Winnipeg man was member of Chinese military branch behind cyber attacks on Canada, officials allege

A military veteran who spent 20 years in uniform, Lieutenant Colonel Huajie Xu now lives on a quiet street in Winnipeg.

But he did not serve in Canada’s armed forces.

Instead, he was a member of China’s People’s Liberation Army, according to records obtained by Global News.

Before arriving in Canada in 2021, Xu worked at the military academy of the Chinese cyber warfare department that hacks Canadians and steals their secrets.

Chinese state-sponsored cyber attacks have targeted Canadian companies, activists and government agencies.

But three years ago, Xu obtained permanent residence in Canada and moved into a newly built suburban home in the Manitoba capital.

Questioned by immigration officers when he landed at Vancouver airport, the 43-year-old said he and his wife left China because “the air quality was getting bad.”

“Through the internet, we found out that the air quality is better in Canada.”

He denied involvement in, or knowledge of, China’s cyber warfare and espionage programs, and insisted he was only a PLA instructor.

But the army school in Henan where he taught is the training centre for the PLA hacking units that target Canada and the United States.

It is also on the Canadian government’s list of “research organizations and institutions that pose the highest risk to Canada’s national security.”

In addition, it has been rated a “very high risk due to its record of training signals intelligence and political warfare officers and carrying out offensive cyber operations.”

Xu’s wife worked at the same PLA facility, as a language instructor, he told immigration officials. In their marriage certificate photos, records show they both wore their PLA uniforms.

The case is one of a growing number that raise questions about how effectively Ottawa is screening those who have served foreign governments hostile to Canada.

The government has named China, Iran and Russia as the top adversaries targeting Canadians through cyber attacks and foreign interference.

At the same time, the immigration department has issued visas and permanent residence to foreign nationals who worked for those regimes.

Senior members of the Iranian government have been turning up in Canada, prompting immigration officials to launch close to 90 investigations.

So far, just two deportation orders have been issued against the Iranian officials, most recently Seyed Salman Samani, the former deputy interior minister.

The government has also struggled to keep out those tied to China’s PLA, which has so many veterans in Canada that in 2018 they formed a non-profit society, although it has since disbanded.

Last month, the government tabled documents on another Winnipeg couple with ties to the PLA, who were fired from Canada’s infectious disease laboratory over their extensive ties to Beijing.

“It has been very disappointing for me,” said Mehmet Tohti, executive director of the Uyghur Rights Advocacy Project, an advocacy group for China’s Uyghur minority.

China has been mounting increasingly sophisticated cyber attacks against activists, who have been targeted with phishing emails, malware and spyware, Tohti said.

Knowing that members of the same government targeting them are living in Canada has left activists in fear, he said.

“This is a national security issue.”

Xu’s case is notable because he spent most of his military career at the PLA Information Engineering University, PLAIEU.

“The PLAIEU is China’s only military academy for cyber and electronic warfare and is reputed to be a centre for information warfare research for the Chinese military,” a Canadian federal court judge wrote last month.

Until 2016, the school operated under China’s cyber espionage branch, known as the Third Department, or 3/PLA.

Following a reorganization, it was absorbed by the Network Systems Department of the Strategic Support Force, which the judge wrote “has also been recognized as engaging in espionage against Canada and contrary to Canada’s interests.”

The PLAIEU could not be reached for comment, but the Australian Strategic Policy Institute wrote that the university is known for its research and training on hacking.

“PLA experts have described IEU as ‘the sole military academy for the cyber and electronic warfare arms of China’s network-electronic forces,'” it said.

One professor, Zhang Changhe, allegedly hacked foreign governments, oil companies and a nuclear safety agency, according to the institute.

“Yes I was an instructor at the university but I did not do anything beyond teaching,” Xu told the Canada Border Services Agency in an interview.

But the CBSA has argued that his role supported the work of 3/PLA, which “is responsible for numerous instances of espionage against Canada.”

“By working as a lecturer at that university, Mr. Xu provided material support to the ongoing activities of the Third Department by contributing to the training and recruitment of soldiers that would go on to work in the Third Department,” the CBSA argued.

According to Brent Arnold, a cyber security expert and partner at the law firm Gowling WLG, Beijing is the primary state cyber-menace that Canada faces.

“China is the most strategic, most coordinated and most resourced,” he said. “They are best positioned to be the real threat.”

