Chinese-Made CCTV Systems, Surveillance of Military Facilities, Drone Cloud Data, and Security Gaps
By Jean Cummings
Co-Editor, The Korea Signal
Chinese-made CCTV systems can no longer be treated simply as inexpensive surveillance equipment. Security vulnerabilities that allow external intrusion and remote access have repeatedly been identified in Chinese surveillance equipment, including Hikvision products, and some of those vulnerabilities have been exploited in actual attacks. The United States has formally warned that when such equipment is installed in government facilities and critical infrastructure, China could use it to surveil Americans or threaten communications networks. The United Kingdom has also begun removing Chinese-made CCTV systems from sensitive government facilities because of concerns that they could be hacked and used for remote surveillance. Canada went further, ordering Hikvision Canada to cease operations following a national security review. Chinese surveillance equipment inside government and military facilities is no longer being treated as an ordinary procurement issue.
This report examines how Chinese-made CCTV systems entered South Korean military bases and major public facilities, while also examining how exposed U.S. and South Korean military facilities have become as Chinese nationals repeatedly photograph and surveil military installations.
The previous three reports in this series examined the channels through which China could gain access to South Korea’s semiconductor personnel and manufacturing technology, telecommunications networks, government computer systems, and research institutions. This report examines how those vulnerabilities are now appearing in physical locations, including military bases and major public facilities.
The South Korean military installed Chinese-made CCTV systems at military bases before belatedly removing approximately 1,300 cameras. Subsequent investigations found that Chinese CCTV systems disguised as South Korean products had entered not only the military but also police facilities, ports, highways, airports, local governments, and public institutions.
At the same time, cases involving Chinese nationals repeatedly photographing and surveilling South Korean military installations and other critical national facilities have continued to emerge.
Chinese CCTV Disguised as Korean Products Did Not Enter Military Bases Alone
In July 2024, South Korean intelligence and military authorities conducted a joint inspection of equipment supplied to the military. The investigation revealed that approximately 1,300 CCTV cameras installed at frontline units and other military facilities were Chinese-made. The military had been using the cameras believing they were South Korean products, but investigators determined that the systems had been designed in a way that could allow recorded video to connect to a specific server in China and potentially be transmitted outside the military network. Although no actual data leakage was confirmed, the military decided to remove all of the equipment and replace it with South Korean products.
The problem was that Chinese CCTV systems disguised as South Korean products had not entered military bases alone. In 2024, an analysis by the office of National Assembly member Park Chung-kwon, based on three years of data submitted by the Korea Communications Commission and other agencies, found that approximately 30,000 Chinese-made CCTV cameras had been supplied to government agencies and the public sector while being represented as South Korean products. The disclosed figures included 4,095 cameras at the Korea Land and Housing Corporation, 590 at the Korean National Police Agency, 358 at port authorities, 348 at the Korea Expressway Corporation, and 320 at Incheon International Airport Corporation. Another 14,495 cameras had been installed across 79 local governments. Similar equipment was also found at the Korea Atomic Energy Research Institute and the Institute for Basic Science, including models manufactured by China’s Dahua.
According to information disclosed by the Seoul Metropolitan Council in 2024, Seoul City, its affiliated agencies, and district governments had installed 3,658 Chinese-made CCTV cameras, 1,222 of which had already exceeded their seven-year service life. Chinese equipment was also installed at schools, hospitals, childcare centers, and other facilities. A separate investigation found CCTV equipment manufactured by Chinese video surveillance companies subject to U.S. import restrictions being used at South Korean public institutions, including fire departments and the Korea Electrotechnology Research Institute. At the time, 261 cameras from those companies had been identified.
In March 2026, an internal investigation revealed a much larger number. The Korea Land and Housing Corporation, the state-owned company responsible for public housing construction and supply, announced that a comprehensive inspection of CCTV systems installed in rental housing had identified 10,584 Chinese-made cameras disguised as South Korean products. Investigators found 7,030 cameras at 81 public rental housing complexes and another 3,554 cameras in 354 purchased rental buildings. The cameras had been installed at entrances, underground parking garages, common entrances, playgrounds, and childcare centers.
These products had been supplied through Korea’s Public Procurement Service purchasing system. The supplier reportedly imported Chinese cameras from 2016 through 2021 and then changed their stated country of origin before supplying them. More importantly, the equipment had not only passed government procurement procedures but had also received domestic security certification. The case demonstrated that labels and certifications alone cannot reliably establish the actual country of manufacture or supply chain behind a product.
