For a few years now, for study and for work, I’ve been developing my own processes and tools to do OSInt on Chinese targets.
It all started both for academic reasons, as a student at Ca’ Foscari, and through CTI work, where reconstructing the behaviour and structure of Chinese adversaries was an integral part of the job. The need to peek beyond the Great Firewall was constant: sources in Mandarin, business registries of cities whose names I still struggle to pronounce, online slang that was practically incomprehensible were all part of daily life.
The standard techniques and tools I had successfully adopted until then had to be adapted to the new scenario.
Where did I start? The first step was the one anyone would have taken: opening the OSInt manuals.
Open the manuals and China is not there
Take, for example, the latest edition of OSINT Techniques by Michael Bazzell, the bible of the field: forty-seven chapters, one for Facebook, one for X, one for Instagram, one for TikTok, and none specifically for the Chinese internet. The word “China” appears maybe a handful of times in six hundred pages.
Deep Dive by Rae Baker? It mentions it more often, but never really digs into the subject.
This is not a criticism of these two spectacular books!
I guess this kind of analysis is simply not a priority for the analysts those books were written for. They are excellent texts, and they teach you how to do OSInt with a bit of Chinese in the mix. Not how to do OSInt on China, which is a different thing: a true specialisation, where the social platforms, the language and the culture of the people don’t resemble the targets you usually deal with.
Why the manuals skip it
But why do they skip it, even the best ones? Because it’s a subject that undoubtedly needs a book of its own.
Let’s start with access. The Great Firewall and the other censorship technologies adopted by China don’t just block foreign sites: they also tend to complicate the reverse path, that is, collecting a Chinese source from the outside before it disappears. And many mainland platforms require a +86 number tied to a real identity just to register.
And there you have the first OPSEC challenge, to be faced before you’ve even started searching.
Then there are the language and the cultural references. Here auto-translation betrays you at the worst possible moment. Or rather, it can render the general meaning perfectly well, but you risk losing the precise meaning of the slang, the neologisms, the euphemisms born specifically to slip under the censorship.
A word that sounds innocent can be the way an entire community talks about a forbidden topic.
And then there’s the part you can’t touch: telling authentic information from information built in an environment where the state narrative takes countless forms, becoming part of the landscape and not the exception. The risk is not finding nothing, but rather falling for the narrative and believing that what you’re reading is true.
How I’m filling the gap
The space between those manuals and what I needed is something I’m filling by hand, banging my head against it, and partly thanks to the right people at the right time. While working on my master’s thesis at Ca’ Foscari, dedicated precisely to OSInt on China, I took the course by Skip Schiphorst, a sinologist and former Korps Mariniers, specifically dedicated to this subject and developed for i-intelligence. It’s a hands-on course to the core: no knowledge of Chinese is required to start and, module after module, it shows you how true “so I had understood nothing here” really is.
I’m pointing it out because I found it useful and because Skip is a wonderful person I’ve stayed in touch with years later (when is the next beer in Rome, Skip?). That said, Skip isn’t the only one specialised in this field: courses dedicated solely to China are also run by OSINT Combine and SANS, among others. When a branch of OSInt earns its own separate courses, it’s no longer a variant: it’s a specialisation.
If you just want to get an idea without investing right away, I’d start with two reads. Bellingcat put the real difficulties down in black and white in The Challenges of Conducting Open Source Research on China. OSINT Combine, on the operational side, gets into the specifics of search engines, euphemisms and translation in OSINT: The Chinese Internet. To find your way among Chinese databases, registries and tools there’s also a community-maintained, hand-tested index, OSINT Tools China. And if you’re wondering whether the subject can stand on its own, consider that there are people who do only this, like osintonchina.com: nobody opens a shop where there’s no market.
Why it’s worth it anyway
At this point the question is legitimate: if it’s all such an uphill climb, why bother?
Because beyond those walls there are over a billion connected people and an enormous amount of content that exists only in Mandarin, produced by an actor that weighs on cyber, supply chain, research and defence like no other. Chinese open sources are there, public, and mostly ignored by those who stop at the first +86. Whoever learns to extract reliable data from them takes home a knowledge advantage few people have. Not because it’s secret stuff: because it’s inconvenient to reach, and almost everyone gives up first.
So the point is not whether it’s worth it, but what I need to do to do it well.
A series, not an article
All of this doesn’t fit in a single piece, and that’s exactly why I decided to create the “Wukong” project, where I want to tackle the matter both with articles and by preparing a dedicated VM derived from Speculator.
The goal is not to create “SinOsint” experts. Not now, at least. It’s rather to put years of experience to work and think carefully about how to do these things safely: network, dedicated VM, tools, etc. I got here through mistakes, meeting a lot of wonderful people and never ceasing to learn, since the internet is and always will be in constant evolution.
In short, I want to share how I’ve worked in a Sinophone environment without forcing you to become a sinologist (ehm… no, I don’t count), looking at:
- What lies beyond Google, looking at what Baidu, Sogou and all those tools and engines that must be queried with their own operators have to offer.
- What WeChat, Weibo, Douyin and Xiaohongshu really are: not the Chinese clones of the social networks we’re used to, but platforms with search, visibility and moderation logics of their own.
Would you like to walk this path with me? And if you’ve already tried digging into this field, tell me about it: shall we talk in the comments or in our Telegram group?
This article was translated with the help of an AI language model and may contain inaccuracies.
Leave a Reply