Relationship established
A customer, supplier, research partner, investor, recruiter, conference organizer, visiting scholar, or prospective collaborator establishes a legitimate reason to engage.
Pattern model
The relationship is not the risk. Ungoverned access is.
A regular analytical sequence makes otherwise different records easier to compare. It is a diagnostic structure—not proof that every stage occurred and not a claim that every Chinese partner, researcher, employee, or institution follows it.
01
The transfer framework
Six questions leaders can ask
Each dossier answers the same six questions and labels the evidence at every stage. A stage may be established, inferred, alleged, disputed, interrupted, or not established; blank evidence is never converted into a completed transfer.
Sensitive access gained
The relationship reaches people, laboratories, repositories, samples, prototypes, manufacturing floors, vendor lists, work devices, or the tacit knowledge that makes a process work.
Information acquired
Information is requested, copied, memorized, downloaded, photographed, exported, reverse engineered, or obtained through an insider. The conduct can range from contractual learning to criminal theft.
Assets moved
Files, samples, knowledge, equipment, or personnel move across organizational or national boundaries—sometimes through personal accounts, travel, outside companies, or affiliated institutions.
Downstream use assessed
The record may establish, support an inference, allege, dispute, or fail to establish that a recipient integrated the asset into research, manufacturing, products, bids, training, standards, or further collection.
Consequences assessed
The record may document loss, attribute an estimate, identify potential harm, show that intervention interrupted the path, or leave consequences unknown. A completed harm is never assumed.
Signals worth combining
One signal is often ordinary. Corroborated combinations can be probative.
A conference invitation, a large download, a new outside company, or a departing engineer can each be benign. A supported inference requires more than nationality, destination, or product similarity: it needs evidence tying access, protected material, conduct, movement, technical correspondence, deception, or multiple corroborating records together.
Relationship signals
- Invitations whose host, funding source, or agenda cannot be independently verified
- Stipends, travel, gifts, appointments, or equity not disclosed through required channels
- Pressure to route agreements through personal accounts, affiliates, or unfamiliar intermediaries
Access signals
- Requests for source code, file directories, unpublished protocols, supplier identities, or work devices beyond the stated purpose
- Bulk access inconsistent with role, project phase, or previous behavior
- Efforts to bypass material-transfer, export, licensing, visitor, or clean-device processes
Movement and use signals
- Personal cloud, removable media, unusual printing, photography, or unexplained sample movement
- New products, patents, job postings, or company claims that closely track protected work
- A customer reducing purchases while recruiting key staff or requesting deeper technical access