That is what makes this case important. Products bearing the names of Korean companies, purchased through Korea’s Public Procurement Service, and carrying domestic security certifications were later discovered to be Chinese-made. Because equipment supplied through the same system reached not only military bases but also police facilities, ports, highways, airports, research institutions, local governments, and public housing, a “Made in Korea” label or Korean procurement and certification record can no longer be considered sufficient evidence of the actual manufacturer or supply chain behind surveillance equipment.
Korea’s “Direct Production” Label Does Not Guarantee the Origin of Critical Components
South Korea’s public procurement system makes the problem even clearer. Under the standards for confirming the “direct production” of security cameras and video surveillance systems published by the Korea Telecommunications Industry Cooperative, a company does not have to manufacture every product used in a system itself. It may directly manufacture only one or more components among cameras, lenses, video controllers, video servers, storage systems, and other products while using raw materials, subsidiary materials, parts, and modules purchased from China to assemble the complete system.
South Korea’s Public Procurement Service has likewise explained that video surveillance systems contain approximately 30 major components, making it difficult for a single contractor to manufacture all of them directly. Outsourced processing and purchased components are therefore permitted. Korea’s “direct production” certification consequently verifies only that the supplier of the finished product meets certain production requirements. It does not establish or guarantee that critical components inside the product were not manufactured in China.
For that reason, CCTV systems that replaced Chinese equipment inside South Korean military facilities must be examined beyond the company name displayed on the finished product or a “direct production” designation. Investigators need to determine whether the video-processing SoC and network chips were manufactured by Chinese companies, whether camera modules and NVRs were produced in China, whether firmware was developed by Chinese companies, and whether update servers are located in China.
The South Korean military’s discovery in 2024 that it had been using Chinese CCTV systems under the belief that they were Korean products already demonstrated in practice that a “direct production” designation alone cannot establish the actual manufacturer or the origin of critical components inside surveillance equipment installed at military facilities.
Does TTA Security Certification Examine the Actual Supply Chain?
Because Chinese equipment has been found even among products that passed Korean procurement procedures and domestic security certification, another question must be asked: Does South Korea’s current security certification system examine only a product’s security functions, or does it also identify its actual manufacturer and supply chain?
On September 30, 2025, the Telecommunications Technology Association, or TTA, issued South Korea’s first “Security Function Verification Certificate for Video Information Processing Devices” for an IP camera. The certificate serves as a preliminary certification designed to simplify the security conformity verification process administered by the National Intelligence Service. TTA tests IP cameras, NVRs, VMS platforms, and related equipment for compliance with government security requirements. Video information processing devices became subject to security conformity verification beginning in April 2024.
The question is what the certification actually examines. Testing security functions such as login controls, access restrictions, and encryption is entirely different from tracing the actual OEM or ODM, the manufacturer of the video-processing SoC and network chips, or the source of the camera module. Whether certification requires disclosure of the firmware developer, the country in which update servers are located, and a hardware and software bill of materials determines whether the supply chain itself is actually being verified.
At LH, CCTV systems that passed procurement procedures and domestic certification were later found to be Chinese products disguised as Korean-made equipment. Unless it is established that TTA certification verifies not only security functions but also the actual manufacturer and critical-component supply chain, the existence of a domestic security certificate cannot by itself establish that a product is outside the Chinese supply chain.
Even the U.S. Department of Defense Failed to Properly Identify White-Label Equipment
This problem is not unique to South Korea’s procurement system. According to a report released by the U.S. Government Accountability Office on May 19, 2026, the Department of Defense investigated video surveillance equipment manufactured by five China-related companies identified under Section 889 beginning in 2019. The investigation found more than 300 cameras and recording devices connected to DOD IT networks. More than 40 percent were installed in secure areas containing classified information or critical facilities and were classified as high-risk equipment. When the Department expanded the investigation to subsidiaries and affiliates of those Chinese companies, as well as other manufacturers publicly identified as producing covered products, the total number of targeted surveillance devices connected to DOD IT networks increased to approximately 1,500. More than 1,000 additional China-related surveillance devices that were not connected to DOD IT networks were also discovered.
The problem did not end when the equipment was identified. In August 2025, officials from the Department of Defense’s intelligence and security organization and the Office of the Chief Information Officer told the GAO that they did not know with certainty whether those more than 1,000 non-networked devices were still in use. Defense officials said that normal equipment replacement cycles made it likely that most had been replaced, but their actual removal and current status had not been confirmed. In other words, even after China-related surveillance equipment was discovered at U.S. military facilities, the Department was unable to track the location and operational status of some of that equipment to the end.
