TL;DR: LinkedIn makes it really easy for Chinese spy agencies to identify suitable targets at companies or government orgs of interest and contact them innocuously in the form of recruiters. While this much is by design, a LinkedIn profile also often has enough information to let them deduce that a person's career is not going well or they're in financial trouble, making them particularly susceptible to bribery or blackmail:
> For example, Kevin Mallory, a former CIA officer,
was sentenced to 20 years in prison for handing over
secret documents and confidential information to Chinese intelligence. His career was floundering and he
was in dire financial straits when he received a message from a fake account on LinkedIn in 2017. This fake
contact claimed to be working for a think tank that
was looking for foreign policy expertise. The targeted
ex-CIA officer travelled to China twice and was given
money and equipment to maintain his communications with the Chinese.
One point not raised by the article is that two can play at this game: LinkedIn is allowed to operate in China and has some 41 million users, and there's a local unicorn called Maimai (脉脉) that's increasingly popular as well.
You don't have to work a "sensitive job" to be a target.
If you are a system admin / in security, leadership role, being on linkedin exposes you. I work in the payment industry and every so often I get the weirdest invites. I simply refuse to accept anyone I don't personally know and I have my profile locked down.
Why would you have a real
linkedin account if worked
at such a sensitive job.
Perhaps he made it to apply for one of the 194 jobs the CIA currently advertises on LinkedIn [1] for jobs like "Cyber Threat Analyst", "Polygraph Examiner", and "Targeting Officer" or to connect with the 1,110 other CIA employees LinkedIn lists.
I once had a Field Security Officer who identified themselves as such on their Linkedin profile. Boggles the mind why they did it. Another past FSO always lied to people and told them she was a secretary.
> Want to know all the code names for America's massive intelligence gathering programs? Just browse through the "intelligence analysts" who post their resumes on the public career networking site LinkedIn.
If another country can use LinkedIn to identify targets... so can the local target's country. They can identify weak points, address them.
Also it occurs to me China's social credit system would do the same, both ways.
It might even make it easier to setup a double agent who is so tempting based on their profile the other country is sure to contact them and work with them.
LinkedIn is one of the many sources used in OSINT [1] in red teaming. Comes as no surprise intelligence agencies also use it, and it comes as no surprise that US intelligence agencies use data from US companies.
Got an invite from a fake account claiming to be a professor at my alma mater. The name only exists on LinkedIn and has currently a handful of connections. I reported the account, but it remains up as of today. I do not have a public account.
Made me paranoid enough to stop accepting invites (~1000+ pending) and drop all usage of LinkedIn. Very discomforting to know you are a target. LinkedIn will have to visibly move on this for me to change my outlook and regain trust.
13 comments
[ 2.5 ms ] story [ 33.8 ms ] thread> For example, Kevin Mallory, a former CIA officer, was sentenced to 20 years in prison for handing over secret documents and confidential information to Chinese intelligence. His career was floundering and he was in dire financial straits when he received a message from a fake account on LinkedIn in 2017. This fake contact claimed to be working for a think tank that was looking for foreign policy expertise. The targeted ex-CIA officer travelled to China twice and was given money and equipment to maintain his communications with the Chinese.
One point not raised by the article is that two can play at this game: LinkedIn is allowed to operate in China and has some 41 million users, and there's a local unicorn called Maimai (脉脉) that's increasingly popular as well.
Let me guess, it's a shameless local clone that gives all user information to Chinese military intelligence?
Does it resemble LinkedIn to you?
As Bob Howard says in the laundry files HE and MO have a fake FB profile.
[1] https://www.linkedin.com/jobs/search?locationId=OTHERS%2Ewor...
> Want to know all the code names for America's massive intelligence gathering programs? Just browse through the "intelligence analysts" who post their resumes on the public career networking site LinkedIn.
Also it occurs to me China's social credit system would do the same, both ways.
It might even make it easier to setup a double agent who is so tempting based on their profile the other country is sure to contact them and work with them.
[1] https://en.wikipedia.org/wiki/Open-source_intelligence
Made me paranoid enough to stop accepting invites (~1000+ pending) and drop all usage of LinkedIn. Very discomforting to know you are a target. LinkedIn will have to visibly move on this for me to change my outlook and regain trust.