US ready to strike back on China cyber attacks

National

US ready to strike back on China cyber attacks

Posted: Updated:

WASHINGTON (AP) — As public evidence mounts that the Chinese military is responsible for stealing massive amounts of U.S. government data and corporate trade secrets, the Obama administration is poised to spell out specific trade actions it may take against Beijing or any other country guilty of cyberespionage.

According to officials familiar with the plans, the White House is eyeing fines, penalties and other trade restrictions as initial, more-aggressive steps the U.S. would take in response to what top officials say has been an unrelenting campaign of cyberstealing linked to the Chinese government. The new strategy is to be released Wednesday, said the officials, who spoke on condition of anonymity because they were not authorized to speak publicly about the threatened action.

The White House plans come after a Virginia-based cybersecurity firm released a torrent of details Monday that tied a secret Chinese military unit in Shanghai to years of cyberattacks against U.S. companies. After analyzing breaches that compromised more than 140 companies, Mandiant has concluded that they can be linked People's Liberation Army's Unit 61398.

Military experts believe the unit is part of the People's Liberation Army's cyber-command, which is under the direct authority of the General Staff Department, China's version of the Joint Chiefs of Staff. As such, its activities would be likely to be authorized at the highest levels of China's military.

The release of Mandiant's report, complete with details on three of the alleged hackers and photographs of one of the military unit's buildings in Shanghai, makes public what U.S. authorities have said less publicly for years. But it also increases the pressure on the U.S. to take more forceful action against the Chinese for what experts say has been years of systematic espionage.

"If the Chinese government flew planes into our airspace, our planes would escort them away. If it happened two, three or four times, the president would be on the phone and there would be threats of retaliation," said former FBI executive assistant director Shawn Henry. "This is happening thousands of times a day. There needs to be some definition of where the red line is and what the repercussions would be."

Henry, now president of the security firm CrowdStrike, said that rather than tell companies to increase their cybersecurity the government needs to focus more on how to deter the hackers and the nations that are backing them.

James Lewis, a cybersecurity expert at the Center for Strategic and International Studies, said that in the past year the White House has been taking a serious look at responding to China, adding that "this will be the year they will put more pressure on, even while realizing it will be hard for the Chinese to change. There's not an on-off switch."

The Chinese government, meanwhile, has denied involvement in the cyber-attacks tracked by Mandiant. Instead, the Foreign Ministry said that China, too, is a victim of hacking, some of it traced to the U.S. Foreign Ministry spokesman Hong Lei cited a report by an agency under the Ministry of Information Technology and Industry that said in 2012 alone that foreign hackers used viruses and other malicious software to seize control of 1,400 computers in China and 38,000 websites.

"Among the above attacks, those from the U.S. numbered the most," Hong said at a daily media briefing, lodging the most specific allegations the Chinese government has made about foreign hacking.

Cybersecurity experts say U.S. authorities do not conduct similar attacks or steal data from Chinese companies, but acknowledge that intelligence agencies routinely spy on other countries.

China is clearly a target of interest, said Lewis, noting that the U.S. would be interested in Beijing's military policies, such as any plans for action against Taiwan or Japan.

In its report, Mandiant said it traced the hacking back to a neighborhood in the outskirts of Shanghai that includes a white 12-story office building run by the PLA's Unit 61398.

Mandiant said there are only two viable conclusions about the involvement of the Chinese military in the cyberattacks: Either Unit 61398 is responsible for the persistent attacks or they are being done by a secret organization of Chinese speakers with direct access to the Shanghai telecommunications infrastructure who are engaged in a multi-year espionage campaign being run right outside the military unit's gates.

"In a state that rigorously monitors Internet use, it is highly unlikely that the Chinese government is unaware of an attack group that operates from the Pudong New Area of Shanghai," the Mandiant report said, concluding that the only way the group could function is with the "full knowledge and cooperation" of the Beijing government.

The unit "has systematically stolen hundreds of terabytes of data from at least 141 organizations," Mandiant wrote. A terabyte is 1,000 gigabytes. The new iPhone 5, for example, has 16 gigabytes of space, while the more expensive iPads have as much as 64 gigabytes of space. The U.S. Library of Congress' 2006-2010 Twitter archive of about 170 billion tweets totals 133.2 terabytes.

"At some point we do have to call the Chinese out on this," said Michael Chertoff, Homeland Security secretary under President George W. Bush and now chairman of the Chertoff Group, a global security firm. "Simply rolling over and averting our eyes, I don't think is a long-term strategy."

Richard Bejtlich, the chief security officer at Mandiant, said the company decided to make its report public in part to help send a message to both the Chinese and U.S. governments.

"At the government level, I see this as a tool that they can use to have discussions with the Chinese, with allies, with others who are concerned about this problem and have an open dialogue without having to worry about sensitivities around disclosing classified information," Bejtlich said. "This problem is overclassified."

