Alleged Chinese spy posed as recruiter for 'retired Australian police'

In short:

A suspected Chinese spying network used a fictitious security firm, purportedly organised by three retired policemen, to target Australians and encourage them to share information.

ABC contacted the individuals in Shanghai whose phones had been used to target those Australians.

ASIO has openly warned about the threat of Chinese espionage online.

Towards the start of COVID in May 2020, Australian lawyer Henry* received a casual offer on LinkedIn.

"We are looking for Security expert consultant employment from Australia and Canada (part-time)," wrote someone using the name "Sophy".

The account claimed to represent Data 31, a security consultancy "organised by three retired Australian police officers" based in Shanghai.

A US-qualified lawyer with extensive experience in China, Henry's practice had covered white-collar defence and investigations. He had also served in the Australian Army for nearly two decades, leaving with the rank of major.

But the consultancy pitch was part of something wider.

An ABC investigation has now identified that "Sophy" was one of several personas used by an alleged Chinese spying network that targeted thousands of people worldwide between 2016 to 2025, including for fictional companies like Data 31.

The LinkedIn accounts, allegedly operated by the Chinese intelligence service, were deregistered last year following an investigation by the Australian Federal Police into businessman Alexander Csergo.

Those approached by the alleged spies included government officials, former military personnel and security professionals linked to Australia, the United States, the United Kingdom, Canada and New Zealand — the nations of the Five Eyes intelligence alliance.

A persona targeting Australians

At least seven Australians were contacted by the account in 2020 under the Data 31 identity.

The contacts included people with Australian military backgrounds, a freelance writer and podcaster, a lawyer, a security executive, and Australian trade department representatives.

Among those approached was an employee of an organisation belonging to Andrew Forrest, one of Australia's wealthiest and most influential businessmen. The mining magnate's success has been closely tied to China's demand for Australian iron ore.

In a message to an Australian security executive, the account claimed Data 31 was seeking consultants to conduct "active investigations" and write "security reports" to "assist banks, data companies and venture capital institutions in Shanghai".

The proposed reports covered international relations, economics and counter-terrorism.

The ABC reached out to Henry for comment but did not receive a response.

Mr Forrest was also contacted for comment but the ABC did not receive a direct response to its questions.

ABC has seen no evidence that any of the Australians had accepted the offers to write reports.

The accounts have a LinkedIn message history spanning over eight years.

One persona, "Vera Su", featured in the Australian Federal Police investigation and subsequent prosecution of businessman Alexander Csergo, who in March became the first person convicted of reckless foreign interference under Australia's 2018 national security laws.

He is serving a three-and-a-half-year prison sentence.

The Chinese Embassy in Canberra rejected the AFP's claims as "entirely groundless".

Over the past few weeks, the ABC has reviewed thousands of messages from two LinkedIn accounts linked to the alleged Chinese spying operation.

One of the accounts was active as early as 2016. Over the following years, they connected with thousands of users, including Australians and people who had worked in Australia.

The accounts claimed a range of affiliations over time, including a Chinese government tourism project, an electronics company, an EV brand, Data 31 and two other fictitious Chinese think tanks. They also used several identities, including "Sophy Ding", "Hanna Lee" and "Vera Su".

Between April and July 2020, the account repeatedly messaged potential Australian targets on behalf of Data 31, which was said to run by "three retired Australian policemen". The ABC could not identify a genuine organisation by that name.

The LinkedIn records do not show any of these contacts completing consultancy work, although some agreed to continue the conversation.

By March 2021, a second account linked to the first was using the name "Vera Su" and claiming to represent Nesa Consulting. It was through this persona that Csergo was approached.

Who is behind the accounts?

Between 2016 to 2025, more than 60 Australians, including around 20 government officials, were targeted.

They include a commander with the AFP, a former system analyst with the Royal Australian Air Force, a deputy CEO and senior commissioners of the Australian Trade and Investment Commission, and public servants from state governments around the country.

Other people approached came from a wide range of fields, including corporate law, business consulting, economic advice, research, academia, sales, marketing and senior management.

The ABC understands Australian authorities have contacted some of the individuals who were approached to assess whether any classified information was compromised.

The real identities of those behind the accounts were not established during Csergo's trial.

During the trial, an intelligence expert described how operatives conceal their identities through intermediaries known as "cut-outs" and commercial or academic cover.

Nesa Consulting had the hallmarks of such a front. Some of its marketing materials had been plagiarised from NERA Economic Consulting, a real firm, and the AFP could not locate a website or confirm an address for it.

The ABC has since obtained voice and text messages linked to the alleged agents. It has also investigated the addresses, emails and phone numbers connected to them, tracing them to one woman and a man based in Shanghai.

The same number is connected to a WeChat account, which she used to connect with her targets off LinkedIn. The account remains active and carries the same name — Ding Chenqi Sophy.

Chinese government records obtained by the ABC show Ms Ding worked for a Shanghai-based IT company Shanghai Geguan Internet while she was in contact with her targets, including Csergo. The ABC could not find any public record of the company.

The number used by "Ken" is linked to a man in his early 50s, Xu Gefeng, who is associated with another IT company, registered in 2005.

The ABC contacted Ms Ding by phone, but she did not answer. Mr Xu answered his phone but hung up after ABC journalists identified themselves. Mr Xu's phone could not be reached afterward.

ASIO warnings

The threat posed by Chinese intelligence has been a recurring theme for ASIO Director-General Mike Burgess.

In ASIO's 2024 Annual Threat Assessment, the director-general described an espionage operation by the "A-Team", which adopted the name "Sophy" and others, and claimed to represent fictional companies such as Data 31.

In the organisation's 2026 Annual Threat Assessment, he revealed that a foreign spy had approached an Australian security clearance holder online, posing as a consultant.

"The spy paid the official to write two reports on Australia's relationship with our Pacific neighbours, and then, thinking he'd been hooked, offered money for inside information on AUKUS," Mr Burgess said.

The official grew suspicious and reported the contact to ASIO.

"My officers borrowed the phone from the official and rang the so-called consultant in her home country. Thinking it was her target, the spy picked up and got a very unwelcome surprise when she realised she was speaking to ASIO," he said.

"We demonstrated we knew exactly who she was, demanded she cease targeting Australian citizens.

"The spy hung up. Message received."

*Not his real name.