Alleged Chinese spies used LinkedIn to approach more than 100 people linked to Australia, including a former state premier, a senior police officer and federal government staff, according to an ABC investigation published this week. The accounts, which posed first as think tank representatives and later as a fictitious security firm, are tied to the same network behind Australia’s first conviction for reckless foreign interference.

The Australian Federal Police (AFP) alleges the operation was run by China’s Ministry of State Security. The Chinese embassy in Canberra has rejected the claim as entirely groundless. Here is what the ABC found, why experts call it a shift in espionage tactics and what professionals can do to protect themselves.

What the ABC investigation found about alleged Chinese spies

According to the ABC investigation, two LinkedIn accounts connected to suspected Chinese spies amassed thousands of connections worldwide and approached dozens of Australians working in government, policing and trade. They offered paid consultancy work, presenting themselves as think tank employees who wanted “valuable advice” in return for competitive pay.

Between 2016 and 2025, the alleged spies targeted more than 100 individuals linked to Australia. The accounts reached out to 58 of them, and some recipients shared personal contact details. People approached included those whose profiles listed jobs at Austrade, the Department of Foreign Affairs and Trade, Investment NSW, Invest Victoria and Tourism Australia.

Some of the pitches went beyond consultancy. One message asked whether the recipient had a special source of information from important people in government. Several recipients declined. An Austrade employee said he could not accept money because he worked for the Australian government, although he offered to introduce others in his professional network.

The list of connections included former Queensland premier and current Opposition Leader Steven Miles, who was connected to one account in April 2021 while deputy premier. The ABC says it has seen no messages between Mr Miles and the account, understands he did not respond, and stresses that a connection alone does not show he received an offer or passed on information.

The link to the Alexander Csergo case

The ABC says the accounts belong to the same alleged network that groomed Sydney businessman Alexander Csergo, the first person convicted of reckless foreign interference under laws introduced in 2018. In November 2021, while he was living in Shanghai, an account using the name Vera Su offered him part-time work with a firm called Nesa Consulting, advising on trade between China and Australia.

The prosecution case was that Csergo then met two people known to him as Ken and Evelyn, prepared reports and received cash payments. He was convicted in March and last month was sentenced to three years and six months in jail. The court heard he did not disclose any confidential information and that his reports were compiled from publicly available material. The AFP obtained the LinkedIn records during its investigation, which is how the wider targeting came to light.

A fake security firm run by “retired Australian police”

A follow-up ABC report described another persona that claimed to represent Data 31, a Shanghai-based security consultancy supposedly organised by three retired Australian police officers. The account contacted at least seven Australians in 2020, and a related WeChat account was used to approach dozens more. The LinkedIn accounts were deregistered last year after the AFP investigation.

Experts warn of a fundamental shift in tradecraft

Chinese intelligence expert Nicholas Eftimiades described the approach as a fundamental shift. He said growing artificial intelligence capabilities may be making mass outreach cheaper and safer for operatives, who can now contact hundreds of thousands of people at a time.

Former US federal prosecutor Vikas Didwania, who has run Chinese intelligence cases, called LinkedIn a goldmine for intelligence gathering because people publicly post details about their roles and security clearances. He said the information gained from a recruit may not be classified or even useful at first, but can form part of a longer process in which a source is pushed to give a little more each time.

In June, the Five Eyes alliance issued a rare joint warning about Chinese intelligence using online job platforms for recruitment. ASIO, asked about the alleged operation, said it does not comment on or confirm investigations. Didwania also cautioned that counter-espionage efforts must avoid a chilling effect on legitimate collaboration, which can be hard to tell apart from recruitment.

How to protect yourself from fake recruiters and consultancy offers

You do not need a security clearance to be a target. These steps reflect the warning signs described in the reporting and standard online safety advice:

• Verify the sender: Check that the organisation, its staff and its website exist independently of LinkedIn. Be wary of think tanks or firms with a thin online footprint.
• Question unusual offers: Pay well above the market rate for simple reports or advice is a red flag, especially from someone you have never met.
• Protect workplace information: Know your employer’s security rules and any obligations tied to a security clearance.
• Be careful when chats move off-platform: Several targets were encouraged to continue on WeChat, by phone or in person.
• Review your profile: Limit details about projects, clearances and access that a stranger could use to profile you.
• Report suspicious approaches: Tell your employer’s security team and the National Security Hotline on 1800 123 400.

For related advice on fake job offers, see our earlier report on recruitment scammers targeting Australian jobseekers on LinkedIn.

Why it matters in Western Australia

The ABC’s findings centred on federal and state government and trade bodies, but the tactics apply to any professional with specialist knowledge. That includes people in Western Australia’s resources, defence and research sectors, where connections to government and industry are valuable and often visible on professional profiles.

Frequently asked questions

Who is accused of running the LinkedIn accounts?

The AFP alleges the accounts were operated by China’s Ministry of State Security. The Chinese embassy denies this and calls the claims groundless. No one connected to the accounts has been named as charged.

Did Steven Miles do anything wrong?

No wrongdoing is alleged in the ABC’s reporting. It says a connection does not establish that he received an offer or provided information, and it understands he did not respond to any message.

Is all outreach from think tanks suspicious?

No. Most professional outreach is legitimate. The advice is simply to verify who is contacting you, especially when the offer is unsolicited, unusually generous or asks for access to sensitive networks.

Image: Canley / Wikimedia Commons / CC BY-SA 3.0 (cropped and resized)