Over the past decade, the People’s Republic of China (PRC) has undertaken a sweeping reform of its cyber reserve forces, transforming its cyber militia system from a peripheral asset into a strategically relevant component of the People’s Liberation Army’s (PLA’s) broader cyber warfare architecture. Within China, cyber militias are paramilitary units composed of civilian volunteers operating under the dual leadership of local governments and the PLA. These units are organized by civilian work units (e.g. state-owned enterprises, universities, and the commercial technology sector) and are principally tasked with supporting the defense of critical network infrastructure, logistics systems, and communications platforms. While historically the role of cyber militia forces has been largely auxiliary in nature, they increasingly function as a regularized reserve force that trains alongside active-duty PLA units and that are integrated into Theater Command-level operational planning.
This report presents the first detailed study of China’s cyber militia system since 2015. It draws from an analysis of 136 individual militia units, as well as authoritative Chinese-language military writings and mobilization documents in order to detail the structure, evolution, and operational role of China’s modern cyber militia system. The report’s key findings are as follows:
The Party-state’s ongoing reforms to China’s cyber militia system have greatly increased PLA network warfare resilience and surge capacity.
● China’s cyber militia system provides the PLA with a scalable reserve force capable of expanding operational capacity in the network domain with minimal lead time. Unlike conventional reserve formations, which require intensive training in weapons systems and field operations, cyber militia units draw on civilian personnel who already possess high-value technical expertise in offensive cyber operations, network reconnaissance, and systems exploitation.
● As a result, the functional divide between China’s active-duty cyber forces and its militia-based reserves is far narrower than in traditional military domains. Select militia units can pivot from rear-echelon support roles to frontline operational functions with little latency, allowing the PLA to surge capacity for broader, more sustained cyber campaigns at a scale that would otherwise be difficult to achieve using uniformed forces alone.
Cyber militia forces function as a key supplement to the PLA in high-risk contingencies such as cross-Strait operations or flare-ups in the South China Sea.
● PLA military officials and defense academicians have identified cyber militia forces as a vital supporting force for network operations in specific scenarios, such as a future Taiwan invasion contingency or crisis in the South China Sea. These units’ familiarity with relevant local civilian networks, distributed architecture, and flexibility of employment offer the PLA a means of shoring up over-stretched active-duty units during periods of high demand.
● Authoritative PLA commentary suggests that these units will be used not only for rear-area support but also to supplement offensive cyber missions in South China Sea and cross-Strait scenarios. Cyber militia units train regularly in simulated offensive and defensive cyber operations and are expected to participate in tasks such as deception operations, public opinion control, and technical support for island landings and maritime operations.
China’s cyber units are becoming more professionalized and diversified, with participation expanding beyond universities and SOEs to include elite commercial cybersecurity firms.
● Since 2018, the Party-state has implemented reforms to China’s cyber militia structure that dictate stricter recruitment quotas, more regular joint exercises with PLA units, and more standardized training procedures. These policy “sticks” are accompanied by a number of “carrots” including incentives such as tax breaks, procurement preferences, and political branding in order to encourage participation from high-end private cybersecurity firms.
● Cyber militia units such as those operated by Antiy Labs and Qihoo 360 represent the vanguard of this effort. Such units contribute personnel, tools, and infrastructure to the PLA’s mobilization system. These partnerships blur the line between state and private cyber capabilities and suggest that Chinese cybersecurity firms with global commercial reach may act as vectors for state-aligned operations in a conflict.
Read the Full Report:
The accompanying data set for the report is available here:
An interactive map showing the locations and identifying details of the militia units surveyed for this report is available here:
