Cup of Cha
This is China

When the American northeast went black in August of 2003, the official version of events was that a tree branch crippled a huge chunk of the American and Canadian power grids. This either seemed far-fetched, or utterly terrifying, depending on your point of view. Well, a new report from National Journal says that China’s “cyber-militia” may have been behind the event, and the overall implications are chilling:

There has never been an official U.S. government assertion of Chinese involvement in the outage, but intelligence and other government officials contacted for this story did not explicitly rule out a Chinese role. One security analyst in the private sector with close ties to the intelligence community said that some senior intelligence officials believe that China played a role in the 2003 blackout that is still not fully understood.

Perhaps even more startlingly, there have been assertions from American computer security experts that “China” (defined in the context as a military hacker) breached security systems again in February of this year and caused the Florida blackout, affecting 3 millions Americans in the process.

I can still remember when the blackout struck, I was driving down the street in Brooklyn coming back from a minor league baseball game. It was less than two years after the 9-11 attacks, and people were extremely unnerved for the first few minutes, until people realized that it was not a terrorist attack. Or so we thought.

I don’t really want to get hung up on terminology, but the potential involvement of a foreign government in the biggest American electrical outage in nearly three decades is an extremely unnerving realization. During the Gulf War in the early 1990s, China began to understand how woefully behind its military was technologically. The government began to pour enormous sums of money into its army, and has since become one of the elite forces in the world.

Until I read this article, I was under the impression that China was still significantly behind America, but the enormous development of cyber-militias by the PLA could potentially change the dynamics of international military build-ups, much as the Gulf War did a generation earlier.

The Defense Department has been cautious in choosing its words, emphasizing that threats have come from China as a geographical entity rather than the actual government, but there are clear overtones:

“Numerous computer networks around the world, including those owned by the U.S. government, were subject to intrusions that appear to have originated within” the People’s Republic of China. Although not claiming that the attacks were conducted by the Chinese government, or officially endorsed, the declaration built upon the previous year’s warning that the People’s Liberation Army is “building capabilities for information warfare” for possible use in “pre-emptive attacks.”

Former CIA offical Andrew Palowitch was not nearly as cautious in his comments in the article:

We are currently in a cyberwar, and war is going on today.

Is it possible that while the US was so worried about nuclear threats in Iraq that didn’t exist, tried to re-design the army into a “sleek” fighting force and talk tough with the world, that China identified, and is on the way to mastering, the next frontier of warfare? Sadly, the article reports that the Bush Administration may have been asleep at the switch until recently, arguably distracted by the ill-conceived Iraq “threat,” which was clearly less imminent than cyber-attacks:

Many security experts are surprised that the administration is only now moving to take dramatic measures to improve the security of government networks, because some Cabinet-level and White House officials have been warning about the threat for years to just about anyone who will listen.

Until McConnell, the national intelligence director, personally drove the point home to Bush in an Oval Office meeting in 2006, there was little top-level support for a comprehensive government cyber-security plan. “They ignored it,” one former senior administration official said flatly. “McConnell has the president’s ear.”

How dangerous is the cyber-threat? Reports indicate that experts have been telling Bush for years that the situation has disastrous potential for America, with serious action only being taken recently:

Lawrence Wright of The New Yorker reported earlier this year that McConnell told Bush during the 2006 Oval Office meeting, “If the 9/11 perpetrators had focused on a single U.S. bank through cyberattack and it had been successful, it would have had an order-of-magnitude greater impact on the U.S. economy.” According to Wright, the president was disturbed, and then asked Treasury Secretary Henry Paulson Jr., who was at the meeting, if McConnell was correct; Paulson assured the president that he was.

[Senior US counterintelligence official Joel] Brenner confirmed Wright’s account as “a true story.”

While there have been no widespread reports of specific “terrorism” of this sort, indications are that the tactics are already being used in a sinister way. According to the National Journal article China’s military currently uses its elite hackers for everything from national security to business negotiating tactics:

Brenner, the U.S. counterintelligence chief, said he knows of “a large American company” whose strategic information was obtained by its Chinese counterparts in advance of a business negotiation. As Brenner recounted the story, “The delegation gets to China and realizes, ‘These guys on the other side of the table know every bottom line on every significant negotiating point.’ They had to have got this by hacking into [the company’s] systems.”

Bennett told a similar story about a large, well-known American company. (Both he and Brenner declined to provide the names of the companies.) According to Bennett, the Chinese based their starting points for negotiation on the Americans’ end points.

These revelations come on the heels of an admission by the Bush Administration that the computer of Commerce Secretary Carlos Gutierrez in December of last year:

…spyware programs designed to clandestinely remove information from personal computers and other electronic equipment were discovered on devices used by Commerce Secretary Carlos Gutierrez and possibly other members of a U.S. trade delegation, according to a computer-security expert with firsthand knowledge of the spyware used. Gutierrez was in China with the Joint Commission on Commerce and Trade, a high-level delegation that includes the U.S. trade representative and that meets with Chinese officials to discuss such matters as intellectual-property rights, market access, and consumer product safety. According to the computer-security expert, the spyware programs were designed to open communications channels to an outside system, and to download the contents of the infected devices at regular intervals. The source said that the computer codes were identical to those found in the laptop computers and other devices of several senior executives of U.S. corporations…

None of this is to say that other countries don’t engage in similar practices, although it is much more unusual to see firms using them in business negotiations. Furthermore, there is serious concern that these different breaches are not simply uncoordinated efforts, but part of a broader trend that is based in national security vulnerabilities made possible by the nature of globalization:

Intelligence officials now worry that software developed overseas poses another layer of risk because malicious codes or backdoors can be embedded in the software at its creation. U.S. officials have singled out software manufacturers in emerging markets such as, not surprisingly, China.

In other words, if your company’s security system is designed by a firm, even an American firm, which has many of its coders in China or other foreign nations, competitors might not even need to do much work to access your information. They might already have the keys.

None of this is particularly surprising given the seemingly paranoid view of Chinese toward Microsoft over the last several years. In mid 2007 China Daily published an op-ed entitled “Microsoft operating system caches secret surveillance programs on China?” Hmmm…wonder why they would think that…

All of this could have serious implications for both business and national security in America and throughout the world. It is hardly a revelation that Chinese companies are engaging in such tactics, as many leaders in the foreign business community will not put any information about negotiations on computers in China and are extremely cautious even when talking on the phone about industry secrets. However, the apparent wide-scale of deception must give pause to even the most cynical business people. And national security experts would be wise to wonder if China’s military is running far ahead of the US on the next frontier of warfare. America has some serious catching up to do.

[update: Stan over at China Hearsay thinks I'm nutty, and maybe he's probably right. But I bet he doesn't doubt that Chinese companies are willing to steal information electronically during negotiations. Or if he does I'll get another lawyer to handle my billion-dollar takeover deals.]

Share This

Tags: Business, cyber-warfare, military, technology
Follow Comments via RSS Feed
You can leave a response or trackback from your site.