Update on China’s Military Cyber Force Headquarters

The Network Systems Department (NSD) of the People’s Liberation Army (PLA) Strategic Support Force, created in December 2015, appears to be the entity where military cyber operations are now based. It is a challenging collection target and many aspects of this PLA organization are still unknown.

The NSD is very rarely mentioned in open sources by its actual name. Instead, new data confirms that it uses the cover designator “32069 Unit.” Using this as a search term, some new information was discovered, including confirmation of its location in a neighborhood called Xianghongqi in northwest Beijing, plus some associated phone numbers and academic journal articles. Open-source information has also identified that the NSD Commander, Zheng Junjie, has been promoted to the rank of lieutenant general. This suggests the importance of the cyber mission within the PLA structure.

Ground-level imagery from 2017 was also discovered that shows the newly-built probable NSD Headquarters building (see Figure 1) in the Xianghongqi compound. This building was externally complete in 2014 and, based on the parking of cars in front of the building, occupancy appears to have started in early 2016.

BACKGROUND

Evidence collected from open sources over the past two years has indicated that the PLA’s cyber operations forces, formerly part of the General Staff Third Department, moved into a new structure, the Network Systems Department of the PLA Strategic Support Force, as part of Xi Jinping’s December 2015 military reorganization. However, besides identifying the new name, the headquarters location, and command personnel, details on this new and potentially powerful component remain elusive. The name itself (战略支援部队网络系统部) rarely appears in Chinese open sources, despite the fact that its generic nature is itself a form of cover. There is a Chinese-language Wikipedia page for this entity that ties it to the former Third Department, but this information is not authoritative and says little about the entity’s nature in its current form. Most other online appearances of the name are repeats of or quotes from the Wikipedia entry.

Traditionally, Chinese military units are not discussed in the open by real name but are usually referred to by their military unit cover designator (MUCD), a five-digit number intended to mask the true identity and function. Evidence has accumulated that the NSD is using the cover designator “32069 Unit,” a designator that did not exist prior to the Xi Jinping reorganization. Searches on the designator have provided the most information on the NSD, but even that source type has been very limited. This report provides an update on what new information has been found about the NSD. In most cases, the data gives us more about the Headquarters but not about the organization’s structure or operations.

CONFIRMATION OF COVER DESIGNATOR

Recent information has confirmed earlier assessments that the NSD uses a new military unit cover designator “PLA 32069 Unit.” Prior to the formation of the Strategic Support Force at the end of 2015, the PLA Third Department had used the cover designator PLA 61195 Unit.[1] [2] Several instances have been found that connect the 61195 Unit designator to the new 32069 Unit designator.[3] [4] The latest example is an October 2018 legal document posted online for an apparent lease agreement executed by the NSD, which stated that the 61195 Unit had concluded the original lease but that entity was now known as the 32069 Unit (see Figure 2, below).[5]

NSD HEADQUARTERS LOCATION

Very little descriptive information was found online for the 32069 Unit designator. However, using the designator as a search term, a number of sources were discovered that identify that unit with addresses previously used by the PLA Third Department Headquarters in Beijing. Many of the sources were contract documents or announcements of contract bid selections. In Figure 3 below, one such announcement identified the 32069 Unit address as “No. 1 Xianghongqi Road A, Haidian District, Beijing.”

Another 32069 Unit contract announcement, also from Nov 2017, used the address “Zone A, No. 1 Yiguangsi Road, Haidian District, Beijing” (see Figure 4 below).[6]

Another postings using either the Xianghongqi or the Yiguangsi address have been associated with this headquarters, including one that used both terms in the address.[7] These addresses point to a neighborhood in northwest Beijing just outside of the North Fifth Ring Road (see Figure 5 below). Different Chinese maps label the sections of this neighborhood in different ways, but it appears that these addresses both point to the large compound in Xianghongqi that was the former headquarters for the PLA Third Department.[8] This compound is bounded on the east side by Xianghongqi Road A.

