Letter I: The State Question
Where Commercial Negligence Ends and State-Adjacent Activity Begins
Executive Summary
China's National Intelligence Law (2017, amended 2018) contains two provisions that transform every Chinese-owned cloud provider into a potential intelligence asset: Article 7 mandates that "any organization or citizen shall support, assist, and cooperate with state intelligence work," while Article 14 grants intelligence agencies the power to "require relevant organs, organizations, and citizens to provide necessary support, assistance, and cooperation." These are not theoretical risks. They are operative law โ binding on every entity documented in Letters A through H of this series. The question is not whether these companies could be compelled to cooperate. The question is whether the infrastructure patterns we observe are distinguishable from what state-directed activity would produce.
The Legal Framework
Three Laws, One Mandate
| Law | Article | Obligation | Scope |
|---|---|---|---|
| National Intelligence Law (2017) | Article 7 | "Any organization or citizen shall support, assist, and cooperate with state intelligence work" | All PRC organizations globally |
| National Intelligence Law (2017) | Article 14 | Intelligence agencies "may require relevant organs, organizations, and citizens to provide necessary support, assistance, and cooperation" | Compulsory โ no refusal mechanism |
| Cybersecurity Law (2017) | Article 28 | Network operators shall "provide technical support and assistance to public security organs and national security organs" | All network operators (cloud = operator) |
| Data Security Law (2021) | Article 36 | "Without approval of the competent authority, no organization or individual shall provide data stored within PRC to foreign judicial or law enforcement" | Blocks cooperation with Western investigations |
Note the asymmetry: Article 7 mandates cooperation with Chinese intelligence. Article 36 prohibits cooperation with foreign investigations. This is not a neutral regulatory framework โ it is a one-way valve.
The Golden Share Mechanism
State Control Without State Ownership
The "golden share" is China's innovation in corporate governance: a 1% equity stake held by a state-affiliated entity (typically CAC-backed) that carries board seat rights and veto powers over key decisions. Documented instances among our subjects:
| Company | State Mechanism | Source |
|---|---|---|
| Tencent | Beijing took golden share in Tencent subsidiary (Reuters) | Marketscreener/Reuters reporting |
| ByteDance | CAC-backed fund + 2 state entities acquired 1% with board seat in Beijing Douyin (domestic TikTok) | Business Insider, March 2023 |
| UCloud | STAR Market listed (688158.SH) โ full PRC securities regulation applies | Shanghai Stock Exchange filings |
The golden share creates a paradox: the company remains "privately owned" for international marketing, while the state holds structural veto over its operations. ByteDance disputes that this mechanism affects global operations. The dispute itself is irrelevant โ Article 7 applies regardless of ownership structure.
What Our Data Shows
Provider-Level Summary Under PRC Law
| Provider | IPs | Abuse=100 | Avg Threat | Legal Status | State Link |
|---|---|---|---|---|---|
| Tencent | 181 | 156 (86%) | 53.5 | PRC corporation + golden share | Board-level state control |
| UCloud | 147 | 48 (33%) | 25.7 | STAR Market listed (688158.SH) | Full PRC securities regulation |
| BytePlus | 50 | 29 (58%) | 39.6 | ByteDance subsidiary + golden share | CCP committee + board seat |
| Yisu Cloud | 35 | 16 (46%) | 35.8 | HK entity + PRC Cybersecurity Law | Seychelles opacity layer |
| CDS Global | 4 | 4 (100%) | 97.0 | US-registered, Chinese-operated | Tech contact in mainland China |
The Volt Typhoon Parallel
The CISA Finding
In February 2024, CISA, FBI, and NSA issued a joint advisory confirming that PRC state-sponsored actors (Volt Typhoon) had:
- "Compromised the IT environments of multiple critical infrastructure organizations" in the United States
- Used leased US VPS infrastructure from commercial cloud providers
- Employed "living off the land" techniques using legitimate tools
- Were "pre-positioning to launch future disruptive or destructive cyberattacks"
The pattern: state actors using commercial cloud infrastructure with jurisdictional layering to obscure attribution. This is not hypothetical โ it is documented, confirmed by Five Eyes intelligence agencies, and represents exactly the architecture we observe across all six providers in this series.
Structural Parallels: Volt Typhoon vs. Our Observations
| Characteristic | Volt Typhoon (CISA) | 031 Series Providers |
|---|---|---|
| Infrastructure | Leased US VPS from commercial providers | Singapore/HK/US shell entities of PRC parents |
| Jurisdiction | US-based servers for US targets | SG/HK registration for global attack surface |
| Attribution barrier | Commercial VPS = plausible deniability | Shell entity = "customer problem" |
| Scale | Critical infrastructure pre-positioning | 417 IPs, 253 at abuse=100, 336 in campaigns |
| Legal framework | NIL Art.7 compels cooperation | Same law, same companies, same obligation |
The APT Convergence
Five Groups, One Architecture
Our prior investigation (TI-2026-026O) documented that five previously distinct Chinese APT groups โ Volt Typhoon, Flax Typhoon, Salt Typhoon, APT40, APT41 โ have converged on identical infrastructure patterns:
- SOHO-device proxy mesh architecture (shared across all five)
- Living-off-the-land toolkits (identical LOTL patterns)
- Commercial cloud infrastructure as staging (the same providers)
- Jurisdictional layering for attribution denial
This convergence suggests not five independent operations, but different functions of a single integrated capability. The cloud providers in our series provide the substrate on which this unified architecture operates.
