW systems for tactical/battlefield purposes.  These include the DZ 9001 ground-mobile ELINT system, the man-portable ZJ 9301-1 ESM system, the truck-mobile BM/DJG 8715 and Model 970 radar jamming systems, the WZ 551 radio intercept and radio/radar jamming system, and various HF/VHF radio intercept and DF systems, as well as EW systems, designed for use by special forces.

The DZ 9001 ELINT system, produced by China National Electronics Import and Export Corporation (CNEIEC) in Beijing, covers the D- through J-bands (i.e., 1-18 GHz).  It consists of a three-truck convoy, in which two vehicles carry deployable (scissors-lift) antenna radomes with the third being configured as a control centre.  A trailer carries a generator and other support equipment.  The system has a DF accuracy of >3° RMS.[70]

The ZJ 9301-1 battlefield ESM system, also produced by CNEIEC in Beijing, provides a man-portable capability across the same frequency range.  It has two configurations:  one covers the D- through H-bands (i.e., 1-8 GHz), and the other the I- through J-bands (i.e., 8 to 18 GHz).  It is reportedly 'able to handle between three and five detected radars simultaneously', with a DF accuracy of >4° RMS.[71]

The BM/DJG-8715 vehicle-mounted radar intercept and jamming system, produced by the Southwest Institute of Electronic Engineering (SWIEE) in Chengdu, operates in an air defence network, and is aimed at airborne radars, including missile guidance radars, missile seekers, navigation radars, and terrain-following emitters.  The system consists of one ESM station and up to eight ECM sites, which 'are integrated by means of datalinks to ensure automatic control, direction of jamming, and feedback of ECM data'.  Both the ESM and the ECM stations are mounted on self-propelled vehicles 'to ensure high mobility'.  The system features a wide frequency coverage (I/J-bands, or 8-18 GHz), automatic classification and identification of a variety of radar threats, monopulse auto-angular tracking with high DF accuracy (5-8º), and a multi-threat jamming capability.[72]

The Model 970 mobile radar jamming system, produced by CNEIEC, is primarily designed to protect high-value ground targets from air attack by interfering with airborne surveillance and navigation radars and radar-guided missiles.  The system covers the I/J-bands (8 to 20 GHz).  It has a  receiver for measuring the bearing, frequency and other parameters (such as antenna rotation speeds) of hostile radars, which can be used in conjunction with a pulse analyser to measure parameters such as pulse widths, pulse repetition frequency (PRF), radar illumination, and so forth.  The equipment is contained in a trailer for rapid mobility, with the antenna system mounted on the roof.  Operationally, a number of Model 970 units are placed some 3-5 km from the protected area.[73]

A variety of HF/VHF radio interception, DF, ELINT and jamming systems have been developed for use by Special Forces.  These light-weight, man-portable systems are used to conduct interception, jamming and deception missions against communications and radar systems.[74]

The Chinese electronics industry has also produced a Radar Signal Environment Simulator, which can reportedly simulate 100 radar signals in order to deceive adversary ELINT collection and EW systems.[75]

Since at least 1997, EW and counter-command and control missions have been regularly conducted as part of the PLA's large-scale exercises.  In an exercise in Chengdu Military Region in October 1997, for example, an EW scenario included both standard EW actions (i.e., intercept, jamming, and electronic protection measures) and physical and electronic attacks by special forces against enemy command posts and communications facilities.[76]

Airborne EW systems

The PLA Air Force has a limited range of EW systems, including tactical ELINT, ESM and ECM systems for air support operations, radar jamming systems for strike and fighter aircraft, and self-protection radar warning receivers (RWRs) for a wide variety of combat aircraft.  All of them are produced by the SWIEE.  (The SWIEE also produced the BM/KZ 8608 ELINT system installed on the EY-8 aircraft and used for both strategic and tactical ELINT operations.)

Table 3

PLA Air Force airborne EW systems

Three models of airborne jamming systems are currently in service – the BM/KG 8601, the BM/KG 8605 and the BM/KG 8606.  The BM/KG 8601 repeater jammer operates in the E/F-bands (2-4 GHz) and the G/H-bands (4-8 GHz), and is carried by strike and fighter-bomber aircraft to counter air-to-air missiles, surface-to-air missiles, and surveillance radars.  It has high jamming power, minimal repeater delay times, and multi-jamming capabilities.[77]

The BM/KG 8605 system operates in the I/J-bands (8-20 GHz), and is regarded as 'a smart noise jammer that produces a hybrid output that incorporates elements of both noise and deception modulations'.[78]  The BM/KG 8606 system operates within the I-band (8-10 GHz), and uses orthogonal and dual circularly-polarised jamming techniques.[79]