The GAO identified white-labeling as one of the principal reasons China-related equipment is difficult to identify. When cameras and surveillance systems manufactured by Chinese companies are sold under another company’s brand, asset inventories based only on the displayed brand may fail to reveal the actual manufacturer. This was not a hypothetical vulnerability. It occurred in actual U.S. government procurement. Following a multi-agency investigation, the U.S. Treasury Department determined that the American company Aventura Technologies had sold Chinese-made surveillance equipment to U.S. government agencies and the military while falsely representing the products as made in the United States. Aventura pleaded guilty to related charges in 2024. Chinese-manufactured surveillance equipment entered U.S. government and military facilities carrying the name of an American company.
In South Korea, Chinese CCTV systems entered the military as purportedly Korean products. In the United States, Chinese surveillance equipment entered government and military facilities under other companies’ brands. Both cases demonstrate that identifying the actual manufacturer solely through the brand on the equipment and procurement records can fail.
Section 889 Provides a Basis for Examining USFK’s Korean Contracting Network
Federal Acquisition Regulation 52.204-25 regulates certain telecommunications and video surveillance equipment manufactured not only by Huawei and ZTE but also by Hytera, Hikvision, Dahua, and their subsidiaries and affiliates. Section 889(a)(1)(B), in particular, restricts federal contractors from using covered equipment even when that equipment is not directly used in performing a federal contract. The FAR explicitly states that the restriction applies regardless of whether the covered equipment is used directly in connection with federal contract work.
Applied to South Korea, this means that examining only the equipment a Korean company uses inside a U.S. military installation is not sufficient. Even if American-made equipment is used inside a U.S. military facility, the contractor’s compliance should be reviewed if Hikvision, Dahua, or other Section 889-covered equipment is being used at the company’s headquarters, warehouses, or other business locations. If the equipment carries a Korean brand, investigators should not stop at the trademark. They should identify the actual OEM.
The rules are different for subcontractors. FAR 52.204-25 requires the relevant clause to flow down to subcontracts, but the company-wide prohibition in paragraph (b)(2) does not apply to subcontractors in the same manner. However, if a prime contractor receives notice from a subcontractor at any tier that covered equipment is being used, the contractor must report that information to the U.S. government. The report must include the contract number, supplier name, brand, model number, OEM number or manufacturer part number when available, and mitigation measures. For Department of Defense contracts, those reports must be submitted through the system designated by the Department.
The Korean “direct production” structure, the scope of TTA certification, and the white-label identification failures already documented in the United States must therefore be examined together when applying Section 889 to USFK’s Korean contracting network. USFK and the Department of Defense should identify Korean contractors providing facilities management, security, construction, logistics, telecommunications, and information technology services, and then compare the brands and actual manufacturers of CCTV systems installed at those companies’ headquarters, workplaces, and logistics facilities against Korean procurement and import records. This would make it possible to determine whether equipment manufactured by Chinese companies prohibited by the United States is being used under Korean brands or other labels.
The Equipment Review Underway Through September 2026 Must Be Connected to the Investigation in South Korea
The GAO report also describes the Department of Defense’s ongoing equipment-review schedule. In December 2025, U.S. Cyber Command conducted another network review and discovered three additional Section 889-covered devices. External access was blocked and removal procedures began. The fact that prohibited equipment was again discovered years after the major 2019 review demonstrates that an earlier investigation and removal effort did not completely eliminate the problem. The Department is now using its Comply-to-Connect system to identify devices connecting to its networks and determine whether they comply with security requirements. According to the GAO, DOD components are required to achieve full operational capability for this system by September 30, 2026.
That review should not stop with equipment directly connected to USFK’s internal networks. Korean companies that manage video and logistics around U.S. military installations, Korean contractors with access to U.S. bases, and subcontractors performing logistics, construction, and telecommunications work should also have their surveillance and network equipment included in the investigation.
The Department’s equipment-identification effort scheduled through September 2026 and an investigation of supply chains in South Korea should therefore not be treated as separate issues. Even inside the United States, Chinese surveillance equipment escaped detection because of white-labeling, while the South Korean military has already discovered that it was using Chinese CCTV systems under the belief that they were Korean products. If the same identification failure occurs around USFK, it will not represent a new category of risk. It will mean that a supply-chain vulnerability already identified by both countries was never fully investigated within the Korean procurement networks connected to U.S. Forces Korea.
Chinese CCTV Systems Were Also Installed Across South Korea’s Overseas Diplomatic Missions
The Chinese CCTV problem did not stop at South Korea’s borders. An analysis of Foreign Ministry data submitted to the National Assembly’s Foreign Affairs and Unification Committee in 2022 found that among 5,339 CCTV cameras installed at 159 South Korean diplomatic missions overseas, 2,169 Chinese-made cameras were installed at 94 missions. More than half reportedly lacked security certification at the time. Chinese equipment was also identified at South Korean diplomatic facilities in the United States.
In June 2026, the South Korean Embassy in Germany issued a contract for CCTV replacement requiring both cameras and recording systems to be Korean products carrying domestic TTA certification and to have no wireless LAN capability. Yet publicly available information still does not clearly show how many of the 2,169 Chinese cameras identified in 2022 have been replaced as of 2026, or which diplomatic missions continue to use them.
A Foreign Ministry announcement that equipment has been “replaced” therefore cannot by itself establish that the problem has been resolved. The replacement status and actual manufacturers of equipment currently in use at the 94 missions where Chinese cameras were identified in 2022, particularly South Korean diplomatic missions in the United States, should be verified. Even where cameras have been replaced with Korean products, the actual OEM and manufacturers of camera modules, critical chips, and recording systems should be examined because a Korean brand and domestic certification alone cannot establish the actual supply chain.
Public CCTV Systems Outside U.S. Military Bases Present the Same Security Problem
Around Camp Humphreys, Osan Air Base, and Kunsan Air Base are public CCTV systems operated by local governments, police, and road authorities. Roads and logistics hubs used by U.S. military vehicles and personnel also fall within South Korea’s public surveillance infrastructure. The fact that Chinese CCTV systems disguised as Korean products were actually supplied to police, ports, highways, airports, and local governments demonstrates that the surveillance network outside U.S. military bases cannot be separated from this problem.
U.S. military movements and activities do not occur exclusively inside military installations. U.S. vehicles and personnel travel on public roads, military supplies pass through South Korea’s logistics networks, and aircraft and naval movements can be observed from public spaces surrounding bases. CCTV systems covering those areas are operated by South Korean local governments, police agencies, and road authorities.
The absence of Chinese CCTV systems inside a U.S. military installation therefore does not establish that the surveillance-equipment problem around USFK has been resolved. To determine the actual scope of exposure, investigators must also identify the manufacturers and operators of South Korean public CCTV systems that continuously record U.S. military movements outside the bases and determine who has access to that footage.
Chinese Hackers Have Already Stolen Footage From More Than 4,500 Korean IP Cameras
Separate from the Chinese equipment and supply-chain problem, South Korea has already experienced cases in which CCTV systems themselves were hacked from outside and footage was stolen. In late 2023, reports emerged that Chinese hackers had compromised more than 4,500 South Korean IP cameras, obtained footage, and distributed it through Telegram. The material reportedly included sensitive footage recorded inside private homes and other private locations. South Korea’s security industry and the Korea Internet & Security Agency, or KISA, also received information concerning the incident.
The case demonstrated in practice that when an attacker gains control over IP-camera credentials, firmware, or external-access settings, the attacker can gain access to the same footage viewed by the camera owner. Supply-chain verification therefore must be accompanied by a separate examination of how cameras and recording systems can be accessed and administered remotely.
CCTV systems surrounding U.S. military installations and logistics facilities should be examined to determine whether external-access functions are enabled, whether maintenance contractors retain remote-management accounts, and whether NVR and VMS systems are connected to the internet. Where Korean companies manage the equipment, investigators should determine who has been issued remote accounts, from which IP addresses those accounts have been accessed, and through which servers firmware updates and video transmissions are routed. Only then can the United States determine whether video surrounding U.S. military facilities can be accessed from outside.
A Chinese National’s Drone Also Filmed South Korea’s National Intelligence Service
In November 2024, a Chinese national in his forties was arrested after flying a drone in Naegok-dong, Seoul, and allegedly photographing the National Intelligence Service building. Investigators determined that he had also filmed the nearby NIS facility while photographing the Heonilleung royal tombs. Police concluded after an initial investigation that they had found no counterintelligence indicators and released him, although they imposed a travel ban and continued the investigation.
But this case must be examined alongside the series of incidents involving Chinese nationals photographing South Korean military facilities during the same period. Following the June 2024 drone surveillance of a U.S. aircraft carrier at the Busan Naval Base, incidents involving Chinese nationals photographing South Korean military installations, U.S. military bases, and critical national facilities continued to emerge. In an April 2025 briefing to the National Assembly Intelligence Committee, the NIS reported that 11 such cases had been identified in approximately ten months. The targets were concentrated not only around military bases but also airports, ports, and the National Intelligence Service itself.
The NIS specifically noted that the individuals operated high-performance cameras and radios from locations just outside the legal boundaries covered by the Military Bases and Installations Protection Act. Because they used such equipment from positions where they could avoid the application of domestic law, the NIS concluded that their conduct indicated an intention to circumvent Korean law and assessed the series of incidents as “low-intensity intelligence activities” designed to collect information on key South Korean and U.S. military capabilities.
The November 2024 incident involving a Chinese national photographing the NIS building therefore should not be closed solely on the basis of the police’s initial conclusion. Investigators should compare the drone model and user account, GPS flight records, metadata from the recorded files, cloud-access records, and immigration history with evidence obtained from other military-facility surveillance cases. That would allow authorities to determine whether individuals previously treated as unrelated had common contacts, equipment, accounts, or travel patterns.
Chinese Nationals Returned to the Same U.S. Air Base Just Two Days After Being Questioned and Released
On April 21, 2025, two Chinese nationals were caught photographing fighter aircraft near Osan Air Base, K-55, in Pyeongtaek. Following an eight-hour joint investigation involving the police, the National Intelligence Service, and the Defense Counterintelligence Command, authorities concluded that no counterintelligence indicators had been identified and closed the case without booking them. Yet only two days later, on April 23, the same two individuals returned to the vicinity of the same air base and again photographed fighter aircraft. This time, they were apprehended after U.S. military personnel reported them to Korean police. During the second investigation, police again concluded that photographing aircraft in flight from outside the base was insufficient to establish a violation of existing law and released them.
The fact that the two men returned to the same location immediately after the first investigation raises a security problem much larger than the narrow question of legal jurisdiction. During the first investigation, police, the NIS, and the Defense Counterintelligence Command had already obtained their identities and passport information. Yet when the same individuals returned to the same U.S. military installation two days later, the second incident was detected not through a Korean warning system but through a report from U.S. military personnel on the ground.
Had information obtained during the first incident been integrated into the USFK security system, the return of the same individuals should have triggered an entirely different level of response. If that information was not provided to U.S. forces or local police, then intelligence collected by South Korean authorities about foreign nationals surveilling military installations was not translated into actual base protection.
The central issue in this case is therefore not simply that two Chinese nationals photographed the base twice. It is that information obtained during the first encounter failed to prevent their second approach only two days later.
Former Chinese Military Personnel Were Caught Intercepting Military Communications and Approaching USFK Insiders
In May 2026, the Suwon District Court sentenced two Chinese nationals to prison for repeatedly photographing South Korean and U.S. military facilities. One defendant received an indeterminate sentence of two years with a minimum term of 18 months, while the other was sentenced to two years. It was the first case in South Korea in which foreign nationals were convicted under the Criminal Act’s general enemy-benefiting offense.
From the second half of 2024 through March 2025, the two repeatedly entered South Korea and visited four South Korean and U.S. military installations, including Suwon Air Base, Osan K-55, Camp Humphreys K-6, and Cheongju Air Base, as well as Incheon, Gimpo, and Jeju international airports. They photographed fighter aircraft and air traffic control facilities hundreds of times. The court also found that they had attempted to intercept communications between air traffic controllers and pilots using Chinese-made radios. After reviewing WeChat conversations, the circumstances of their entry into South Korea, and their travel patterns inside the country, the court found that the two had acted in concert and concluded that the information obtainable through their photography and interception activities could damage South Korea’s military interests.
Chinese military intelligence collection, however, did not remain limited to photographing facilities from outside or using radios. In 2025, authorities uncovered a case in which individuals connected to an intelligence organization under the Joint Staff Department of the Chinese People’s Liberation Army approached an active-duty South Korean soldier. According to the indictment and related documents, the soldier provided materials concerning the UFS U.S.-ROK combined military exercise under instructions from the Chinese side. The information included the names of U.S. military bases in South Korea, force reinforcement plans, locations that could become targets during a contingency, and personal information on officials responsible for the combined exercise. Investigators also found that the soldier had received money from the Chinese side.
In August 2026, two Chinese nationals with Chinese military backgrounds were arrested on allegations of collecting information related to the South Korean military and U.S. Forces Korea. A Chinese national in his sixties had repeatedly entered South Korea on tourist visas and allegedly used an SDR receiver, antenna, and laptop from a hotel near Kunsan Air Base to collect communications between fighter aircraft and the control tower. Police determined that some of his visits coincided with periods when U.S. and South Korean air forces were conducting joint exercises.
Another Chinese national in his forties operated a military-surplus store near the main gate of Camp Humphreys and allegedly approached a Korean employee working inside the base to obtain UFS materials and personnel-related information. Police are also investigating allegations that he observed and photographed movements of weapons inside the U.S. military installation. Investigators are now tracing whether information obtained by the two suspects was transmitted to Chinese authorities and whether other actors were directing their activities.
At this point, the nature of the cases clearly changes. In 2024, the principal pattern involved repeated surveillance from outside military facilities. In 2025, authorities uncovered a case in which a person connected to the Chinese side recruited an active-duty South Korean soldier and obtained materials related to a U.S.-ROK combined exercise. By 2026, after the Lee Jae-myung government took office, a former Chinese military member was arrested for allegedly using professional equipment to collect U.S.-ROK military communications, while another Chinese national with a military background was arrested for allegedly approaching an employee inside a U.S. military base and obtaining UFS and personnel information. Chinese military intelligence collection had expanded from external surveillance to communications collection and insider access.
The time has passed when investigators could focus only on the cameras carried by individual Chinese nationals. South Korea and the United States must now determine whether there are additional individuals inside the South Korean military or U.S. Forces Korea who have been in contact with Chinese intelligence collectors or have transferred information to them.
In the Busan Case, the Critical Question Is Not Only What Was Filmed, but Whether the Data Was Transmitted Outside South Korea
In the Busan case, Chinese students used Chinese-made drones and mobile phones to photograph the Republic of Korea Naval Operations Command and the U.S. Navy aircraft carrier USS Theodore Roosevelt nine times between March 2023 and June 2024. Their final surveillance occurred on June 25, 2024, the same day the South Korean president was scheduled to visit the Roosevelt. In June 2026, the Busan District Court sentenced the principal defendant to 18 months in prison and the accomplice to one year in prison, suspended for two years.
The court found that their conduct posed a substantial risk to South Korea’s military interests but stated that it had not found evidence establishing that the photographs or videos had been transferred to an enemy state, an unfriendly country, or an organization. At the same time, the court convicted the principal defendant under the general enemy-benefiting offense.
As of August 2026, the case remains on appeal. At the first appellate hearing on August 13, the defense challenged application of the general enemy-benefiting offense, arguing that footage from the Chinese-made drone could not easily be accessed by Chinese authorities. Whether the surveillance data could have moved outside South Korea has therefore become a central issue in the appeal.
But a court’s inability to prove external transmission does not establish that no data was transmitted to China.
Whether data collected by a Chinese-made drone repeatedly used to photograph a U.S. aircraft carrier and a South Korean naval base was transferred to servers or accounts in China is a technical question that must be investigated independently of the court’s determination of criminal guilt.
The United States should not close the case based solely on the judgment of the South Korean judiciary. Washington should determine directly where the information collected by that drone actually traveled. Chinese access to U.S. and South Korean military facilities has already progressed from repeated photography to communications collection and insider access. If even the final destination of surveillance data is left unresolved under these circumstances, U.S.-ROK military information could continue flowing to China while neither country even recognizes the extent of the exposure.
The issue is no longer limited to what Chinese nationals photographed. Arresting and prosecuting the individuals does not close the intelligence channel if authorities cannot determine where the information they collected went. What remains at the center of the Busan case is not a few photographs or a single drone. It is whether a channel existed through which information collected from critical U.S. and South Korean military facilities could reach China, and whether that channel remains open today.
Chinese Military Intelligence Collection and Pro-North Korean, Anti-American Groups Are Targeting U.S. Military Facilities at the Same Time
The Busan District Court ruled that a warship or aircraft carrier itself does not constitute a “military installation” under the current Military Bases and Installations Protection Act. But that ruling does not eliminate the security risk created by surveillance and intelligence collection directed at U.S. strategic assets. If the arrival times and berthing locations of aircraft carriers or nuclear-powered submarines, aircraft positioning on their decks, and crew movements are photographed and accumulated over an extended period from outside a military base, that information itself can be used to track U.S. military operations and force employment.