The PLA’s Strategic Support Force is responsible for cyber warfare, including cyberattacks and electronic warfare, he said.

“Overall, China’s cyber forces are a combination of military units, government agencies, and affiliated groups, all contributing to the country’s cyber warfare and cyber defence capabilities.”

The federal government’s 2023-24 National Cyber Threat Assessment said the cyber programs of China, Russia, Iran, and North Korea posed “the greatest strategic cyber threats to Canada.”

“PLA attach great importance to information-based warfare,” Xu told the CBSA in an interview.

“When it comes to information warfare, it has two aspects. One is to protect yourself. The other is to destroy your enemy.”

The most recent mailing address Xu provided in his immigration file was a house in a southeast Winnipeg suburb called Sage Creek.

A man resembling Xu answered the doorbell last week but did not comment. A woman then came to the door. “Sorry, we don’t answer questions,” she said.

Property records show the home is owned by Ying Ruan. In immigration records, she is listed as Xu’s wife.

During interviews with the CBSA, Xu said Ruan had also worked at the PLAIEU as a civilian English instructor and did “very brief military training.”

Neighbours said she was an optician and moved into the home with her daughter several years ago, while Xu had joined them more recently.

Ruan came to Canada as a student, obtained a work visa and then immigrated through the Provincial Nomination Program, records show.

“Why did you two choose to wear military uniform in your marriage certificate?” a CBSA officer asked Xu.

“You can choose to wear whatever you want and it was a significant occasion and both of us are in the military university. So why not?”

Hundreds of pages of records filed in court indicate that Xu joined the PLA in 1998 and became a member of the Chinese Communist Party in 2001.

He earned a degree in Infantry Command from Jinan Army College, and a Masters in Military Education Training from the PLAIEU.

Between 2011 and 2013, Xu was trained by the Russian military in Moscow. Upon returning to China, he became an instructor at the PLAIEU until retiring in 2018.

In 2021, he applied to immigrate to Canada. Despite acknowledging his military career in his application form, he was accepted as a permanent resident.

Immigration, Citizenship and Refugees Canada declined to answer when asked by Global News why it had approved Xu as an immigrant.

Upon arriving at Vancouver airport, Xu was detained by the Canada Border Services Agency due to his background in the Chinese military, but eventually released.

The case proceeded to the Immigration and Refugee Board for hearings to determine whether he was inadmissible to Canada for his alleged membership in a PLA espionage unit.

At the hearings, the CBSA argued that Xu had worked for the PLAIEU, which the agency called “a military institution run by the espionage departments of the PLA.”

The espionage units the CBSA was referring to were 3/PLA and its successor, the Network Systems Department (NSD) of the Strategic Support Force (SSF).

The officials singled out the 2017 hack of the U.S. firm Equifax as an example of “an act of espionage against Canada” by the SSF.

In one of the largest data thefts on record, the PLA SSF stole credit card numbers, social security card numbers and trade secrets. Almost 20,000 Canadians were impacted.

The officials also pointed out that the SSF had hacked the systems of the Immigration and Refugee Board, the very body hearing Xu’s case.

The lawyers defending Xu said their client was not a member of the PLA cyber warfare branch, either when it was called the Third Department or later when it became the SSF.

“There’s no evidence that Mr. Xu contributed in a significant way to the Third Department,” Lorne Waldman argued at a hearing, according to a transcript.

“There’s no evidence that Mr. Xu supported the objectives of the Third Department in any way. There’s no evidence connecting Mr. Xu to the Third Department, other than the fact that he taught at a university that at a certain point became under the administrative control of the Third Department or the NSD,” he said.

“Mr. Xu came to Canada after his permanent residence application was approved, and he was detained at the port of entry upon arrival. Instead of being granted permanent resident status after having been here and issued a visa, he’s been detained, interrogated, and accused of being a spy.”

The Immigration and Refugee Board sided with Xu, ruling he was not a member of Chinese cyber espionage department.

But the Federal Court tossed out the board’s decision in a February ruling, calling it “unintelligible” and “unreasonable.”

The court has ordered a new hearing to decide whether Xu should be deported. The IRB said the matter was being heard behind closed doors. The CBSA has indicated it may also launch proceedings against his wife.

The CBSA would not comment on the case.

Stewart.Bell@globalnews.ca with files from Iris Dyck