Several clients in the legal and financial sectors.
In Hong Kong in 2019, the government was in the process of implementing a new extradition bill, which would allow for suspected political offenders to be removed to mainland China. There were strong objections of human rights and freedom of speech in Hong Kong as a result, which led to initially peaceful protests.
The protests started low level until June 2019, when a large protest of 1million people was organised over a number of days. Later in the week, violence erupted outside a government building; this escalated rapidly and protestors retaliated, causing parts of the business district in Hong Kong to become locked down. This impacted several Mitie customers as violence was in close proximity to their offices. Most property damage was against businesses connected to mainland China, which impacted one Mitie customer in particular. The scope of the protest and the violence became a consistent feature and some customers started to consider moving out.
Through our investigation into the region we found evidence to suggest activists were creating homemade caltrops to try and disable vehicles, roads were being blockaded with makeshift barricades and even improvised weaponry was being designed and technical drawings shared amongst activists. As protests developed, we even observed some deployment of homemade explosives and improvised explosive devices (IEDs), and some hoax IEDs, suggesting the situation was escalating and could develop into an insurgency, rather than just civil unrest.
The GSOC produced a report specifically on this threat from explosives/IEDs because of the escalation in risk. Chinese military forces were also massing on the border and it looked as if a Chinese incursion into Hong Kong could occur, which would have drastically altered the security situation in the region, so something we monitored closely to keep our customers informed.
Whilst monitoring the situation, one of the key challenges that initially faced the team was that Hong Kong students used a lot of slang when describing planned actions, because they wanted to evade Chinese surveillance. This presented a number of challenges for us, because literal translations would often not make any sense. We had to quickly learn and understand the local slang dialect being used before we could make sense of the intelligence and extract value.
The Global Security Operations Centre reached out to contacts in the region to assess which social media platforms were being used to promote the protests among the public. One of our Customer Intelligence Analysts is skilled in both speaking and reading Chinese, and began identifying where activists were planning various demonstrations so that we could identify potential flash points for violence days before they occurred.
In order to ensure effective coverage outside of that analyst’s working hours, they created cheat sheets with related hashtags, local media sources, local journalists, live streamers and local commentators and where to find new feeds, so that all of our Intelligence Analysts without Chinese language skills could monitor protests live. The Chinese speaking analyst continued to support with detailed hand overs and continued analysis of the evolving situation. They spent a lot of time translating the content, being created primarily by HK students, and then ‘deciphering’ the coded language and the slang being used. We also identified several Telegram channels being used to share protest promotion posters anonymously, allowing the GSOC to identify muster points, march routes and targets quickly.
This approach enabled the Global Security Operations Centre to produce and deliver regular daily alerts, live updates of the protests, escalations in violence and the areas of the city most impacted. These alerts were available for customers to access at any time, providing them valuable insights whenever they needed them.
Due to our Intelligence Analysts excellent analytical work, our existing customers who benefitted from the intelligence expanded their UK based services, to take on additional support to focus their interests in Hong Kong. This was extremely well received by the customers global security teams and their colleagues in the impacted areas as it meant better planning for their daily work routines and enabled them to identify and assess potential further escalations in violence. The continued support of our Intelligence Analysts enabled our customers to safely continue their business activity ultimately without the need to withdraw staff from Hong Kong.
We also pro-actively identified one employee of a GSOC customer who appeared in some activist videos online being arbitrarily arrested and the victim of excessive force by Hong Kong police for alleged involvement in riots. We didn’t have all the information, but it appeared they had been unfairly detained and so we alerted our customer so they could attempt to ascertain the whereabouts and status of their employee, providing added value in our monitoring and analysis of the ongoing events.