SEOUL — Allegations that a former Chinese People's Liberation Army officer carried out repeated signals intelligence operations targeting key U.S. and South Korean military bases are putting renewed pressure on Seoul's counterintelligence system and exposing potential weaknesses in intelligence-sharing networks between the allies.
Indictment records submitted to the National Assembly show that the former PLA lieutenant colonel, who spent four decades in signals intelligence units, allegedly located and intercepted communications near strategic installations 13 times between March 2024 and August 2026. Seven of the covert surveillance operations coincided directly with high-profile bilateral or trilateral exercises, including Ulchi Freedom Shield, Freedom Shield, Freedom Flag and Freedom Edge, the trilateral drill involving Japan. The repeated targeting of strategic hubs — particularly Kunsan Air Base, to the U.S. Air Force's 8th Fighter Wing — has raised concerns in Seoul and Washington over the possible exposure of operational plans and tactical data.
Surveillance timelines, signal targets and the "mosaic" threat
The alleged espionage points to a systematic effort to monitor allied force deployments and military readiness along the West Sea corridor.
Kunsan Air Base — the U.S. military airfield in South Korea closest to China and Taiwan — was targeted seven times in the 13 identified eavesdropping operations. Other surveillance sites included Busan Naval Base during trilateral naval maneuvers involving the aircraft carrier USS Theodore Roosevelt, and Camp Humphreys in Pyeongtaek, to the Combined Forces Command and U.S. Forces Korea:
Interception of exercise communications: The surveillance operations coincided directly with live maneuvers simulating responses to regional security threats, potentially allowing the collection of real-time flight telemetry and operational logistics data.
Leaked after-action materials: Co-defendants linked to the operations allegedly obtained and transmitted after-action review (AAR) files from Ulchi Freedom Shield exercises. The files contained wartime operational plans, assessments of unit vulnerabilities and tactical flight footage of attack helicopters.
The risk of a "mosaic": Intelligence analysts warn that combining operational data that appears unclassified or insignificant in isolation can enable foreign intelligence services to reconstruct sophisticated, highly classified operational frameworks.
"Even if individual pieces of intercepted communications appear non-sensitive on their own, foreign intelligence services utilize the mosaic theory to piece together full wartime operational plans," said Yang Uk, a research fellow at the Asan Institute for Policy Studies. "Allowing signals intelligence breaches during major combined exercises directly threatens allied force protection and operational security."
Legal loopholes and trust in alliance intelligence sharing
The case has exposed major legal and structural challenges in South Korea's domestic counterintelligence system, prompting concern among U.S. security officials.
Because the suspect was indicted before recent amendments to the Criminal Act formally took effect, expanding the definition of espionage to cover foreign nationals spying on behalf of countries that are not formally considered enemies, prosecutors were limited to bringing lesser charges related to benefiting foreign entities. At the same time, U.S. defense officials have signaled growing concern over South Korea's counterintelligence standards, warning that unresolved security gaps could lead Washington to restrict sensitive intelligence-sharing channels related to contingencies in the region.
Operational steps to strengthen counterintelligence and base security
To counter sophisticated foreign signals intelligence operations and protect joint military infrastructure, security agencies and defense intelligence commands are implementing four core measures:
First, military counterintelligence units establish expanded physical and electronic security perimeters around strategic military installations, deploying mobile signal-jamming networks and spectrum-monitoring teams during joint exercises. Second, domestic intelligence agencies coordinate real-time threat-sharing channels with allied counterintelligence agencies and standardize vetting procedures for foreign nationals operating near sensitive defense zones. Third, legislative liaison committees accelerate reviews of the law to modernize anti-espionage provisions and ensure clear legal grounds for prosecuting foreign military intelligence operatives. Fourth, base operations commands enforce strict communications security (COMSEC) protocols, requiring encrypted communications channels and multilayered data verification across all operational units.
Protecting national security and alliance credibility
The disclosure of alleged Chinese signals intelligence operations targeting combined U.S.-South Korea exercises represents a critical test for South Korea's national security leadership.
As Seoul moves to reform its espionage laws and restore full counterintelligence capabilities, closing security loopholes remains an urgent operational priority. By strengthening base defenses, tightening legal protections and deepening intelligence coordination with Washington, South Korea aims to preserve the integrity of its counterintelligence system and maintain the operational readiness of the alliance.
Originally published on kr.ibtimes.com
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
