Counterintelligence — 2026-04-03

FBI Labels Suspected Chinese Hack of Surveillance Network a Major Cyber Incident

The FBI designated a suspected Chinese intrusion into its Digital Collection System Network (DCS-3000) as a major cyber incident, warning Congress the breach poses national security risks. The attack, detected February 17 through abnormal log activity, targeted an unclassified network containing call metadata, surveillance returns, and personal details of subjects under active FBI investigation. The system manages court-authorized wiretaps and foreign intelligence surveillance requests. The intrusion used tactics consistent with Salt Typhoon, the Chinese operation that penetrated major US telecommunications providers. A former FBI cyber division official said she was unaware of the Bureau making such a determination on a hack of its own systems since at least 2020.

Analysis
The DCS-3000 compromise is the most significant Chinese penetration of US law enforcement infrastructure since Salt Typhoon. The system manages FISA-authorized wiretaps, meaning Chinese intelligence may have gained visibility into which targets the FBI is surveilling and what collection is yielding. The counterintelligence implications are severe: subjects under surveillance could be warned, sources could be compromised, and operational tradecraft could be reverse-engineered.

2 sources