A photograph of a fighter jet. A fragment of radio traffic. The time an aircraft takes off. A glimpse of weapons moving inside a military base.
Each piece of information may appear insignificant on its own. Collected repeatedly and put together, however, those fragments can begin to reveal when forces move, how often aircraft operate and what patterns emerge around military exercises.
That is at the heart of what security researchers describe as China's "Thousand Grains of Sand" approach to intelligence gathering — relying not only on professional agents stealing highly classified secrets, but potentially on large numbers of people collecting small pieces of information.
“China uses an intelligence-gathering strategy that employs large numbers of nonprofessional amateur spies. This is called the ‘Thousand Grains of Sand’ approach,” Yun Min-woo, a professor of police science and security studies at Gachon University, wrote in a recent study.
“From this perspective, China assigns limited tasks to large numbers of people and sends them into a target country,” he said.
Recent security cases in South Korea suggest that the methods used to collect those pieces of information are also becoming more diverse.
According to the Gyeonggi Nambu Provincial Police Agency's Security Investigation Division, a foreign man in his 60s stayed at a hotel near Gunsan Airport in April and set up a receiving system consisting of an SDR receiver, antenna and laptop.
Gunsan Airport is home to South Korean air assets and the U.S. Air Force's Gunsan Air Base.
Police allege that the man used the equipment to illegally collect air traffic control communications between military aircraft pilots and controllers.
Unlike a conventional radio designed around particular frequencies or functions, software-defined radio (SDR) shifts much of the signal processing to software, allowing a computer-linked receiver to monitor and analyze a broader range of frequencies.
Police said the suspect was a retired member of his country's military.
Investigators also found that he had no previous record of entering South Korea before January 2024 but had since visited the country several times. Some of those visits coincided with periods when South Korean and U.S. air forces were conducting military exercises.
The suspect told investigators that listening to civilian aviation communications was a hobby and that he collected military communications because he wanted to listen to fighter aircraft.
Police are conducting forensic analysis of his hard drives and laptop to determine his motive and whether anyone was behind his activities.
No evidence has yet been made public showing that he was acting under the direction of a foreign government.
For counterintelligence officials, however, what information is collected may be only part of the picture. When it is collected can be just as important.
Yun said suspected intelligence-gathering incidents involving Chinese nationals in South Korea and overseas showed a recurring pattern: attempts to observe sensitive facilities often coincided with militarily significant events.
Cases examined in his study occurred around joint military exercises, missile interception tests, scheduled satellite launches and visits by major naval assets.
South Korean cases displayed similar characteristics.
“The timing also coincided with events such as military aircraft takeoffs and landings and the arrival of a U.S. aircraft carrier at the Republic of Korea Navy's operational headquarters in Busan.”
Repeated observations can therefore become more valuable than a single dramatic breach.
Yun suggests that the evolution is not unique to South Korea.
Of 34 suspected Chinese intelligence-related filming or intrusion cases examined in his research across the United States, Europe and the Indo-Pacific, 24 involved military-related targets, including air bases, naval facilities, training grounds, missile ranges, aircraft carriers, defense plants and a nuclear submarine shipyard.
What once largely involved photographs taken with smartphones or telephoto lenses has expanded to drones capable of approaching sensitive sites from the air.
Drones are also no longer limited to carrying cameras. Radio-detection equipment and other sensors can be mounted on unmanned platforms, allowing them to collect both visual information and electronic signals.
“In addition to cameras, drones can be equipped with radio-detection devices and sensors and used as multifunctional platforms,” Yun said.
He identifies electronic signals intelligence (SIGINT) as one potential function of drone-based intelligence collection.
“Electronic signals can be collected by detecting communications towers, radio frequencies and radar signals,” Yun said.
The concept is already moving into military applications.
At the Paris Air Show in June 2025, French defense company Thales unveiled a mini electronic warfare payload designed for drones that can passively detect and locate radio signals.
The United States has pursued a similar concept. In 2024, the U.S. Department of Defense funded a project called the “Low-Cost Open Source EW Drone,” aimed at combining a high-speed unmanned aircraft with commercially available SDRs, multiple antennas and an onboard processor.
The system was designed to identify radio-frequency signals in real time and explore techniques for locating the source of transmissions.
Such systems illustrate how drones and SDR technology can change intelligence collection. A drone carrying a camera can show what is happening at a military facility, while a radio frequency (RF) sensor can add another layer by indicating where transmissions originate and when radio activity increases.
That makes the distinction between professional espionage equipment and everyday civilian technology increasingly blurred.
The advantage of small pieces
The “Thousand Grains of Sand” concept helps explain why intelligence services may value information that appears mundane.
Instead of depending entirely on a highly trained agent penetrating a secure headquarters and stealing a top-secret document, a broader collection network can accumulate many lower-level observations.
“Even if these amateur spies are detected, arrested, deported or punished, there is virtually no spy asset for the Chinese authorities to lose,” Yun wrote.
He added that when such actors claim they were merely tourists, students or hobbyists, proving a connection to a state intelligence organization can be difficult.
That ambiguity has appeared repeatedly in cases examined in his study.
People caught filming sensitive facilities have offered explanations ranging from tourism and curiosity to an interest in aircraft or scenery. Yun argues that investigators should therefore look not only at an individual's explanation but also at repetition, equipment, location and timing.
That does not mean every Chinese tourist operating a drone or photographing an aircraft is engaged in espionage. Establishing state direction requires evidence in each case.
But Yun argues that repeated incidents involving similar targets should not automatically be assessed in isolation.
“Recent unauthorized drone-filming incidents by Chinese nationals should not be understood as individual episodes but rather as part of interconnected and continuing operations within the overall picture,” he said.
Counterintelligence moves outside the fence
The evolving methods pose a particular problem for South Korea because much of conventional military security is designed around controlling physical access.
Fences, gates, guards and restricted zones can prevent unauthorized individuals from entering a base.
They do much less against someone staying in a nearby hotel with a radio receiver, operating a camera from a public location or flying a small drone near a sensitive facility.
Yun argues that drones could even provide information about a target's security response itself, including its radio environment, detection capabilities and response procedures.
The security perimeter may therefore effectively extend beyond the military installation itself.
Until now, authorities investigating suspected intelligence activities involving countries other than North Korea have often had to rely on other criminal provisions, including Article 99 of the Criminal Act and laws governing military facilities and communications.
The new law may provide investigators with stronger legal tools.
But technology is evolving alongside the law.
“As far as we understand, the case is currently under investigation by the police,” a vice spokesperson at the South Korean Defense Ministry said at a regular briefing Thursday. “The Ministry of National Defense has nothing further to add at this time.”
Copyright ⓒ Aju Press All rights reserved.