What did she see? The intelligence scramble to retrace an accused spy's footsteps

What did she see? The intelligence scramble to retrace an accused spy's footsteps

Investigators are combing through a decade of internships and government work

Several Western intelligence agencies were sent scrambling this summer to figure out what — if anything — of value an accused Canadian spy managed to access during internships at multiple agencies and government departments.

Biwei Zhang, a Canadian intern at NATO military's headquarters in Mons, Belgium, was arrested by Belgian authorities in July on suspicion of espionage and communicating with a foreign crime entity. She has been held in pretrial detention since being taken into custody and was this week denied an appeal for release.

Belgian justice and security officials have released very little information and have even declined to name her. A CBC News investigation, in late July, identified her through open-source records and established that over the past decade, she had hopped between high-profile organizations.

Zhang apparently worked as an economist for Statistics Canada, a systems engineer in satellite operations for the Canadian Space Agency and held positions at the European Space Agency in Italy and the World Trade Organization in Switzerland.

Ottawa will look into screening processes amid NATO intern spying allegations

Court decision barring Chinese student sends message about espionage risk, experts say

Belgian authorities have not said who she might have been spying for, but European media outlets, citing intelligence officials, say it was China.

The Canadian Security and Intelligence Service (CSIS) confirmed it is overseeing a multi-departmental damage assessment.

"When security incidents of this nature arise, it is customary that departments and agencies conduct a review to identify and address the potential consequences," said Magali Hébert, a CSIS spokesperson, in a written statement.

"CSIS can confirm that it is engaged with federal counterparts in that regard."

CBC News spoke to several confidential sources — in the intelligence and diplomatic communities — about the fallout of the allegations against Zhang.

Kenneth Lasoen, who teaches intelligence at the University of Antwerp, said a "serious post-mortem" into her alleged activities would also be among the first order of business for a handful of European intelligence services.

NATO spy suspect possibly recruited after she was vetted, says ex-CSIS officer

All of them are trying to build a picture of what access she may have had, what sort of damage might have been done and whether Zhang had a connection to a wider network.

Much of the public discourse about the case in Canada has focused on how the alleged spy received security clearance. A House of Commons committee plans to convene hearings.

Intelligence services, however, are more concerned with the bigger picture of what she may have seen, what might have been done and whether there were accomplices.

"I would think the most interesting part from the damage assessment would be — of course — to find out exactly who she works for, what the lines of communication were [and] how did she work for her handlers?" Lasoen told CBC News.

In the immediate aftermath of her arrest, NATO said none of its critical systems were compromised.

The European Space Agency has focused its public comments on her security screening and how it was up to national authorities to conduct a deeper vetting. An official from the World Trade Organization (WTO) confirmed that Zhang worked at the organization for a brief period in 2023.

Reconstructing her alleged activities in each of the other agencies, in Europe and Canada, would depend on how long they retain security data.

"Are there still logs of the movements of her badge, for example? Are there still images on security cameras of her trying to get in or actually moving in parts of the office that she actually had no business being?" Lasoen said.

"I'm sure at SHAPE [NATO], because that's the most recent, they'll manage to reconstruct most of those things. But for the other places, the question is how long ago was it and what's their policy on how long they actually keep that sort of information."

An expert in counterterrorism and cyber who has also acted as an instructor for certain European intelligence services, Lasoen said it's significant that Belgian authorities accused her of communicating with a criminal organization.

Under Belgium's recently rewritten law, anyone who entices somebody to conduct espionage is considered a criminal organization.

"But then that's where it gets a bit risky, as far as I would be concerned, diplomatically," Lasoen said.

Sister denies detained Ontario university student is Chinese spy

"If we're going to be calling the Chinese secret service a criminal organization, I'm sure the Chinese will have a certain opinion about that."

Given that her arrest involved allegedly spying at NATO's military headquarters, the information she supposedly gathered or the activities she undertook would be of direct benefit to Chinese military intelligence.

The question being asked in intelligence circles is: Was she working for them directly, or a third-party criminal organization?

There are documented third-party networks active in Europe who've allegedly co-operated with Chinese intelligence agencies, including Fujian community associations. That's according to a ProPublica investigation in Italy and Spain.

Chinese overseas police stations are also a known source of intelligence liaison.

While none exist in Belgium, France recently dismantled a chain of nine of them.

Authorities in Brussels have contended with informal consular networks, which supposedly provide assistance to Chinese nationals in the country.

In Canada, authorities would be combing through the departments to which Zhang had access, looking at the data she saw through a military or intelligence lens to determine what sort of value it might be to a foreign power.

CBC News identifies Canadian intern accused of spying on NATO

For example, it has been reported publicly by The Globe and Mail that while at Statistics Canada, she tracked shipping data out of the Port of Montreal — information that's economically important but also militarily significant in the event of war.

Zhang's role as an IT intern is also potentially significant, said an expert in disruptive cybersecurity.

China has taken a decidedly different approach to cyber espionage than adversaries such as Russia, Iran and North Korea.

Whereas those nations and their proxies often focus on "smash and grab" types of attacks, stealing data ransoming companies and shutting down systems, China aims for stealth intrusions.

"They're going to use techniques that are low and slow, very methodical, very deliberate and virtually impossible to detect," said J Paul Haynes, CEO of Cinchy, a Toronto-based data access and governance company.

The idea is to either implant malware in critical infrastructure systems for activation at a later date, perhaps during a crisis or war. Or, establish what Haynes calls "a beachhead" for an outside hacker.

"The best way has always been having a human on the inside working with external hackers on the outside," said Haynes, who has commented regularly for the Centre for International Governance and Innovation.

"Whether it's the CIA on down, everyone would say that's the hardest scenario to defend against when you've got an insider that's actively working against you."

A European media consortium — Le Lettre, Le Soir, Knack and Follow the Money — reported that a counterintelligence investigation at SHAPE involving Zhang was triggered by her allegedly loitering around restricted military command buildings and consistently asking personnel highly specific, "hypothetical questions" regarding security protocol breaches.

Last week, the publications reported that Belgian security officials now suspect that accomplices were involved.

Senior reporter, defence and security

Murray Brewster is the senior defence writer for CBC News, based in Ottawa. He has covered the Canadian military and foreign policy from Parliament Hill for over a decade. Among other assignments, he spent a total of 15 months on the ground covering the Afghan war for The Canadian Press. Prior to that, he covered defence issues and politics for CP in Nova Scotia for 11 years and was bureau chief for Standard Broadcast News in Ottawa.