I remembered thinking that this was good, a well crafted, researched targeted attack and I wouldn't say I was impressed but maybe my blood ran a little cold recognizing how sophisticated cyber attacks can be and there was no question to deny that it must be a Chinese government backed attack.

In the aftermath of the 2008 Beijing Olympics, Chinese authorities waged a brutal crackdown in Tibet, leading to arrests of thousands of Tibetans and the deaths of over 100 Tibetans¹². Beyond those involved in the 2008 protests, Tibetan writers, singers, and educators became prime targets of repression¹³. A report from the International Campaign for Tibet (ICT) published on March 9, 2009 revealed that around 600 Tibetans have been detained as political prisoners since March 2008¹⁴.

2009 marked a somber turn for Tibetans when a 20-year-old monk from Kirti monastery named Lobsang Tashi (or Tapey to his friends) self-immolated in protest against Chinese policies. As his body burned in protest, Chinese police shot him and took him into custody.¹⁵ His protest was understood as a plea for international attention to China’s oppressive measures in Tibet.

Over the next nine years, 158 more Tibetans self-immolated, calling for the return of His Holiness the Dalai Lama and freedom for Tibet. This unprecedented series of self immolations was a major turning point for the Tibet movement as it demonstrated the extreme levels of repression Tibetans in Tibet were under and the measures they were prepared to take to bring attention to the dire human rights situation.

During this time, like all leaders in the Tibet Movement, Lhadon Tethong, the Director of Tibet Action Institute paid close attention to the self-immolations and worked tirelessly to bring international attention to them.

In February 2012, Lhadon received an email that appeared to come from Cheng Li, a notable Chinese-American scholar who was Director of Research at The Brookings Institution, a Washington DC-based think tank. In the email, Mr. Li explained to Lhadon that he would be attending an academic conference on religious research in Shanghai and would like to learn more about Tibetan self immolations. The email included a spreadsheet that Mr. Li explained listed Tibetans who had self-immolated since 2009. He asked Lhadon to review the document for him.

On the first read Lhadon was enthusiastic about this request from a prominent China expert. However, she quickly determined that the email was not sent from the real Cheng Li. A telltale sign was that the email was sent from a suspicious looking email account (chengli.brookings@ aol.com).

As a leader in the Tibet movement Lhadon had become accustomed to receiving emails with malicious files and messages designed to entice her to open them. The constant targeting she experienced made her weary of any messages she received. While these types of emails were routine to Lhadon, this particular message left her feeling vulnerable.

Lhadon sent the email to researchers at the Citizen Lab who verified the attachment contained malware designed to infect computers running Windows.¹⁶ This finding confirmed Lhadon’s suspicions the email was a clever attempt at breaking into her computer and spying on her.

Following this revelation, Lhadon and the Citizen Lab researchers devised their own ruse to turn the table on the attackers. Lhadon wrote back to “Cheng Li” with some information about the type of computer she was using as bait that the attackers may be interested in.

"Thank you for your inquiry. I’d be happy to help out–I’m having trouble opening the document on my Mac though, I think there may be an issue with the Chinese character font? I think if you sent me a Word version that might be easiest, as it would also allow me to make comments in the document."

A few days later the Cheng Li imposter wrote back with a polite message apologizing for the delay in replying and noting he still had to prepare his report on self immolations so there was time for Lhadon to send him comments. The email included a link to a report that was in fact directed towards a website that would serve the visitor malware for windows or a Mac depending on the computer they were using. This response led Lhadon and the Citizen Lab researchers to conclude that the attackers had taken the bait they left in her message.

Lhadon’s response included that she was using a Mac, and they likely spent the next four days putting together malware that could infect Mac computers. This digital espionage attempt stood out for the social engineering used to convincingly masquerade as Cheng Li and the technical adaptations the attackers made in real time in hopes of getting access to Lhadon’s communications and data.

While tricking the attackers was an empowering moment, overall the experience left an emotional toll on Lhadon.

"The attack left me reeling, shattering my sense of security and trust in my online interactions. It amplified my feelings of vulnerability and paranoia. Considering the confidential nature of my work, the breach threatened to compromise sensitive information, adding another layer of anxiety to my already demanding role."