The problem does not end with the court’s conclusion that a warship itself cannot legally be classified as a military installation. Because the current law has a narrow scope, Chinese nationals or other outside actors can concentrate on observing and recording U.S. strategic assets without photographing the military base itself. At a time when repeated surveillance has already progressed to communications collection and insider access, this legal gap leaves an opening through which actual intelligence-collection activity can continue without being stopped.
A more direct incident occurred in August 2026. On August 4, eight members of the Korean Progressive University Student Union, known as Daehakjinyeon, a group with a long record of pro-North Korean and anti-American activism, attempted to enter the main gate of Osan Air Base K-55 in Pyeongtaek. Six of them actually entered the base.
Daehakjinyeon is a radical pro-North Korean organization that previously displayed photographs of Kim Jong Un in Seoul’s Gwanghwamun area and on university campuses while campaigning to welcome his visit to Seoul. The organization participated in the Baekdu Praise Committee, which was established to welcome Kim Jong Un, and even operated a “Kim Jong Un State Affairs Commission Chairman Study Group.” In 2019, its members climbed over the wall of the U.S. ambassador’s residence in Seoul, occupied the compound, and shouted anti-American slogans. Members of that same organization have now entered the main gate of a U.S. military installation. This is a clear provocation against U.S. forces by pro-North Korean elements.
The activists shouted anti-American slogans while recording their actions on video. U.S. military personnel apprehended them at the scene and turned them over to South Korean police. A court subsequently issued arrest warrants for only three of the four individuals for whom warrants had been requested. Yet pro-North Korean and pro-Chinese elements within the South Korean government have tolerated these groups and their activities for years. Under the Lee Jae-myung government in particular, pro-North Korean, pro-Chinese, and anti-American groups have been protected while groups holding anti-China demonstrations have repeatedly faced government pressure.
The fact that members of a pro-North Korean and anti-American organization with a record of defending Kim Jong Un, leading anti-American protests, and even breaking into the U.S. ambassador’s residence were able, under the Lee Jae-myung government, to pass through the gate of a U.S. military base and physically enter the installation is only one example of how serious South Korea’s internal security situation has become.
The More Urgent Immigration Issue Is the Reentry of Individuals With Records of Military Surveillance and Intelligence Collection
The South Korean government operated a temporary visa-free entry program for Chinese group tourists from September 29, 2025, through June 30, 2026. The government said that it had introduced safeguards under which passenger lists from groups recruited by designated travel agencies would be screened in advance, including checks for previous illegal stays. Yet large groups of Chinese nationals continue entering South Korea, while management and enforcement remain inadequate. Groups dressed in Chinese military-style uniforms have even appeared openly in public parks in Seoul, marching together while shouting slogans praising the Chinese Communist Party.
Another controversy arose amid large public demonstrations at Seoul’s Olympic Park in Jamsil over allegations of election fraud. Police were accused of putting subcontracted security personnel in police uniforms and using them to physically remove demonstrators from the site. These personnel concealed their faces and refused to identify themselves, while evidence emerged that a number of Chinese nationals had been deployed in the operation. Citizens confronted individuals wearing police uniforms, recorded their conversations in real time, and distributed the videos through YouTube and other social-media platforms. The controversy escalated to the point that conservative National Assembly members directly confronted the Korean National Police Agency and demanded explanations.
The problem is that Chinese intelligence collectors have already photographed South Korean military facilities and collected military information, yet the South Korean government has failed to properly track them. At the same time, allegations have emerged that unidentified Chinese nationals have even been used in the exercise of police authority under the Lee Jae-myung government. This is why official statements from the South Korean government and police cannot simply be accepted at face value.
The case in which Chinese nationals returned to the same Osan U.S. military base only two days after being questioned by police and intelligence authorities demonstrates precisely this failure of control.
As Chinese surveillance and intelligence-collection incidents continue to occur, South Korea should be tightening immigration controls and security around military facilities. Instead, the Lee Jae-myung government has failed to properly control or track Chinese nationals while remaining reluctant to confront Beijing, even as security gaps already exposed in repeated incidents continue to be left open.
The Lee Jae-myung Government Is Weakening the National Security Act and Counterintelligence System
Against this backdrop, a major political confrontation is also unfolding in South Korea over espionage law, the National Security Act, and the country’s counterintelligence investigative system. A March 2026 amendment to South Korea’s Criminal Act created Article 98-2, which criminalizes the detection, collection, disclosure, or transfer of state secrets for “a foreign state or an organization equivalent thereto.” The provision takes effect on September 13. But conservatives argue that this provision is only one part of a much larger issue.