The Indistinguishability Problem
The Core Question
There are three possible explanations for what we observe:
- Commercial negligence: These providers simply fail to police their networks, and the attack traffic is from independent criminal actors renting infrastructure.
- State-enabled: The providers know but are compelled by Article 7 to provide passive cooperation โ non-interference with state-adjacent activity.
- State-directed: The infrastructure is purpose-built for intelligence operations, with the commercial cloud business serving as cover.
Our position: Under PRC law, these three scenarios are functionally indistinguishable from the outside. Article 7 mandates cooperation. Article 36 blocks disclosure. The golden share provides structural control. The jurisdictional layering prevents investigation. Whether the initial impulse is commercial or state-directed, the outcome is identical: attack infrastructure that cannot be stopped, investigated, or attributed.
The "Commercial Negligence" Hypothesis โ Stress Test
If this were purely commercial negligence, we would expect:
| Expected (negligence) | Observed (our data) | Assessment |
|---|---|---|
| Random abuse across customer base | 86% of Tencent IPs at abuse=100; 100% of CDS Global | Not random |
| Response to abuse reports | Zero response rate documented (Letter F) | Systematic non-response |
| No coordination between providers | 287 cross-ASN entity links, shared campaigns (Letter H) | Coordinated activity |
| Diverse abuse patterns | Same HASSH fingerprints across providers = same toolkits | Unified tooling |
| Some providers would respond to pressure | Data Security Law Art.36 legally prohibits cooperation | Structural impossibility |
Confidence: HIGH โ The "purely commercial negligence" hypothesis fails under five independent tests. The observed behavior is consistent with state-enabled or state-directed activity, and is inconsistent with what uncoordinated commercial negligence would produce.
The State-Adjacent Pattern
CCP Party Cells in Technology Companies
Every Chinese technology company above 50 employees is required to establish a CCP party cell (ๅบๅฑๅ ็ป็ป). These are not ceremonial:
- ByteDance: Confirmed CCP committee, subject of golden share mechanism
- Tencent: Party committee established, golden share in subsidiary confirmed by Reuters
- UCloud: STAR Market listing requires full party compliance reporting
The party cell provides an informal communication channel that operates parallel to corporate governance. Instructions conveyed through party channels leave no corporate paper trail. This is the mechanism by which Article 7 cooperation can be requested without generating discoverable evidence.
The Unfalsifiable Position
Why This Question May Be Unanswerable
The genius of the PRC legal framework is that it makes the state question structurally unfalsifiable from the outside:
- If a company cooperates with intelligence: it's obeying Article 7 (mandatory)
- If a company refuses foreign investigation: it's obeying Article 36 (mandatory)
- If no evidence of state direction exists: it was communicated via party channels (no paper trail)
- If the infrastructure looks commercial: that's the cover architecture (per Volt Typhoon precedent)
This is not conspiracy theory. This is the documented operational architecture confirmed by CISA, FBI, NSA, and Five Eyes intelligence services. The only question is scope: does it apply to these specific six providers, or only to the known APT groups? Under Article 7, the legal obligation applies equally to all.
Assessment
Graduated Confidence Levels
| Claim | Confidence | Basis |
|---|---|---|
| All 5 providers are subject to NIL Article 7 | CONFIRMED | PRC law applies to all PRC-origin organizations |
| State has structural control mechanism (golden shares) | HIGH | Reuters, Business Insider, regulatory filings |
| Attack patterns are inconsistent with pure negligence | HIGH | Cross-provider coordination, 86% abuse rate, shared toolkits |
| Providers are structurally incapable of cooperating with Western investigations | CONFIRMED | Data Security Law Art.36 explicitly prohibits it |
| Specific providers are actively state-directed (not just enabled) | LOW-MEDIUM | No direct evidence of specific tasking available to external researchers |
| The distinction between "enabled" and "directed" is operationally meaningful | LOW | Under Art.7, the outcome is identical regardless of initial impulse |
Methodology
This letter synthesizes: (1) PRC legal texts in official translation (chinalawtranslate.com), (2) CISA/FBI/NSA joint advisories on Volt Typhoon (AA24-038A), (3) Reuters and Business Insider reporting on golden share mechanisms, (4) 417 IPs tracked across 6 ASNs with enrichment from 12+ intelligence sources, (5) prior series letters A-H documenting cross-provider coordination, (6) 287 entity-link relationships spanning 9 relationship types. The state question is assessed at calibrated confidence levels โ we state what is confirmed, what is highly probable, and what remains structurally unknowable.