Chinese spy balloon used a U.S. internet provider to communicate

WASHINGTON — U.S. intelligence officials have determined that the Chinese spy balloon that flew across the U.S. this year used an American internet service provider to communicate, according to two current and one former U.S. official familiar with the assessment.

The balloon connected to a U.S.-based company, according to the assessment, to send and receive communications from China, primarily related to its navigation. Officials familiar with the assessment said it found that the connection allowed the balloon to send burst transmissions, or high-bandwidth collections of data over short periods of time.

The Biden administration sought a highly secretive court order from the federal Foreign Intelligence Surveillance Court to collect intelligence about it while it was over the U.S., according to multiple current and former U.S. officials. How the court ruled has not been disclosed.

Such a court order would have allowed U.S. intelligence agencies to conduct electronic surveillance on the balloon as it flew over the U.S. and as it sent and received messages to and from China, the officials said, including communications sent via the American internet service provider.

The company denied that the Chinese balloon had used its network, a determination it said was based on its own investigation and discussions it had with U.S. officials.

NBC News is not naming the provider to protect the identity of its sources.

A National Security Council spokesperson referred questions to the national intelligence director’s office. It declined to comment.

Liu Pengyu, a spokesperson for the Chinese Embassy in Washington, said it was a weather balloon that accidentally drifted into American airspace.

“As we had made it clear before, the airship, used for meteorological research, unintentionally drifted into U.S. because of the westerlies and its limited self-steering capability,” Liu told NBC News in a statement. “The facts are clear.”

Chinese intelligence officials have covertly used commercially available service providers in various countries in the past, often as backup communication networks, according to multiple former U.S. officials. They frequently seek out encrypted networks or ones with strong security protocols so they can communicate securely, the officials said.

The previously unreported U.S. effort to monitor the balloon’s communications could be one reason Biden administration officials have insisted that they got more intelligence out of the device than it got as it flew over the U.S.

Senior administration officials have said the U.S. was able to protect sensitive sites on the ground because they closely tracked the balloon’s projected flight path. The U.S. military moved or obscured sensitive equipment so the balloon could not collect images or video while it was overhead.

After the balloon was shot down on Feb. 4, Gen. Glen VanHerck, the commander of North American Aerospace Defense Command, or NORAD, told reporters that the U.S. military and intelligence community had taken exhaustive steps to protect against the balloon’s ability to collect intelligence.

“We took maximum precaution to prevent any intel collection,” VanHerck said at a briefing. “So that we could take maximum protective measures while the balloon transited across the United States.”

In an exclusive interview this month, VanHerck said he worked together with U.S. Strategic Command, which oversees U.S. nuclear weapons, to reduce the release of emergency action messages to ensure the Chinese balloon could not collect them.

“We took action to put capabilities away, whether that be airplanes, ballistic missiles in our missile fields,” VanHerck said. “We limited our emission of emergency action messages that could be potentially collected on.”

Emergency action messages, or EAM, are how U.S. leaders communicate with strategic forces all around the world. The messages, which are highly classified, can include directing nuclear-capable forces on response options in the case of a nuclear war.

“Protecting EAM and nuclear command and control communications is of critical importance to the United States,” a senior defense official said. 

After the balloon was shot down, a senior State Department official said that it was used by China for surveillance and that it was loaded with equipment able to collect signals intelligence.

The balloon had multiple antennas, including an array most likely able to collect and geolocate communications, the official said. It was also powered by enormous solar panels that generated enough power to operate intelligence collection sensors, the official said.

Defense and intelligence officials have said the U.S. assessment is that the balloon was not able to transmit intelligence back to China while it was over the U.S.

The FBI forensics team that examined the balloon after it was shot down completed a classified report about the equipment it carried, according to multiple U.S. officials. Its findings remain secret and have not been widely briefed.

Federal judges on the surveillance court, where proceedings are held in secret, must determine whether there is probable cause that the surveillance target is a foreign power or a foreign agent and that the surveillance is necessary to obtain foreign intelligence information. The court’s rulings are classified.