After the Moon Jae-in government abolished the National Intelligence Service’s authority to conduct counterintelligence investigations, the ruling bloc under the Lee Jae-myung government has moved to abolish the National Security Act and further reduce the counterintelligence functions that remain within the NIS. Conservatives view these moves as a serious national security crisis that would dismantle the laws and counterintelligence capabilities used to prosecute North Korean spies. They have strongly resisted the effort, describing abolition of the National Security Act as the “dismantling of national security” and warning that it could turn South Korea into a “paradise for spies.”
The reason for the strong conservative backlash is that they see the Lee Jae-myung government as weakening the National Security Act and the counterintelligence functions historically used to track and investigate domestic organizations connected to North Korea, while attempting to defuse public opposition by presenting new penalties against intelligence activities conducted for foreign states, including China, as though the overall system were being strengthened. Chinese surveillance of U.S. and South Korean military facilities has already expanded into communications collection and insider access, while members of an openly pro-North Korean and anti-American organization have physically entered a U.S. military installation. Yet a South Korean government dominated by pro-North Korean and pro-Chinese forces has continued to impose only weak consequences on these actors. The rapidly expanding gap in South Korea’s national security system therefore demands close attention.
Conclusion
What is happening in South Korea can no longer be treated as a series of isolated security incidents or temporary failures of management. Pro-North Korean and pro-Chinese forces have taken control of the government and have penetrated not only the political establishment but also the judiciary, law enforcement, and now the Ministry of National Defense, while dismantling South Korea’s security system. The consequences are no longer confined to South Korea. They now directly threaten U.S. Forces Korea and U.S. military information.
Washington can no longer view South Korea solely through the framework of the traditional U.S.-ROK alliance and the military cooperation of the past. The United States must conduct its own comprehensive investigation into the relationships between the Lee Jae-myung government and pro-North Korean and pro-Chinese forces in South Korean politics and individuals and institutions connected to North Korea and China; what contacts and transactions are taking place behind the scenes; and whether information affecting the security of the United States and U.S. Forces Korea is being exchanged through those channels.
If the collapse of South Korea’s security network is allowed to continue, the damage will not stop at South Korea’s borders. The U.S. government and the Department of Defense must treat what is happening inside South Korea as an urgent U.S. national security matter and move immediately to investigate and take the necessary action.
Selected References
- U.S. Government Accountability Office (GAO). Telecommunications: Selected Agencies Have Taken Steps to Address Risks of Equipment Linked to China. GAO-26-107668, May 19, 2026. GAO Report
- U.S. General Services Administration. Federal Acquisition Regulation 52.204-25: Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. FAR 52.204-25
- U.S. Department of Justice, Eastern District of New York. “Aventura Technologies, Inc. Pleads Guilty to Wire Fraud and Illegal Importation for Reselling Chinese Goods as U.S.-Made.” March 19, 2024. U.S. Department of Justice
- Seoul Shinmun. Report on former Chinese military personnel accused of collecting ROK and U.S. military intelligence, including the interception of military communications near Kunsan Air Base. August 12, 2026. Seoul Shinmun
- Newsis. Report on two Chinese nationals with Chinese military backgrounds arrested for collecting information related to the ROK military and U.S. Forces Korea. August 12, 2026. Newsis
- News1 Korea. Report on Chinese nationals with military backgrounds accused of intercepting fighter communications and obtaining information related to U.S.-ROK military exercises. August 11, 2026. News1 Korea
- Seoul Shinmun. Report on two Chinese nationals who returned to the vicinity of Osan Air Base and photographed military aircraft two days after being questioned and released by South Korean authorities. April 23, 2025. Seoul Shinmun
- Korea Economic Daily. Report on a former Chinese People’s Liberation Army serviceman accused of using SDR equipment near Kunsan Air Base to intercept communications between fighter aircraft and air traffic control. August 11, 2026. Korea Economic Daily
- Yonhap News Agency. “Military Takes Down Over 1,300 Chinese-Made Surveillance Cameras at Units.” September 13, 2024. The cameras, installed at South Korean military facilities, were found to be Chinese-made and designed to connect to a specific server in China, creating the potential for footage to be transmitted externally. Yonhap News Agency
- Yonhap News Agency. “2 Chinese Nationals Sentenced to Prison for Filming Busan Naval Base.” June 10, 2026. The case involved Chinese nationals who used Chinese-made drones and mobile phones to photograph the Republic of Korea Naval Operations Command and the USS Theodore Roosevelt on nine occasions between March 2023 and June 2024. Yonhap News Agency
