XI JINPING’S first meeting with President Obama as head of state on June 7th is also the first such summit to feature prominently the issue of alleged Chinese cyber-attacks on American companies and interests. It has taken a long time for the issue to take centre stage in diplomatic relations between the two countries. After years of ineffectual and perhaps overly discreet grumbling about Chinese hacking, American officials are finally forcing the issue.
The prospects for effective public diplomacy on hacking appear grim. The Americans have placed some hope in “naming and shaming” China for hacking, and in recent months there has been no shortage of that. Senior American officials, big Western news media and Mandiant, a security firm, have issued a series of detailed reports and accusations of widespread Chinese hacking: of defence industry technology, of energy companies, of blueprints for American infrastructure, and of the e-mail systems of American officials and journalists. Mandiant’s report in February traced many attacks to the area around a People’s Liberation Army facility in Shanghai.
Here we go again
- From pivot to twirl
- Admit nothing and deny everything
- The death of Chen Xitong
In recent weeks came two more incendiary salvos from America. On May 22nd an independent commission—led by Dennis Blair, a former director of national intelligence, and Jon Huntsman, a former ambassador to China—issued a report accusing China of being responsible for the theft of 50-80% of all American intellectual property that is stolen, including a significant but unknown quantity from cyber-intrusions. On May 28th the Washington Post, citing in part a confidential assessment made for the Pentagon, reported that “many of the nation’s most sensitive advanced weapons-systems have been compromised by Chinese hackers”, including missile-defence technology and combat aircraft. All the accusations have met with angry denials by Chinese authorities, who have complained of being the victim of American hacking.
Chinese officials have at least agreed to talk about the issue. John Kerry, the American secretary of state, said in Beijing in April that the two sides would establish a working group on cyber-security. But it will be hard for Americans to discuss hacking productively with their counterparts. China goes by what three American authors in a new book, “Chinese Industrial Espionage”, call a philosophy of “admit nothing and deny everything”.
In addition, experts accuse China of making no distinction between hacking to steal intellectual property and the traditional pursuit of foreign military secrets. All is fair game. They don’t believe Americans who tell them that “America does not conduct espionage on behalf of our companies,” says James Mulvenon, an expert on the Chinese army and one of the authors of the new book. In the Chinese system the two types of cyber-espionage are being conducted by the same people and organisations, he says, and the commercial proceeds are distributed to state-owned enterprises and other national champions.
So far, none of the investigations that trace hacking to China has named or shamed (publicly, at least) a single Chinese company that has received the fruits of cyber-attacks. If it is indeed the army that is responsible for much of the hacking, as American security firms and government officials argue, that makes it difficult to see which companies are the ultimate beneficiaries. It also makes it impossible to estimate the total commercial value of Chinese hacking.
“Part of the problem is that we don’t fully understand how much of it is being used and how effectively,” says Dmitri Alperovitch, a co-founder of CrowdStrike, a cyber-security firm. “When someone steals the designs for the latest automobile, that automobile is not going to roll out off the assembly line in China the next day.”
The lack of transparency complicates strategies for dealing with hacking. If American investigators had specific information about Chinese companies which are benefiting from stolen technology, then legal or trade actions, or the threat of them, might have an impact. Security experts say that businesses must protect themselves anyway by increasing their layers of security and their vigilance against the most common types of attacks, such as spear-phishing with infected attachments and web links.
In addition, Mr Alperovitch and Mr Mulvenon both suggest a standard counter-intelligence measure known as “poisoning the well”. By planting “honey nets” and false leads, Mr Mulvenon argues, America could force the Chinese to become more selective about their approach. “The goal of our policy should be to transform the Chinese system so it is as hard to get a [cyber-]operation approved in their system as it is in ours,” he says.
Mr Obama could also try to persuade Mr Xi to be more selective by stressing the damage to China’s reputation. American officials began publicly acknowledging alleged Chinese cybertheft as early as 2006 (according to the new book); in 2010, Google publicised an attack against its systems. The recent barrage of negative publicity has had a bigger impact, playing into fears of China as an aggressive rising power.
Hacking has in the past six months moved to “the top of the list” for business executives’ meetings with Chinese officials, says James McGregor of APCO Worldwide, a consultancy. And also, it appears, for Mr Obama’s meeting with Mr Xi. Putting the issue at the top of Mr Xi’s list will apparently take more doing.
Powered by Facebook Comments