Inside the PLA’s Instant Messaging Ecosystem
China: Technosphere provides a biweekly deep-dive into China’s technological control at home and influence abroad.
Any translations into English are unofficial and informal. All Chinese-language links in this brief are safe to click on. They will lead you to an archived version of the websites. However, do avoid going on the actual websites, as this might expose you to being tracked by the Chinese state.
Subscribe for free, or support China: Technosphere with a paid subscription to unlock the full archive of previously featured companies.
Biweekly Feature: Why PLA messaging apps are and will remain insecure
Key takeaway: The Chinese military, also known as the People’s Liberation Army (PLA) uses custom-designed instant messaging platforms. Despite strong encryption claims, the PLA maintains backdoor access via surveillance tools, which monitor soldiers’ online behavior. Meanwhile, Zhizhangyi’s U.S.-registered subsidiary, Amovatech, presents itself as a tech partner to global firms while its parent company directly supplies the PLA and various Chinese security agencies, including in Xinjiang.
The Chinese military obtains custom-designed military grade instant messaging software. One of the providers is Xi’an Fengdao Network Technology Co., Ltd. (西安奉道网络科技有限公司). It provides a platform for video, audio and text communications in the military camp, on the training ground or when on a mission.
The company’s software allows to transmit 2GB battle maps in a matter of 18 seconds via what appears to be a block cipher mode of operation.
According to the provider the software uses a combination of China’s national SM9 cryptography algorithm and AES-256 to secure data.
BigAnt (杭州九麒科技有限公司), for its part, supplies a Fujian military unit with its instant messaging platform. In 2020, 360 Zhiyu, a part of 360 Group, a cybersecurity company, supplied the PLA Air Force with its instant messaging platform. It relied on a mix of (AES+RSA) and national encryption algorithms (SM2+SM4). The same 360 product is used by a secret military research institute.
BeeWorks (深圳恒拓高科信息技术有限公司), another company, supplies its messaging platform to the China Aerospace Science and Industry Corporation (produces missile weapon systems) and the PLA. Carlsberg and BMW Brilliance are listed as BeeWorks customers on its website.
Figure 1: the PLA as a customer (Source: BeeWorks).
Ansiyuan (杭州安司源科技有限公司), for its part, has developed an instant messaging platform for the PLA’s weapons and equipment procurement network (you can download the app here on the Apple App Store, although it is not advisable). The app uses Chinese national cryptographic algorithms and helps to match procurement demand with suppliers.
Figure 2: A weapons and gear procurement app for the PLA. (Source: Apple App Store)
Backdoors to address leadership paranoia
All that professed cybersecurity for instant messaging is necessary in such sensitive environments. But providing soldiers with access to the internet has its drawbacks. The PLA has difficulties to manage officers’ and soldiers’ behavior related to mobile gaming, online gambling, subversive information, adult content, (un)intentional disclosure of military equipment photos and location.
In order to rein in soldiers’ internet behavior, the PLA maintains backdoors into their phones to peek inside, which of course undermines encryption. And if the PLA can read soldier communications - so can others.
One of those backdoor solutions is created by Beijing Zhizhangyi Technology Co., Ltd. (北京指掌易科技有限公司). The company offers a Military Mobile Terminal Security Solution for the PLA that monitors every move a soldier makes on their online device. Figure 3 shows how it works.
Figure 3: The Mobile application big data situation awareness platform (Source: Beijing Zhizhangyi Technology Co., Ltd.)
A graphic interface allows the PLA to monitor a soldier’s online behavior. Based on this, it provides a soldier’s psychological charactersistics, number of friends, speech behavior, website preferences, consumption characteristics, entertainment preferences, social preferences, top 10 apps used and much more. The interface also seems to show who officers and soldiers are in contact with, where in the world their online acquaintances are based.
Zhizhangyi Technology provides a variety of digital solutions to its customers, which include the Chinese People’s Liberation Army Ground Force, Navy, Air Force, Rocket Force, Information Support Force, and the People’s Armed Police Force.
Zhizhangyi’s product specifically mentions that officers are monitored too. Another article, however, mentions that higher ranking officers above the regimental level are equipped with special military mobile phones that deploy end-to-end encryption and that special surveillance apps are solely installed on ordinary phones . It is unlikely, however, that higher ranking soldiers go unmonitored, when they use special military phones. Only recently the Chinese Communist Party (CCP) sacked a handful of three-star generals for reasons of financial crimes. My guess is that the higher the rank of a soldier, the more closely the CCP monitors them due to regime security concerns, whether offline or online, regardless of the device they are using. These surveillance efforts are unlikely to abate. On the contrary, the greater the CCP leadership’s paranoia, the more pervasive the tracking efforts are likely to become.
Company spotlight: Amovatech (北京指掌易科技有限公司)
Amovatech appears to be a subsidiary of Zhizhangyi Technology Co., Ltd. (北京指掌易科技有限公司), which we have amply analyzed above. Both companies share the same brand logo and the English-version website of Amovatech is linked directly to the Zhizhangyi website. The Chinese entity is based on the 7th Floor of the Aviation Technology Building, No. 58 Beiyuan Road, Chaoyang District, Beijing. It does not only supply the PLA but also the Xinjiang Autonomous Region Public Security Department, the Xinjiang Land and Resources Department, Xinjiang Mobile, Xinjiang Telecom, the Bank of Urumqi, and the Taiwanese AUO Corporation (optoelectronics)
Amovatech is based on 350 S. Main Street, Suite 300, Ann Arbor, Michigan. On LinkedIn, Amovatech mentions that it provides products to the military, but not which one [as seen above, it is the Chinese military]. The LinkedIn profile states that Amovatech provides mobile security solutions and cooperates with Microsoft, Apple, and Samsung. Another website adds Google, IBM, Intel, and SoftBank as Amovatech’s partners. Its own website claims that it is trusted by Swire Coca-Cola, Finnish KONE and American CBC Companies. I am not sure how global companies feel comfortable entrusting their cybersecurity to firms linked to the PLA, but I suppose every organization makes its own risk calculations.
Figure 4: Amovatech (Source: Linkedin)
Thank you for reading China:Technospehere.
Subscribe for free here to receive new posts and support my work. Full access to the curated archive of companies previously mentioned in the brief is provided to paying subscribers.