I’ve been entertaining myself finding needles in haystacks of Chinese data for the last month. In this project, I could extract enough of China’s sealed espionage convictions to build a profile of how they catch spies. I’m not sure if I should have a martini shaken, not stirred, or a Moutai while writing this; thankfully its 3pm in the afternoon and I have a few hours to decide (11pm ex post facto: I had a martini. If you’ve ever had a glass of Chinese Moutai you’ll understand why).
Each bubble is a Chinese province’s conviction count; most sit on the Taiwan-facing coast and the Korean border, and the known gap is the high-end threat this record cannot see.
Bottom Line Up Front
Chinese courts convicted at least 216 people of espionage and related national-security offenses between 1991 and 2021. We can count them because the records were published on the PRC’s own judicial transparency platform of ~80 million cases, China Judgments Online (CJO), and stayed up until Beijing changed their judicial transparency in 2021. You can download it off bit torrent. Once extracted, they are plausibly the largest open, case-level compilation of foreign-intelligence penetration of China in (unclassified) existence, the mirror image of the Western databases that count Chinese spies caught in the West.
The temptation is to read the 216 cases as a portrait of the assets (that’s spy-speak for a recruited “spy”). The portrait of the spy-catcher is worth more or at least I find it more interesting. Every case here is one the Ministry of State Security (MSS, China’s civilian intelligence service, which runs both espionage abroad and spy-catching at home) or its military counterpart detected, investigated, prosecuted, and proved. The portrait is specific: China is very good at catching the low-tradecraft paid observer on its Taiwan-facing coast and its Korean border, and it is very good at following small money. The military half of the record shows foreign collection reached every branch of the People’s Liberation Army (PLA).
China also hides some things on purpose. The verdicts name the foreign intelligence service in only 9 of the 216 cases and withhold it in 200; the remaining 7 can be inferred from structure. Two hundred of 216 is a 93% withholding rate. Caveat lector, most of the 93% is deliberate redaction plus an artifact of how these records surfaced, not evidence that China failed to work out which countries’ service was running the asset. From this record, the pool of cases where China genuinely may not have known the service is at most 8.
The blind spot is a hypothesis that I have a low confidence in. The Chinese counter-intelligence apparatus looks tuned for the cheap coastal observer, and it may under-see the remote, patient, professional penetration. The extracted cases can not refute the alternative explanation, that China catches the high end too and those cases never reach the civilian courts paperwork.
The court data ends where this particular court database went dark in 2021; the analysis was current as of July 2026. Dollar figures use one round rate of 7 yuan to the dollar, close enough to the actual rates of the case years.
How a now-dark database gives up sealed verdicts
In 2014 the Supreme People’s Court ordered Chinese courts to publish their judgments online, and for seven years they mostly did. The result was China Judgments Online: roughly 80 million cases spanning 1985 to 2021, on the open internet, in Chinese. Espionage was supposed to be the exception. Military courts (军事法院) are a closed system whose verdicts never entered the database at all, and civilian state-security trials are routinely sealed.
The seal has a bureaucrat-shaped hole in it. When a convicted spy is transferred to an ordinary provincial prison, that prison files the same routine paperwork it files for every inmate: sentence-reduction and parole rulings (减刑/假释). Those rulings quote the sealed verdict verbatim, because the form requires the conviction details: name, court, charge, sentence, often birthdate, rank, unit, and money. The prison clerk is not running a declassification review. He is filling out a form. So sealed espionage verdicts, including verdicts from military courts that never published anything, surface word for word inside the most mundane filings in the system.
In 2021 Beijing pulled the whole database offline. Copies had been preserved while it was public, and this analysis runs on one. Provenance matters here, so I will be precise: everything in this post comes from court records the PRC itself published and later removed. Nothing was hacked. The only tradecraft involved was reading.
One more property of the corpus does real work. The database carries its own index of case numbers, so a verdict quoted in prison paperwork but absent from the published set is provably one Beijing chose to withhold, not one I failed to find. Withholding is measurable, and that measurement carries the second half of this post.
Two rules governed the build. No person entered the count on a name match alone; every identity had to be confirmed by a second attribute in the record itself, a birthdate, a rank, a unit, a sentence. Everything is a tally of documents that exist.
