14

Over the past 18 months there have been several news articles pointing the finger at the Chinese government over hacks on U.S government and businesses.

Most recently: China Suspected of Hacking US Defense Firms, Others — Largest Theft 'In History'

Is there any evidence indicating that the Chinese government was directly involved in either financing or directing people or groups in cyber attacks on the U.S government or businesses.

The apparent smoking gun in plenty of these articles is this excerpt from Wikileaks:

A global computer hacking effort: China’s Politburo directed the intrusion into Google’s computer systems in that country, a Chinese contact told the American Embassy in Beijing in January, one cable reported. The Google hacking was part of a coordinated campaign of computer sabotage carried out by government operatives, private security experts and Internet outlaws recruited by the Chinese government. They have broken into American government computers and those of Western allies, the Dalai Lama and American businesses since 2002, cables said.

I personally don't think this is strong enough evidence to implicate the Chinese govt., just because some guy told an embassy contact.

  • I too find it suspicious because China seems to show far more interest in trade than war. – Randolf Richardson Aug 7 '11 at 23:18
  • Well China and any other country will be more than happy to get some of the know how and technologies from the military industrial complex. But I doubt that there is even semi solid evidence or the administration would have sprung in action. – Daniel Iankov Aug 8 '11 at 1:03
  • The most interesting thing to me is China does not really deny that it is happening just that our "Facts" are wrong. All of the denials seem worded so that the denial is shaded very specifically. And certianly this is not much different than putting inteligence resources into place in country for the event of war which I am certian both sides have. I think the complaint here is that the US has been ineffective in countering and stopping the "Attacks". Thus we can not do anything about them or we risk being "Nuked" at a Communications level. – Chad Aug 8 '11 at 16:52
  • 1
    @RandolfRichardson - which is exactly why PLA is so small and underfunded... – user5341 Mar 7 '13 at 14:19
  • Related question: skeptics.stackexchange.com/questions/8790/… – Andrew Grimm Mar 8 '13 at 2:43
10

A report released in February 2013 by Mandiant (an American cyber security firm) states that in a previous report investigating computer security breaches at hundreds of organizations around the world, the company's position was that “The Chinese government may authorize this activity, but there’s no way to determine the extent of its involvement.” It continues to say that:

Now, three years later, we have the evidence required to change our assessment. The details we have analyzed during hundreds of investigations convince us that the groups conducting these activities are based primarily in China and that the Chinese Government is aware of them.

In analyzing the activities of APT1, "a single organization of operators that has conducted a cyber espionage campaign against a broad range of victims" and "one of the most prolific cyber espionage groups in terms of the sheer quantity of information stolen," Mandiant posits that "that APT1 is likely government-sponsored and one of the most persistent of China’s cyber threat actors." In their opinion:

APT1 is able to wage such a long-running and extensive cyber espionage campaign in large part because it receives direct government support.

The report finally implicates People’s Liberation Army (PLA’s) Unit 61398, as the likely organization behind APT1, "located in precisely the same area from which APT1 activity appears to originate." In making that connection their research finds that "People’s Liberation Army (PLA’s) Unit 61398 is similar to APT1 in its mission, capabilities, and resources."

The report concludes to say that the only possible but unlikely alternative explanation to government involvement would be to imagine a large secret organization of Chinese hackers "with direct access to Shanghai-based telecommunications infrastructure" able to engage "in a multi-year, enterprise scale computer espionage campaign," in the immediate vicinity Army Unit 61398, "performing tasks similar to Unit 61398’s known mission," and that in a country which strictly regulates internet usage.

  • 1
    "the Chinese Government is aware of them" doesn't necessarily mean that they are responsible for them, they just might not care enough to stop it. Is there a more explicit quote available? – Ian Mar 7 '13 at 10:19
  • Added more quotes to summarize the report in greater detail. – denten Mar 7 '13 at 13:46
  • 3
    Thanks! "because it receives direct government support" is ideal. +1 for a more reliable source than in the question: although it'd be nice to see a meta-analysis of several security companies' findings from different nations. – Ian Mar 7 '13 at 13:54
  • 1
    The report made a big splash in the news because it is one of the first to provide such explicit evidence for direct government involvement. No meta-analysis is available to my knowledge. I'll keep an eye out for comparable sources though. – denten Mar 7 '13 at 14:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .