PLA Strategic Support Force

Overview

The People's Liberation Army Strategic Support Force (Zhanlue Zhiyuan Budui, SSF) was a service-level branch of the People's Liberation Army established in December 2015 and operating until April 2024, when it was reorganised into three new PLA arms. During its eight-year existence the SSF consolidated, under a single Central Military Commission–subordinate command, the principal Chinese military capabilities in space operations, cyber operations, signals-intelligence collection, electronic warfare, and psychological-operations / political-warfare functions — capabilities the Chinese military doctrine of the period described as "strategic frontier" and "informatised" warfighting domains.¹

The Force was structured around two principal departments at its founding: the Space Systems Department, responsible for space and counter-space operations, and the Network Systems Department, responsible for cyber, signals-intelligence, electronic-warfare, and psychological-warfare functions. The Network Systems Department absorbed the long-established cyber and signals units of the former Third Department (3PLA) and Fourth Department (4PLA) of the General Staff Department.²

The April 2024 reorganisation, announced personally by Chairman of the Central Military Commission Xi Jinping on 19 April 2024, abolished the SSF as a single service-level branch and replaced it with three independent branches: the Information Support Force (Xinxi Zhiyuan Budui), the Aerospace Force (Junshi Hangtian Budui), and the Cyberspace Force (Wangluo Kongjian Budui), each reporting directly to the Central Military Commission.³

History & Origins

The SSF was established on 31 December 2015 as part of the comprehensive reorganisation of the PLA announced by Chairman Xi Jinping in November 2015. The reform abolished the four General Departments — General Staff, General Political, General Logistics, and General Armaments — that had structured the PLA since the Cultural Revolution, replacing them with fifteen functional departments and offices under the Central Military Commission. It transitioned the operational command structure from seven military regions to five theatre commands and established two new service-level branches — the SSF and the Joint Logistic Support Force.⁴

The institutional lineage of the units that made up the SSF was substantially older. The Third Department of the General Staff Department (3PLA) had been the lead Chinese signals-intelligence service since the founding of the People's Republic, with reported origins in the wartime cryptanalytic units of the Communist Party. The Fourth Department of the General Staff Department (4PLA) had been responsible for electronic warfare and electronic counter-measures. Specific 3PLA units — most prominently Unit 61398 in Shanghai and Unit 61486, also Shanghai-based — had been the subject of Western government and private-sector cyber-attribution work for many years before the SSF was established.⁵

The 2024 reorganisation reflected a Chinese military judgment that the SSF model — one branch combining space, cyber, and information operations — had not produced the desired institutional integration and that separate branches with independent CMC reporting would better support warfighting requirements. Western analytical reception of the change has emphasised the elevation of the Information Support Force in particular, reflecting Chinese doctrinal emphasis on "informatised" warfighting.⁶

Mandate & Jurisdiction

The Force's authorities derived from Central Military Commission orders implementing the December 2015 reform and from the Outline of National Defense Industrial Base Construction. Its core functions were:

• space situational awareness, satellite reconnaissance, and counter-space operations through the Space Systems Department;
• offensive and defensive cyber operations, including computer network exploitation, computer network attack, and computer network defence, through the Network Systems Department;
• signals-intelligence collection at the strategic and operational levels;
• electronic-warfare and electronic counter-measure operations supporting PLA combat formations;
• psychological-warfare and "three warfares" operations integrating media, legal, and psychological elements in support of strategic objectives.⁷

After the April 2024 reorganisation, these functions were redistributed to the three new branches, each of which reports directly to the Central Military Commission rather than through a consolidated command.

Notable Operations

Alleged Unit 61398 / APT1 / Comment Crew (cyber operations). PLA Unit 61398, based in Shanghai's Pudong New Area, was the subject of Mandiant's February 2013 APT1: Exposing One of China's Cyber Espionage Units report, which attributed sustained cyber-intrusion operations across multiple sectors of the US economy to the unit. In May 2014 the United States Department of Justice unsealed an indictment against five named Unit 61398 officers — Wang Dong, Sun Kailiang, Wen Xinyu, Huang Zhenyu, and Gu Chunhui — on charges including economic espionage and computer fraud. The case was the first Western criminal indictment of named foreign-state cyber officers; the defendants remain at large.⁸

Alleged Unit 61486 / APT2 / Putter Panda — cyber operations. Unit 61486, also based in Shanghai, was identified by CrowdStrike's June 2014 Hat-tribution to PLA Unit 61486 report as the unit responsible for the cyber-intrusion set tracked as Putter Panda / APT2. Operations attributed to the unit included sustained intrusions into US, European, and Japanese aerospace, defence, and satellite-communications targets. The unit has been under sanctions by the United States Department of the Treasury.⁹

Alleged APT41 / Wicked Panda / Barium — cyber operations. The cyber-intrusion set tracked as APT41, attributed by Western government and private-sector reporting to Chinese state actors with links to MSS-affiliated contractors and PLA-related operators. The September 2020 US Department of Justice indictment named five Chinese nationals associated with APT41 on charges including computer fraud, aggravated identity theft, and money laundering relating to intrusions into more than 100 organisations.¹⁰

Confirmed Anti-satellite testing. China's anti-satellite (ASAT) testing programme — including the January 2007 destruction of the Fengyun-1C weather satellite, the May 2013 high-altitude DN-2 test, and successive co-orbital and direct-ascent tests — was, prior to 2015, the responsibility of PLA Second Artillery Corps and General Armaments Department units. From 2015 to 2024, the SSF's Space Systems Department was the lead organisation; from April 2024, the new Aerospace Force has the role. The 2007 test produced approximately 3,500 pieces of trackable orbital debris and was the largest single contributor to low-earth-orbit debris in the history of human spaceflight.¹¹

