Full Report
Years before the figure skater became an Olympic superstar, a Chinese operative tried to stalk her father and monitored other US residents deemed dissidents against China. And that’s just the beginning.
Analysis Summary
# Threat Actor: Sun et al. Network (Chinese Intelligence Proxies)
## Attribution & Identity
* **Primary Attribution:** People’s Republic of China (PRC) government.
* **Key Individuals:**
* **Qiang Sun:** Overseas handler/director based in China; believed to be the primary link to the PRC government.
* **Frank Liu (Fan Liu):** A Long Island-based "fixer" and head of a foundation, acting as a domestic facilitator for PRC operations.
* **Matthew Ziburis:** A former US Army and Marine Corps veteran hired as an operative/subcontractor.
* **Associated Groups:** This network is a manifestation of **Transnational Repression (TNR)** operations, often associated with the Ministry of State Security (MSS) or Ministry of Public Security (MPS) (though specific ministry names are not explicitly used in this text).
## Activity Summary
The actor network was engaged in a multi-year campaign (peaked around 2021–2022) to monitor, harass, and discredit individuals residing in the US who were deemed "dissidents" or enemies of the Chinese state. Specific operations included the physical and digital surveillance of figure skater Alysa Liu and her father, Arthur Liu, a former Tiananmen Square activist, ahead of the 2022 Beijing Winter Olympics.
## Tactics, Techniques & Procedures
* **Physical Surveillance:** Stalking targets at their residences and places of work using "boots on the ground" (e.g., Ziburis).
* **Social Engineering/Pretexting:** Posing as officials (e.g., from the US Olympic Committee) to extract sensitive information.
* **Document Harvesting:** Attempting to obtain high-value personal identification such as passport copies under false pretenses.
* **Use of Private Investigators:** Hiring local PIs or using individuals with military backgrounds to lend "professional" cover to surveillance activities.
* **Harassment & Intimidation:** Persistent unwanted contact to pressure targets into silence or cooperation.
## Targeting
* **Sectors:** Human Rights, Sports, Government/Politics (U.S. Congress).
* **Geography:** Primarily United States (California, New York).
* **Victims:**
* **Arthur Liu:** Former Chinese democracy activist.
* **Alysa Liu:** US Olympic figure skater.
* **Unnamed Dissidents:** Other US-based residents critical of the PRC.
* **Political Figures:** Members of the US Congress and New York City mayoral circles (implied influence/contact).
## Tools & Infrastructure
* **Malware:** Not specifically mentioned in the provided text (focuses on physical espionage).
* **Digital Infrastructure:**
* Fax machines (requested for data exfiltration of passports).
* Telephony (used for social engineering calls).
* Foundation/Non-Profit Fronts: Used by Frank Liu to mask activities and build political influence.
## Implications
This case highlights the evolution of **Transnational Repression**, where foreign states leverage US citizens (particularly veterans or individuals with local access) to target people on US soil. It demonstrates that family members of dissidents—including high-profile athletes—are considered viable targets for leverage or intimidation. The strategic goal is the "long-arm" enforcement of PRC ideological control, ensuring that even abroad, critics feel the reach of the state.
## Mitigations
* **Public Awareness:** Educating at-risk communities (dissidents, expatriates) about the tactics of transnational repression.
* **Vetting Outbound Requests:** Verifying the identity of any person requesting sensitive documents (passports, IDs) through official, out-of-band communication channels.
* **Law Enforcement Cooperation:** Maintaining active contact with the FBI’s counterintelligence divisions when suspicious surveillance is detected (as demonstrated by the private investigator in this case).
* **Operational Security (OPSEC):** High-profile individuals at risk should utilize professional security assessments for travel and home offices.