The BM/KJ 8602 RWR is installed on a wide variety of PLAAF fighters, fighter-bombers and other combat aircraft.  It consists of a digital signal analyser, a cathode ray tube display unit, a control box, six receivers, four DF antennas, and an omni antenna.  It is a wideband system, covering a main frequency band of 2-18 GHz, plus a second band of 700 MHz to 1.4 GHz matched to the operating frequencies of a large proportion of Soviet radars;  it is capable of processing up to 16 threat signals simultaneously, from all types of pulsed and CW radars, with automatic sorting and identification, and automatic audio alarm and recording.  Response time is around one second, and threat signal bearing is measured to an accuracy of 15º RMS.[80]

The PLA has also equipped some Z-9 helicopters for EW missions.[81]

The development of China's airborne SIGINT/ELINT/EW capability has been greatly assisted by Israel.  The EL/L-8300 SIGINT systems installed on the HZ-6 aircraft were acquired from Israel;[82]  the BM/KZ-8608 airborne ELINT system is a derivative of the Elistra CR-2800 ELINT/ESM system;  and the BM/KJ-8602 RWR 'bears a strong resemblance in appearance and capability to Elistra's SPS-1000 RWR'.[83]  In addition, China has reportedly also acquired other advanced airborne ELINT and EW equipment from Israel.[84]

Shipborne EW systems

In 1998, the US Department of Defense reported to Congress that:  'The PLAN's major combatants are expected to have an extensive EW suite … .  Its naval forces will have intercept systems designed to detect and locate enemy radar and communications systems'.[85]  But the rush to modernisation has resulted in the acquisition of numerous (more than 15) different types of shipborne EW systems, mostly imported, and many installed on only two or three vessels.  As one analyst has noted:  'Installation does not seem systematic;  ships are apparently fitted with what is available when they are being built'.[86]

The six Kilo-class submarines purchased from Russia are equipped with the Russian Brick Pulp ESM system.[87]  The 19 Ming-class (Type 035) submarines and the first Han-class (Type 091) SSN are equipped with French DR 2000U ESM systems.[88]  The two Sovremenny-class destroyers acquired from Russia are equipped with four Russian Football/Wine Glass ESM/ECM arrays.[89]  At least one of the Luhu-class (Type 052) DDG destroyers, the Harbin (No. 112), is equipped with a Dutch Signaal Rapids (Radar Passive Identification System) ESM/ECM system.[90]  Two DDGs, the Harbin (Luhu-class) and the Kaifeng (Luda-class), carry the French DR 3000S ESM system.[91]  The Harbin and two Luda-class destroyers are equipped with Thomson-CSF's Alligator X-band jamming system.[92]  A Luda-class DDG, the Zhanjiang (No. 165), carries the French DR 2000S ESM system.[93]  The three Jianghu-class (Type 053) frigates are evidently equipped with the Italian Elettronica Newton Beta ESM/ECM system (which includes the Type 211 ESM system, Type 318 noise jammers, Type 521 deception jammers, and Types 923 and 981 omni-antennas and Type 929 directional antennas).[94]  The twelve Jiangwei frigates are reportedly equipped with RWS-8 ESM systems and NJ81-3 jamming systems.[95]

The Chinese electronics industry has developed three EW systems which are installed aboard the great majority of PLAN ships and submarines – the BM/HZ-8610 ESM system and the Type RW-23-1 RWR system on surface combatants and the Type 921-A ESM/RWR system on submarines.  They are each derived from Soviet systems developed in the 1950s, and although they have been considerably modernised (e.g., substituting vacuum tubes with transistors, replacing analogue with digital processors, extending the frequency coverage and improving the DF accuracies), but most of those currently in service involve the designs and technologies available to Chinese industry in the 1980s.

The most common shipborne ESM system is the BM/HZ 8610, deployed aboard more than 250 PLAN vessels, including most minor surface combatants, such as the Haijiu, Hainan, Shanghai, Huangfen and Huchuan classes of fast attack patrol vessels,[96] and used to provide warning, DF and analysis of threat radar systems.  It is produced by the SWIEE in Chengdu, and is derived from the Soviet Bell Tap ESM system, although it has digital processors and uses a much more directional antenna array.  The system typically uses two rows, each of eight monopulse ports, clamped around a mast, and covering the 2-8 GHz, and 7.5-18 GHz frequency bands respectively.  It has a high sensitivity (better than –70 dBW) and high DF accuracy (2.5° RMS).[97]

