For decades, U.S. manufacturers worried primarily about Chinese intellectual property theft.
Engineering blueprints disappeared.
Proprietary processes were reverse-engineered.
Trade secrets walked out the door.
China’s goal was to acquire technology so that it could compete. But starting around 2014, those efforts began to shift to something far more insidious. Today, China is executing hidden surveillance operations designed to map, monitor, and ultimately disrupt American critical infrastructure.
In a September 2025 joint statement, a wide-ranging group of government agencies issued a warning about Salt Typhoon and the nation-state backed group’s focus on targeting telecommunications, government, transportation, lodging, and military infrastructure networks with a goal of maintaining persistent access.
Every industrial equipment manufacturer, critical infrastructure operator, and embedded systems developer needs to understand that China plays the long game. They are building a map of our infrastructure, our people, and our dependencies to exploit years from now.
Surveillance as Strategic Positioning
China’s surveillance efforts expand well into the world of critical infrastructure. Huawei embedded routers inside 5G networks, positioning them to survey traffic and gather trends about communications patterns and people.
More recently, Salt Typhoon revealed indicators of compromise within telecommunications equipment globally, targeting government personnel and senior leaders. Rather than immediate disruption, the goal was to map the network of who talks to whom, when, and about what.
The Salt Typhoon campaign demonstrates just how patient and well-resourced these operations are. When comparing China's cyber operations, the U.S. is outnumbered pretty significantly - 50 to one. The Salt Typhoon team—likely dozens of operatives working on coordinated subprojects globally—compromised at least ten major telecommunications companies across the United States, Southeast Asia, and Africa.
They maintained access for at least two years before detection in fall 2024.
What makes this particularly insidious is how they exploited the infrastructure of surveillance itself. The attackers targeted lawful intercept systems, or the mechanisms telephone companies use to comply with court-ordered wiretaps under the Communications Assistance for Law Enforcement Act (CALEA).
If you create processes that enable backdoor entry, you have to think about how a bad actor can turn that process to their advantage. China flipped lawful intercept on its head, essentially snooping on the snoopers and stealing data that had already been collected for legitimate law enforcement purposes. They accessed transcripts of important telephone conversations without ever needing to touch a mobile phone or the physical telephone network.
But here's what industrial equipment manufacturers need to understand. These actors weren't just collecting conversation content. The metadata provides the blueprint of what's happening.
It reveals patterns of communication, identifies which individuals and organizations are important, and maps relationships across infrastructure. For industrial operations, similar metadata from embedded systems, control networks, and supply chain communications creates an equally valuable intelligence picture.
Another example is the U.S. ban targeting Chinese LIDAR components and related software in U.S.-manufactured autonomous systems due to national security risks. The concern was systematic surveillance of trends across the United States, including tracking law enforcement, emergency response vehicles, and government fleet movements. Every data point contributes to a comprehensive picture of American critical infrastructure and operations.
The Industrial Equipment Vulnerability
For manufacturers of industrial equipment, embedded systems, and automation technology, the implications are stark. Under economic espionage, undermining economic activity in a country does cause harm to the prosperity of companies. It can lead to the theft of intellectual property. And if it's targeting critical infrastructure, it can undermine a country or government’s ability to provide basic services to the public.
Adversaries are actively:
- Mapping software supply chains to identify dependencies.
- Monitoring systems to understand operational patterns.
- Collecting data that seems innocuous today but becomes strategic intelligence tomorrow.
- Pre-positioning access for disruption at a time of their choosing.
Consider the power grid. One of the biggest vulnerabilities is the ability to manipulate demand, like creating surges when they don't naturally exist or forcing brownouts when systems are already stressed. But to execute that attack effectively, you first need years of surveillance data. What are the peak demand times? Which distributed energy resources are most relied upon? How does the grid respond to various conditions?
That's the data being collected today to enable tomorrow’s attacks.
Emerging Frontiers: Drones and Beyond
The surveillance game continues to evolve. Drone technology represents another frontier where the ability to collect position data, surveil operations, and exploit devices even when other detection signals are unavailable creates new vulnerabilities.
It's a cat and mouse game playing out in real-time in Ukraine, where avoiding detection has become as important as the drone's primary mission. The lessons from that conflict are being studied intensely by both defenders and adversaries. Industrial operators need to question whether systems are designed with the assumption that someone might already be watching.
Surveillance threats to U.S. critical infrastructure focus on the long-term. Critical infrastructure operators need to take the same view to safeguard against present and future threats.
- Assess Your Software Supply Chain: Every component, vendor, and connection point is a potential surveillance vector. Understanding the security posture of your suppliers is just as important as assessing your own.
- Think Beyond Operational Security: Traditional industrial security focuses on preventing unauthorized access and ensuring uptime. Modern threats require thinking about what data systems generate, where it goes, and what patterns it might reveal over time.
- Recognize the Timeline: Adversaries are collecting data today to enable attacks five or ten years from now. A strong security posture needs to account for long-term exposure, not just immediate threats.
- Engage Vendors on Embedded Security: The PLCs, HMIs, and embedded systems that control industrial operations were often designed in an era when security was an afterthought. Those systems need hardening against memory-based exploits and surveillance backdoors that can persist for years undetected.
Nation-state adversaries are patient, well-funded, and playing a different game than traditional cybercriminals. They're not looking for immediate payoff, but planning strategic ways to disrupt critical infrastructure and any industrial advantage that the U.S. may have.
The long game requires long-term thinking. Our adversaries understand this. The question is: do we?
