US-South Korea military intelligence — China Spies Target Allied Drills

A former Chinese People’s Liberation Army (PLA) officer targeted communications at major military bases housing U.S. and South Korean troops, specifically focusing on periods of joint exercises, according to investigative findings. As successive Chinese espionage activities in South Korea come to light, strains have emerged in intelligence cooperation between Seoul and Washington, prompting experts to emphasize the critical need for enhanced counterintelligence operations against China.

According to an indictment submitted by the office of People Power Party lawmaker Kim Min-jeon to the Ministry of Justice on Oct. 20, a 64-year-old former PLA lieutenant colonel named A, who served 40 years in the PLA’s interception unit under the Technical Staff Department, intercepted military communications across 13 occasions between March 2024 and August 2028. Among these, seven instances coincided with major South Korea-U.S. and trilateral South Korea-U.S.-Japan joint exercises, such as Ulchi Freedom Shield.

Experts Warn of After-Action Report Leaks

The first interception activity by A took place between March 12 and 14, 2024, at a hotel near Gunsan Air Base, which hosts the South Korean Air Force’s 38th Fighter Group and the U.S. 8th Fighter Wing. This period overlapped with the 2024 Freedom Shield exercise (March 4–14), held to counter North Korean nuclear and missile threats. The exercises involved cruise missile detection and strike drills, air assaults, air-to-air shooting, air-to-ground bombing, and combined wing training.

A few months later, on June 29, 2024, A visited a hotel near the Busan Naval Operations Base, home to U.S. Naval Forces Korea. This coincided with the inaugural trilateral Freedom Edge exercise (June 27–29), which involved the U.S. aircraft carrier Theodore Roosevelt, South Korea’s Aegis destroyer ROKS Seoae Ryu Seong-ryong, and Japan’s Maritime Self-Defense Force helicopter carrier JS Ise. The exercise featured maritime missile defense, anti-submarine warfare, and air defense training aimed at countering threats beyond North Korea.

Between August 24 and 27, 2025, A conducted interception activities at a hotel near Camp Humphreys, which houses the ROK-U.S. Combined Forces Command and the U.S. 8th Army. This also overlapped with the Ulchi Freedom Shield exercise held from August 18 to 28 that year, one of the largest combined military exercises simulating an all-out war scenario involving U.S. mainland troops.

A also targeted other key joint training periods, including March 11–12, 2025 (during Freedom Shield), Oct. 28–Nov. 2, 2025 (during Freedom Flag), March 9–12, 2025 (during Freedom Shield), and April 18–22, 2026 (during Freedom Flag).

Investigators noted that Gunsan Air Base, located closest to China and Taiwan, was targeted most frequently, accounting for 7 of the 13 operations. Police and prosecutors indicted A last month, stating that such surveillance activities allow malicious actors to infer sensitive military secrets, including flight operation details and aerial reconnaissance plans.

Spike in Espionage Strains Intelligence Ties

As China’s domestic espionage activities continue to surface, experts urge the reinforcement of counterintelligence measures to preserve the ROK-U.S. alliance and intel-sharing capabilities. In a report issued in August last year, the U.S. National Counterintelligence and Security Center (NCSC) revealed that the PLA had set up front companies in South Korea to recruit American semiconductor experts. Furthermore, a senior U.S. administration official warned on Oct. 9 that Washington expects Seoul to uphold decades-old alliance standards regarding intelligence and counterintelligence. Currently, the U.S. has reportedly restricted sharing certain North Korea-related intelligence with South Korea.

Kang Jun-young, a professor at Hankuk University of Foreign Studies, stated, “Even outside of direct U.S. demands, South Korea must strengthen domestic counterintelligence for its own national interest and security. The government must first establish clear principles regarding Chinese intelligence gathering and tech theft to consolidate remaining counterintelligence functions following the disbandment of the Defense Counterintelligence Command, while refining related legal frameworks.” A was prosecuted only under general treason charges because a revised criminal act penalizing espionage on behalf of foreign entities was only implemented last month.

Yoon Sang-yong, a professor of military science at Seokyeong University, expressed concern: “While China’s espionage activities appear primarily aimed at checking the U.S., the ultimate destination of the leaked information remains unknown, which means South Korea’s vulnerability to North Korean threats has effectively increased.” Regarding another individual indicted alongside A who acquired and leaked After-Action Review (AAR) data from Ulchi Freedom Shield, Yoon warned, “AAR files contain operational plans for full-scale war scenarios as well as unit vulnerabilities. Footage of Apache helicopter takeoffs and landings leaked alongside them could also expose mounted weapons and firing ranges.”

Yang Uk, a research fellow at the Asan Institute for Policy Studies, emphasized, “Even if individual pieces of gathered information seem insignificant, we must view these espionage activities strictly through the lens of the ‘mosaic theory,’ where combining small details reveals critical military secrets.”