The Type RW-23-1 ESM system (code-named Jug Pair) is produced by CNEIEC in Beijing and is derived from the Soviet Nakat-M (or Watch Dog).  It was first displayed in 1987, and is now installed aboard various classes of destroyers, frigates and other support vessels.  It consists of an antenna array and a control/display console and covers the frequency range from 2 to 18 GHz.  The antenna is built in two sections, which are mounted one on either side of the ship.  The parameters of up to 15 radars can be stored in the library memory of the system and used for comparison with any detected radar emitters.[98]

Table 4

Chinese (indigenous) Navy EW systems

The Type 921-A (Golf Ball) ESM system is produced by CNEIEC in Beijing, and is derived from the Soviet Stop Light system.  It is installed on numerous PLAN submarines, including the Xia-class ballistic missile submarine, the four later Han-class (Type 091) SSNs, and the new Song- class (Type 039) boats.  It is a wideband (2-18 GHz) system, which detects emitters of airborne and shore-based as well as ship-based radars, and provides coarse measurements of bearing (better than ±30º), frequency bands and operational parameters of hostile radar emitters.[99]

Cyber-warfare

China has the most extensive and most practiced cyber-warfare capabilities, although the technical expertise is poor.  China began to implement an IW plan in 1995, and since 1997 has conducted several exercises in which computer viruses have been used to interrupt military communications and public broadcasting systems.  In April 1997, a 100-member elite corps was set up by the Central Military Commission to devise 'ways of planting disabling computer viruses into American and other Western command and control defence systems'.[100]  In 2000, China established a strategic IW unit (which US observers have called 'Net Force') designed to 'wage combat through computer networks to manipulate enemy information systems spanning spare parts deliveries to fire control and guidance systems'.[101] 

PLA IW units have reportedly developed 'detailed procedures' for Internet warfare, including software for network scanning, obtaining passwords and breaking codes, and stealing data;  information-paralysing software, information-blocking software, and information-deception software;  and software for effecting counter-measures.  These procedures have been tested in recent field exercises.  500 soldiers took part in a network-warfare exercise in Hubei province in which simulated cyber-attacks were conducted against Taiwan, India, Japan and South Korea.  In another exercise in Xian, ten cyber-warfare missions were rehearsed:  planting [dis]information mines;  conducting information reconnaissance;  changing network data;  releasing information bombs;  dumping information garbage;  releasing clone information;  organising information defence;  and establishing ‘network spy stations’.[102]  In Datong, 40 PLA specialists are reportedly ‘preparing methods of seizing control of communications networks of Taiwan, India, Japan and South Korea’.[103]  In October 2000, an exercise presided over by the PLA Chief of Staff simulated cyber-warfare and EW ‘with countries south and west of [the] Gobi desert’.[104]

China, which now has some 60 million Internet users (the second largest number after the US),[105] has the largest number of active non-governmental cyber-warriors in Asia.  The most sophisticated and notorious group is the banned Falun Gong 'spiritual movement', which organises its activities through e-mails and Web sites, and which has mocked the government with some remarkable hackings.[106]

Its technical prowess has been dramatically demonstrated from on several occasions since June 2002 when Falun Gong sympathisers hacked into the State-owned Sinosat-1 satellite to broadcast Falun Gong messages and scenes of Falun Gong followers exercising.  In previous months, members had hacked into cable-television networks in several Chinese cities, but hijacking a satellite signal is more complicated.  Although several Asian governments have jammed satellite transmissions in the past several years (including China, Burma, India and Indonesia), this is probably the first time that a non-governmental group has interrupted official satellite transmissions and actually hijacked a satellite signal.[107]

The Falun Gong ‘practitioners’ first took control of Sinosat-1 from 23 to 30 June, when they interrupted official transmissions and broadcast their own video on nine national channels and ten provincial stations.[108]  A second series of take-overs occurred for eight days from 8 September, and again on the night of 21 September, when three of the 39 transponders on the satellite were hijacked.[109]  Another round occurred on 24-29 October.[110]

Chinese radio spectrum management officials have declared that China has capabilities for intercepting satellite up-link signals, and that telecommunications engineers had traced the source of the illegal signals (at least in the case of the September and October incidents) to the Taipei City area.  After the September hijackings, a Chinese official said that:

We’ve used a wide range of technical means to monitor and analyze the hijacking signals and determined an accurate position for the hijacking source.  Specialists are completely certain about the positioning result.

But Chinese officials said at different times that the signals had been traced to Yangming Mountain, about 10 km north of central Taipei,[111] and a mountainous area 45 km south of the capital, near Wulai.[112]  Other commentators suggested that it could have involved a vehicle with mobile satellite broadcasting equipment.[113]  After the October incidents, another Chinese official said:

Our relevant departments made a prompt technical investigation into the direction of the interference and confirmed that it was arising from the city of Taipei.[114]

Other individual Chinese hackers have