Alleged Operations against Taiwan. The pattern of Chinese cyber, signals-intelligence, and information-operations activity directed at Taiwan — extensively documented by Taiwan's National Security Bureau, the Ministry of National Defence, and successive private-sector reports — has been attributed in substantial part to SSF and successor units. The 2022 Taiwan presidential office cyber-attack and the sustained pattern of PLA cyber operations against Taiwanese government and critical-infrastructure targets are described in successive Taiwan National Security Council and US-Taiwan Business Council assessments.¹²

Controversies & Abuses

Alleged Industrial-scale cyber espionage against Western technology and defence sectors. The pattern of cyber-intrusion operations attributed to PLA cyber units across the period from approximately 2003 through the present — initially focused on US and Western government and defence targets, expanding into commercial intellectual-property theft from approximately 2010, and shifting toward strategic targets after the 2015 US–China cyber agreement — has been the subject of sustained Western governmental and analytical attention. The 2015 US–China cyber agreement reduced the public tempo of commercial-IP-theft attribution but, by Western and private-sector accounts, did not eliminate the underlying activity.¹³

Alleged Targeting of Western critical infrastructure. The 2024 US Cybersecurity and Infrastructure Security Agency advisories on the cyber-intrusion set tracked as Volt Typhoon — which CISA assesses as PLA-affiliated — described a pattern of pre-positioning intrusions into US critical-infrastructure networks (water, power, transportation) that, in CISA's assessment, was consistent with preparation for disruptive operations in a future contingency. Volt Typhoon attribution to PLA units has been described in CISA, NSA, FBI, and partner-agency advisories.¹⁴

Notable Figures

• Gao Jin — First Commander, PLA Strategic Support Force, December 2015 – August 2019.
• Li Fengbiao — Commander, August 2019 – ?.
• Ju Qiansheng — Commander, identified at successive public events 2021–2024.
• After the April 2024 reorganisation, the senior commanders of the three new branches — Information Support Force, Aerospace Force, and Cyberspace Force — were named in succession at public PLA events through 2024.

Oversight & Accountability

Oversight of the SSF and its successor branches is exercised by the Central Military Commission of the Communist Party of China. Like other PLA elements, the Force has not been subject to civilian-style external audit; Communist Party discipline-inspection mechanisms — including, since 2018, the National Supervisory Commission — have authority over PLA personnel, but their findings are not publicly disclosed in detail.

The 2018 ratification of the National Intelligence Law of the People's Republic of China provided the legal framework for the cooperation of Chinese citizens and entities with state intelligence work, including PLA cyber and signals operations. The boundary between PLA cyber operations and MSS- or contractor-conducted operations is administratively defined but, in the public record, frequently contested.¹⁵

Sources & Further Reading

1. John Costello and Joe McReynolds, China's Strategic Support Force: A Force for a New Era, China Strategic Perspectives 13 (National Defense University Press, 2018); Elsa B. Kania, "PLA Strategic Support Force: The 'Information Umbrella' for China's Military," Diplomat, 1 April 2017.
2. Costello and McReynolds, op. cit.; Mark A. Stokes and Russell Hsiao, The People's Liberation Army General Political Department: Political Warfare with Chinese Characteristics (Project 2049, 2013).
3. Xinhua News Agency, "Xi attends ceremony establishing new PLA arms," 19 April 2024; PLA Daily, coverage of the reorganisation, April 2024; M. Taylor Fravel, "China's Strategic Support Force is no more — what does the change mean?," War on the Rocks, May 2024.
4. Office of the Secretary of Defense, Annual Report to Congress: Military and Security Developments Involving the People's Republic of China, successive editions; Phillip C. Saunders et al. (eds.), Chairman Xi Remakes the PLA: Assessing Chinese Military Reforms (NDU Press, 2019).
5. Mark A. Stokes, Jenny Lin, and L. C. Russell Hsiao, The Chinese People's Liberation Army Signals Intelligence and Cyber Reconnaissance Infrastructure (Project 2049, 2011).
6. M. Taylor Fravel, op. cit.; Joel Wuthnow, "China's New Information Support Force," China Brief, Jamestown Foundation, 2024.
7. Costello and McReynolds, China's Strategic Support Force; PLA Daily articles on SSF doctrine, 2016–2023.
8. Mandiant, APT1: Exposing One of China's Cyber Espionage Units, 19 February 2013; United States v. Wang Dong, Sun Kailiang, Wen Xinyu, Huang Zhenyu, and Gu Chunhui, indictment, W.D. Pa., 1 May 2014.
9. CrowdStrike, Hat-tribution to PLA Unit 61486, 9 June 2014.
10. United States v. Zhang Haoran et al., indictment, D.D.C., 16 September 2020.
11. Brian Weeden, "2007 Chinese Anti-Satellite Test Fact Sheet," Secure World Foundation, 23 November 2010; CSIS Space Threat Assessment, successive editions.
12. Taiwan National Security Bureau and Ministry of National Defence, annual reports; US–Taiwan Business Council, Taiwan Cybersecurity assessments, 2018–present.
13. National Counterintelligence and Security Center, Foreign Economic Espionage in Cyberspace, 2018; ODNI, Annual Threat Assessment of the U.S. Intelligence Community, successive editions.
14. CISA / NSA / FBI / partner-agency Joint Cybersecurity Advisory AA24-038A, "PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure," 7 February 2024.
15. National Intelligence Law of the People's Republic of China (2017); National Supervision Law of the People's Republic of China (2018).