He said the release of an unclassified report that provides detailed evidence will allow authorities to have an open discussion about what to do.

Mandiant's report is filled with high-tech details and juicy nuggets that led to its conclusion, including the code names of some of the hackers, like Ugly Gorilla, Dota and SuperHard, and that Dota appears to be a fan of Harry Potter because references to the book and movie character appear as answers to his computer security questions.

The White House would not comment on the report expected Wednesday.

"We have repeatedly raised our concerns at the highest levels about cybertheft with senior Chinese officials, including in the military, and we will continue to do so," said Caitlin Hayden, spokeswoman for the National Security Council. "The United States and China are among the world's largest cyber actors, and it is vital that we continue a sustained, meaningful dialogue and work together to develop an understanding of acceptable behavior in cyberspace."

Associated Press writers Christopher Bodeen, Gillian Wong, Charles Hutzler and Joe McDonald contributed to this report.

KSWT-TV Affiliates

  • Most Popular StoriesMost Popular StoriesMore>>

  • Storm hits Yuma, Phoenix could be next

    Storm hits Yuma, Phoenix could be next

    More than 1,600 households lost power in Yuma late Thursday afternoon.More >>
    More than 1,600 households lost power in Yuma late Thursday afternoon.More >>
  • Woman who lost power arrested in generator theft

    Woman who lost power arrested in generator theft

    Deputies in Mohave County say a Kingman woman whose electricity had been turned off has been arrested after a stolen generator and other items taken from a neighbor were found in yard.More >>
    Deputies in Mohave County say a Kingman woman whose electricity had been turned off has been arrested after a stolen generator and other items taken from a neighbor were found in yard.More >>
  • Doug Ducey, Scott Smith lead Arizona governor race

    Doug Ducey, Scott Smith lead Arizona governor race

    Arizona's six-way Republican governor's primary is widely seen as a contest between Mesa Mayor Scott Smith and Arizona Treasurer Doug Ducey.More >>
    Arizona's six-way Republican governor's primary is widely seen as a contest between Mesa Mayor Scott Smith and Arizona Treasurer Doug Ducey.More >>
  • Oregon gunman planned to kill 'bunch' of people

    Oregon gunman planned to kill 'bunch' of people

    Friday, August 22 2014 4:15 PM EDT2014-08-22 20:15:29 GMT
    A gunman who fatally shot his father and then a man camping at an Oregon beach earlier this week left behind notes that said he was mentally ill and planned to "kill a bunch of other people" and then himself.More >>
    A gunman who fatally shot his father and then a man camping at an Oregon beach earlier this week left behind notes that said he was mentally ill and planned to "kill a bunch of other people" and then himself.More >>
  • Drug tunnel found in Mexicali

    Drug tunnel found in Mexicali

    Mexicali--Mexican police found a partially constructed drug tunnel near the U.S. border in Mexicali. Police said the tunnel was presumably being built by drug traffickers. Mexicali's police chief saidMore >>
    Mexican police found a partially constructed drug tunnel near the U.S. border in Mexicali. More >>
  • Possible drowning

    Possible drowning

    On Sunday the Blythe Police Department received a call regarding a missing 10 year old boy in the vicinity of the Colorado river and the Interstate 10 bridge. The call came out shortly after two in the afternoon when his parents lost sight of him as he swam in the river. The Blythe Boat Patrol searched the river and even called inn CHP and Care Flight Helicopters for aerial support. The search went on until night fall and it was the called off. The child was not found; and is believed that he...More >>
    On Sunday the Blythe Police Department received a call regarding a missing 10 year old boy in the vicinity of the Colorado river and the Interstate 10 bridge. The call came out shortly after two in the afternoon when his parents lost sight of him as he swam in the river. The Blythe Boat Patrol searched the river and even called inn CHP and Care Flight Helicopters for aerial support. The search went on until night fall and it was the called off. The child was not found; and is believed that he...More >>
  • Advertise with KSWT

    Advertise with KSWT

    Why Advertise on KSWT? Advertise your business with KSWT and discover a unique and powerful way to reach thousands of people in Yuma, Imperial Valley, Mexicali, San Luis & Algodones . Not only will advertisingMore >>
    KSWT is here to help you promote your business. Advertise with us today! Click here for information.More >>
  • Crime Watch

    Police investigating dead body found in parked car

    Police investigating dead body found in parked car

    YUMA, Ariz. (13 On Your Side) - Yuma police say a dead woman was found in a car parked at Food City on 8th Street on Tuesday night, at around 6:20 p.m. Police are investigating her cause of death andMore >>
    Yuma police are investigating the death of a woman who was found in a parked car Tuesday night.More >>