What came out of the scan: 216 people, 21 of them tried by military courts and 195 by civilian courts. Convictions rise sharply once the courts’ publication mandate takes effect and peak in 2014 and 2015, at 37 and 36 cases. The sentencing is heavy. Of the 216 outcomes: 1 defendant was executed, 7 received suspended death sentences, 23 received life imprisonment, and roughly 177 received fixed terms, with the small remainder unstated or otherwise disposed.
The portrait, in five findings
1. The map is a threat assessment. I have sketched the map of China on whiteboards in SCIFs (a windowless room for doing classified US government things) a thousand times. This map marks theirs, and the convictions cluster exactly where foreign intelligence services would want eyes. The Taiwan-facing littoral dominates with 78 cases: Guangdong (29), Fujian (28), Hainan (11), Zhejiang (10). A second cluster of 26 sits on the Korean border, in Jilin (16) and Liaoning (10). A third, 14 cases in Beijing, runs against the central ministries and draws the heaviest sentences in the set. Chinese counter-espionage enforcement concentrates where geography predicts foreign tasking, which both validates the data and maps where Beijing sees its own exposure.
2. The typical convict is a paid observer, not a mole worth making a movie about. Of the 192 convictions under the two core espionage statutes, 117 fall under Article 111 of the criminal law, which covers stealing, probing, buying, or illegally providing state secrets or intelligence for entities outside China. The other 75 fall under Article 110, espionage proper: joining or taking tasking from an espionage organization. The Article 111 majority, 117 of 192 or 61 percent, is mostly recruited civilians photographing and reporting what they can physically see: ports, airfields, unit movements. One case sketches the type: Ye Genliang, a Chinese student recruited by Taiwan intelligence while studying in South Korea, went home and built an observation ring that filed reports on a military airfield. Caveat lector: only 16 of the 216 records say how the person was recruited. But two patterns recur: cultivation of Chinese citizens studying or working abroad, and cold online approaches with an offer of pay. One man simply wrote the foreign service a letter and volunteered. You call that a walk-in and you assume it’s a dangle (a foreign service trying to waste your time by dangling a fake spy).
3. The MSS has bean counters. Payment evidence survives in 62 of the 216 cases as a confiscation or proceeds figure. The parseable amounts run from ¥600 to ¥505,000, call it $90 to $75,000, with a median near ¥43,000. That is about $6,000. Money is also the only motive the verdicts document; ideology, coercion, and ego are essentially absent from the record. And the trails are forensic. The verdict against Xu Bingtao, a demobilized serviceman who left service carrying 51 CDs of military secrets, itemizes US$19,950 received across 32 separate Western Union remittances from a Taiwan-run cell that spotted him after he posted an online job-wanted ad. The verdict against Huang Liping, an accessory drawn in as the principal’s long-term partner and convicted for moving money for a US-run network, reconstructs US$366,715 in FBI and CIA funds routed through a Hamburg shell company between October 2005 and March 2007; the sentence was ten years. A counterintelligence service that can produce a 32-remittance wire trail and an 18-month reconstruction of a foreign funding pipeline is not weak at financial forensics.
4. Policy restricts disclosing the adversary. Since 2023, when a revised Counter-Espionage Law took effect and the MSS opened its first public social-media channel to advertise its wins, Beijing has been louder than ever about catching spies. Louder, but not more specific. Across the 216 cases the foreign service is identifiable in only 16: 9 verdicts name the foreign services, and in 7 the service can be inferred. The list is short of those the courts do name. Taiwan organizations are the plurality, the FBI and CIA are named verbatim in one case, South Korea’s National Intelligence Service (NIS) in another, a Russian service surfaces inside one multi-service determination, and Japan appears only through a defendant’s nationality but not as a named service.
One case proves the withholding is Chinese policy. Zheng Dongzhe was a serving counterintelligence officer in Yanbian, on the Korean border, recruited at a meeting in Beijing and run for years before being sentenced to life in prison. His verdict writes the recruiting country as 某国, “a certain country,” a formal redaction. The same sentence leaves the recruiting service’s name intact: 国情院, the Gukjeongwon, a term that exists only for South Korea’s NIS. The court masked the label it understood and left the one it didn’t (I had to look it up too). Three more convictions of serving Chinese security officers recruited by a foreign service follow the same pattern, each with the service redacted. A 某国 in a Chinese verdict is a decision someone made.
