The usual collection mechanism is simple elicitation. The visitor may be asked to give a talk to his colleagues in China, who then pepper him with questions that might induce at least a small security breach on his part.