While the Third Department was housed here in older buildings, a large new structure was built between about 2010 and 2014 in the southeast quadrant of this facility. Based on the timing of the construction of this building and its size, it appears to be a good candidate for the Headquarters of the newly formed Network Systems Department. Satellite imagery of this building from 2017 appears in Figure 6 below. The appearance of a full parking lot in front of the building indicates it is occupied and working. Although the building appeared externally complete in 2014, cars only started appearing in this parking lot in early 2016, indicating that occupancy of the building started at about that time.

Ground-level imagery was recently discovered that shows some details of this building. Figure 7 is an image from the street in front of the building, taken in June 2017. Figure 8 is an image from March 2014 that shows the façade in better detail. The exterior was nearly complete at that time, although the image shows some sections facing at the base of the columns in front of the entrance where the facings were not yet finished.

COMMANDER

Zheng Junjie, previously identified as the NSD Commander, was identified in several postings in 2017 and 2018 indicating he still held that position. At some point over the past 16 months, he was promoted from major general to lieutenant general. A March 2018 notice on representatives to the National People’s Congress (see Figure 10) disclosed his promotion but not his position, saying only that he was the former head of the PLA Information Engineering University.[9] This posting included his photo in uniform, wearing the rank of lieutenant general.

However, a September 2017 announcement of general-officer promotions also listed him as promoted to lieutenant general and gave him the titles of Deputy Commander of the Strategic Support Force and concurrently Commander of the Network Systems Department (see Figure 11). This promotion appears to have been given to Zheng Junjie in these positions. No announcement has been found indicating a move to another post as a result of the promotion. Instead, it appears that his promotion in place reflects the importance of this cyber entity in the PLA structure.

OTHER SENIOR PERSONNEL

Online data identified a few other senior officers as staff personnel in the 32069 Unit, including Maj Gen Li Baocheng and Huang Weiqing. The list of known personnel now includes the following (dates of information below in parentheses):

Lt Gen Zheng Junjie (郑俊杰), Network Systems Department Commander (2018)[10]
Lt Gen Chai Shaoliang (柴绍良), Network Systems Department Political Commissar (2016)[11]
Maj Gen Li Baocheng (李保成), Chief of 32069 Unit Logistics Department (2018).[12] [13]
Maj Gen Zeng Dingbo (曾定波), 32069 Unit Political Committee Deputy Secretary (2017)[14]
Tan Lianxing (谭连兴), 32069 Unit Political Work Department Chief (2018)[15]
Sun Feiyu (孙飞宇), 32069 Unit Political Department Cadre Section (2017)[16]
Li Jia (李嘉), 32069 Unit Research Institute Youth League Secretary (2017)[17]
Huang Weiqing (黄伟清), 32069 Unit Headquarters Work Office Deputy Office Chief (2018).[18]
Zhu Xiaowei (朱小伟), 32069 Unit Nanjing Representative Office (2017)[19]
Han Yue (韩跃), 32069 Unit (2017)[20]
Peng Sheqiang (彭设强), 32069 Unit (2017).[21]

ARTICLES

Information on the nature of an organization can sometimes be gleaned from the academic papers written by personnel from that unit. A very limited set of journal articles that claimed to be from 32069 Unit personnel were found online. The following are all the articles found from the past two years with authors in the 32069 Unit:

Research on a Jamming Rejection Method Based on Range Error Coefficient, Zhu Xiaowei (朱小伟), 32069 Unit Nanjing Military Representative Office, 2017.[22]

Research on Comparison of Logistics Safeguards Models for China-U.S. Naval Broad-Ocean Escort Operations, Han Yue (韩跃), 32069 Unit, 2017.[23]

Application of Process Methods in Management Outsourcing for Some Large-Scale Complex-Structure Systems, Wang Shunxi (王顺喜), 32069 Unit Nanjing Representative's Office, Nanjing, Jiangsu Province, 210000, 2017.[24]

Moving Target Angular Tracking FPGA Real-Time Processing Algorithm Based on Karman Wave Filtering, Si Chencheng (司晨诚), 32069 Unit, 2018.[25]

Structure Design for a Type of Airborne Logarithmic Periodic Antenna, Wang Jingyan (王景琰), PLA 32069 Unit Tianjin Military Representative Office, 2018.[26]

Design and Implementation of an Integrated Information Processing Platform, Wang Jingyan (王景琰), PLA 32069 Unit Tianjin Military Representative Office, 2018.[27]

Design and Implementation of a Time-Frequency Transfer System Based on Radio-Frequency Photon Technology, Lin Gang (林岗), PLA 32069 Unit Guangzhou Military Representative Office, 2018.[28]

These articles indicate two things. First, the topics of some of these articles seem to be focused on electronic warfare rather than network warfare. This suggests that personnel have been prevented from publishing articles on cyber operations in open-source journals. Second, several of the units were identified as “Representative Offices” in other cities. The significance of this designation is not clear. The cities named are not necessarily for PLA Theater Command Headquarters—Tianjin is not the headquarters for the Central Theater Command in which it is located. How this fits into the current structure of the NSD is unknown?

ACQUISITION

Another possible source of information on a unit’s character is the collection of reporting posted on purchases made by the unit. In the case of the NSD, one posting on the All-Army Weaponry Purchase Information Network from October 2018 stated that the 32069 Unit Equipment Department had posted 26 purchase requirement items, of which 19 were “public” and 7 were “Top Secret” (公开19，机密7).[29] Another posting on this network from November 2018 gave some of the classified purchase item names, as follows:

32069 Unit Batch Purchase Announcement for Network Security Equipment (Top Secret)
32069 Unit Purchase Announcement for Network Resources Monitoring System and Nine Other Products (Top Secret)
32069 Unit Purchase Announcement Letter for Acquisition Analysis System (Secret)
32069 Unit Purchase Announcement for Computing Memory Resources Super Fusion System (Secret)
32069 Unit Purchase Announcement Letter for Speech Intelligent Translation Platform (Japanese, Korean) (Secret)[30]

The generic nature of these item names limits their utility for analysis, but the announcements nevertheless highlight that there is classified work being done in this organization.

CONCLUSIONS

There is a long list of questions about the NSD that are not being answered by information from open sources. These would include:

If the NSD (as indicated by its name) runs PLA cyber operations, what organization conducts the signals intelligence collection operation that was the original mission of the PLA General Staff Third Department?
Was the cyber attack mission, believed to have been developed in the General Staff Fourth Department (Electronic Warfare and Radar Department), been integrated into the NSD? If so, what organization is now responsible for electronic warfare and radar operations?
What is the relationship between the NSD and the Technical Reconnaissance Bureaus (TRB’s) where cyber forces were initially created and cyber collection operations were conducted? Are these elements still co-located with the TRB’s, where signals collection is still the primary mission?

This paucity of information may reflect the leadership of Xi Jinping, who has tightened controls on Internet use across the board. A more restrictive regime of what kinds of military information can be shared in open sources may have been put in place in the last few years. The NSD may have issued guidance to its own personnel prohibiting references to the organization. In any event, while open-source collection has proven useful in identifying cyber organizations and personnel in the past, the NSD has been a challenging collection target ever since it was formed in late 2015.

Contact the Wapack Labs for more information: 603-606-1246, or feedback@wapacklabs.com

Prepared: Silkworm
Reviewed: B. Schenkelberg
Approved: J. Stutzman

[1] yz.chsi.com.cn/sch/schoolInfo--schId-368175.dhtml.

[2] xhgg1969.blog.163.com/blog/static/200655310201311884117543.

[3] www.bidcenter.com.cn/newscontent-36678019-4.html.

[4] www.bangshu.org/Ch/NewsView.Asp%3FID%3D149.

[5] q.stock.sohu.com/newpdf/201833460342.pdf.

[6] www.zgcrd.org.cn/detail/index/id/77/aid/661.html.

[7] mzj.bjhd.gov.cn/handy/201401/P020140105517327507149.xls.

[8] See Wapack Labs IR: China’s Military Cyber Force Headquarters Located, 26 Oct 2017,

for more details on the identification of this compound as the Network Systems Department

Headquarters.