Of the 200 withheld cases, only 13 carry any descriptor of the foreign principal at all: 5 use a deliberate placeholder like 某国, and 8 say only “an overseas spy organization” with no country attached. The other 187 are silent for a boring reason: the prison paperwork quotes the charge and the sentence, not the crime narrative where a handler would be described. So the true “China could not attribute” pool is at most those 8 generic cases, and probably smaller. The 93 percent is redaction and channel, not blindness. The 16 identified cases also carry narratives roughly five times richer than the withheld ones, which tells you disclosure is rationed, and rationed consistently: Taiwan, which Beijing treats as an internal matter, gets named freely, while sovereign states get 某国 where naming would carry a diplomatic price. For an analyst, the redaction pattern is signal in its own right. It marks which relationships Beijing is managing carefully.
5. Every service was touched, and the trail stops at senior colonel. The 21 military-court convicts are the half of this record that should not exist at all; their verdicts were sealed inside the closed military-court system and surface only through the prison-paperwork channel. Projected onto the PLA’s structure, they spread with an evenness that is itself interesting: 4 Air Force, 4 Navy, 4 from units directly subordinate to the Central Military Commission (the CMC, the top command organ that runs the entire military), and 4 from the Army’s regional commands. No branch was spared. Foreign services were not probing one weak side of the PLA; they were successfully spread across all of it.
Our civilian courts’ leak does have another limit. The highest rank in the recovered set is 上校, senior colonel; no general officer appears anywhere in it. The two known general-officer espionage cases both resulted in executions and neither are present in this database. They are structurally absent here, because executed convicts generate no parole paperwork and military custody generates no civilian filings. The same filter removes anyone executed, anyone never tried, and everything after 2021. The true population is larger than the 216 we know about, and every structural bias in the channel points that direction. Read every number in this post with that in mind.
The blind spot worth tasking
Everything above I hold at high confidence. It’s pulled right out of (a whole lot of chinese-language) data. What follows is a hypothesis I cannot prove or refute with this data.
The court record shows what China catches easily. Its typical espionage convict is the cheap coastal observer: recruited cold, paid small traceable sums, physically standing by the thing he photographs. Every feature of that profile makes him catchable: the wire trail, the proximity, the low tradecraft. The question a practitioner should ask is what the same machine does against a harder adversary: an officer who never wires money to a source inside China, a relationship handled and met abroad, collection that never requires anyone to stand on the same beach in Fujian twice.
The record offers three suggestive silences. First, there are no cyber or technical-intrusion convictions at all. QQ and email appear constantly, but only as communication channels for human assets, never as technical collection. Some of that is mechanical, since remote operators abroad never enter a Chinese courtroom. But China does not appear to convert attributed technical penetrations into named prosecutions the way it industrializes prosecutions of coastal observers. Second, the record thins exactly where the assets get senior; that is finding 5, and it means this channel is structurally blind to the top of the pyramid. Third, the professional long-dwell tail is tiny. The turned border officer Zheng Dongzhe is one of its few members. Another is Liang Ying, an insider at a Chinese embassy in Russia who passed 126 internal documents and drew a single determination naming US, Russian, and Taiwan handlers in one case. Where the record permits computing how long a penetration ran, which is a handful of cases, the spans skew long. A handful is too small to measure with, but it leans one way.
The most consequential known example sits outside the record entirely. Between roughly 2010 and 2012, Chinese counterintelligence dismantled the CIA’s agent network inside China, a loss widely reported to have killed or imprisoned nearly twenty sources. Those were senior cases, and not one appears here: sources who were executed never generated civilian-prison paperwork, and the rollup years predate the comprehensive publication mandate. The channel this analysis rides did not merely miss the high end in theory. It already missed the largest known US intelligence loss in China in a generation.
So, the hypothesis: China’s counterintelligence is tuned to the paid physical observer it convicts at volume, and struggles to see the remote, patient, professional penetration. The alternative hypothesis, which I cannot refute, is that China sees the high end just fine and those cases never enter the civilian prison system where records surface. My confidence in the blind-spot read is low and I neither have the data to support it more or to refute it.