May 14, 2026

An American president, his cabinet and the CEOs of Apple, Nvidia and BlackRock just walked into China carrying disposable electronics and paper documents. A decade of breaches explains why.   There is a photograph you will never see from this week’s summit. It is the one where a senior American official plugs a phone into a Beijing hotel wall charger, checks the morning’s emails, and scrolls through the news over coffee. That photograph does not exist because the phone does not exist. It was left behind, thousands of miles away, by design. When Trump’s delegation landed at Beijing Capital International Airport on Wednesday evening, greeted by Vice President Han Zheng and a military honour guard, its members carried temporary laptops, stripped-down handsets and the quiet understanding that anything electronic brought into the country should be treated as already compromised. Paper briefings replaced cloud documents. Tightly managed channels replaced encrypted apps. Even charging a device became a calculated risk, because in the lexicon of modern espionage, a USB port in a foreign hotel is not a convenience. It is a mouth. The delegation observing this protocol included the chief executives of Apple, Nvidia, Boeing, Qualcomm and BlackRock, people who collectively architect the digital world, now travelling through it as though it could not be trusted. When Tim Cook agrees to leave his iPhone at home, something fundamental has shifted. To understand how Beijing earned this reputation, you have to go back roughly a decade, to a breach so large it redrew the boundaries of what state-sponsored hacking could achieve. In the spring of 2015, investigators discovered that operatives tied to China’s Ministry of State Security had been living inside the computer systems of the United States Office of Personnel Management for the better part of a year. By the time anyone noticed, some 22.1 million records had walked out the door: security clearance applications, background checks, personal histories of federal employees and their families, even 5.6 million sets of fingerprints. Biometrics experts warned that American officers under cover could now be identified by touch alone, even after changing their names. The Director of National Intelligence, James Clapper, offered a remark that has aged into something between admiration and elegy. You had to, he said, “kind of salute the Chinese for what they did.” OPM was a watershed, but also a prologue. The breach followed a recognisable grammar: get in, steal files, get out. What came next did not. In 2023, Microsoft and the Five Eyes alliance named a campaign called Volt Typhoon. Run by a unit linked to the People’s Liberation Army, it had spent years embedding itself inside American critical infrastructure, not to steal data, but to wait. Power grids. Water treatment plants. Ports. Pipelines. The technique, “living off the land,” used the target’s own tools to avoid detection, leaving behind what National Security Advisor Mike Waltz would later call “cyber time bombs.” The purpose was not espionage. It was preparation, the digital equivalent of mining a bridge in peacetime. Then came Salt Typhoon, disclosed in late 2024, and with it a kind of vertigo. The campaign had penetrated more than 200 targets across 80 countries, including nine American telecommunications firms: Verizon, AT&T, T-Mobile and others that together carry the bulk of the nation’s calls and messages. It had run undetected for at least a year. Among the communications reportedly swept up were those of Donald Trump himself, and of JD Vance. A former NSA analyst called it “a component of China’s 100-year strategy.” Ciaran Martin, who built Britain’s National Cyber Security Centre, called the broader shift “the most important change in the cyber threat to the West in more than a decade.” Line these campaigns up and what emerges is not a list of incidents but an arc. Beijing began by stealing personnel files, moved to occupying the machinery of daily American life, and arrived at a place where it could listen to the calls of a future president. Each phase more ambitious, more patient, harder to detect. The Office of the National Cyber Director now frames China’s objective in language that reads less like policy and more like doctrine: to “hold at risk U.S. and allied critical infrastructure” and “shape U.S. decision-making in a time of crisis.” Washington’s response runs on two clocks. The fast one produced the rituals visible this week: clean devices, paper trails, communications routed through government channels. Security as choreography. The slow clock is institutional, and here the story knots. The administration has sanctioned front companies tied to Chinese intelligence, offered a ten-million-dollar bounty on Salt Typhoon operatives, and stood up a Cyber Unified Coordination Group. Yet it has also cut the Cybersecurity and Infrastructure Security Agency’s workforce by nearly a third, the very body defending the networks these campaigns target. You cannot sharpen the sword and blunt it at the same time. The optics of this week carry a weight no communiqué will acknowledge. A president whose own phone was reportedly accessed by Chinese intelligence shakes hands in the Great Hall of the People with the leader of the state that authorised the operation. Beside him sit executives whose fortunes depend on the Chinese market, carrying phones they will discard the moment they leave. Between the paper briefings, the disposable laptops and the silent handsets sits the uncomfortable truth of the relationship: the world’s two largest economies are bound at the hip, and one has spent a decade learning to pick the other’s pockets. Every burner phone in that motorcade is a quiet confession. The Americans know what China can do. They have seen the proof, in 22 million stolen records, in dormant code inside water systems, in phone calls never meant to be heard. And the best they can manage, for now, is to walk into the room carrying nothing worth stealing.