Chinese Hacking Charges a Wakeup Call for Both China & US Businesses

Call it a calculated risk: The US Department of Justice conducted an unprecedented naming and shaming yesterday of five members of an infamous Chinese military unit known for spying on US companies for intellectual property and other valuable commercial intelligence.

A day after pictures of the men (two in military uniform) were plastered on the FBI's Most Wanted posters, the fallout already has begun. No one expects China to extradite the defendants to the US, to fess up to stealing corporate secrets from US firms to assist its state-owned businesses, or to promise to curtail that activity. The hope is that the aggressive US strategy of taking very public legal action against China's cyberespionage activity at the least will send a chill among China's advanced persistent threat operatives.

As expected, China has strongly denied the charges, which cite specific incidents of cybertheft from major US corporations by the five defendants: Wang Dong, Sun Kailiang, Wen Xinyu, Huang Zhenyu, and Gu Chunhui of Unit 61398 of the Third Department of China's People's Liberation Army in Shanghai. Chinese officials confronted the US ambassador to China, Max Baucus, about the indictment and warned that it would have consequences. Today officials released data from the nation's CERT that they say shows US botnet servers controlling 1.18 million host machines in China.

"This [the DOJ indictment] is the first salvo in a tit-for-tat that is going to go on. China is going to retaliate," says Timothy Ryan, a managing director with Kroll Advisory Solutions' cyber investigations practice and a former FBI official who headed its cybersquad.

That may mean an escalation of targeted hacking, experts say. But retaliatory hacking could backfire on China, which is now under criminal scrutiny by the US and could face further exposure and indictments of its hackers. Robert Anderson, executive assistant director of the FBI, said yesterday that criminal charges for such activity by China or other nations would be "the new normal," and that the indictment opens the floodgates for other charges.

"The United States has chosen the old stick and carrot approach -- rewards and punishments -- when it comes to conducting cyber diplomacy with China. What we are seeing now with the announcement yesterday is the stick, a shot across the bow, and it should be taken seriously by the Chinese. In the past few weeks, the US was primarily using the carrot as an incentive," says Franz-Stefan Gady, senior fellow with the EastWest Institute. "It is now China's turn to remove some of the veils covering its activities in cyberspace in order to de-escalate tensions."

Though China quit the new China-US working group on cyber security yesterday in protest of the latest developments, Gady says China isn't likely to make any moves to derail the recent military dialogue between US Secretary of Defense Chuck Hagel and General Chang Wanquan.

Also, Gady doesn't expect the indictment controversy to hurt the US-China anti-spam collaboration effort, which the EastWest Institute helped establish in February 2011. "I do think that cooperation on the technical level will continue unhindered. The great thing, but also the downside, of tech-tech cooperation is that it is inherently apolitical and not subject to temporary political ill winds."

It is highly unlikely that the five indicted members of Unit 61398 will ever be tried for these crimes, but they now have some significant travel restrictions. "If they have kids in school in other countries," the members won't necessarily be free to travel there, says Michael Quinn, associate managing director with Kroll's Cyber Investigations Practice and a former FBI supervisory special agent in the Cyber Division. "If they want to see their kid graduate" from a US college, "they may not travel there now, because they're going to get arrested." They also could be taken into custody "if they are IDed outside the country somewhere friendly to the US."

Quinn says the indictment handed down yesterday had been in the works for a long time. "What we saw yesterday was the outcome of a very long process."

And experts say there are plenty more in the pipeline.

The indictment also may have some unintended consequences for the victim organizations named in the case, which include Alcoa, Allegheny Technologies Incorporated, SolarWorld, US Steel, and Westinghouse Electric. "It could go from the criminal realm to the civil realm," Ryan says. "Now that these very persistent breaches were made public, you're going to have shareholders asking you: What did you do? When did you know it? How many times were you breached? Was this in the prospectus?"

Kristen Verderame, CEO of Pondera International, says the DOJ move should be a wakeup call for US companies doing business in China and with Chinese companies. "It will open the eyes of US companies to the dangers. If you are doing joint ventures, you need to have your cyber security [strategy] up front and be very careful" sharing information electronically, for example. "If you deal with China, you have to do so with your eyes open."

That level of scrutiny could make it more difficult for China to steal intellectual property from its corporate US partners without the threat of exposure by US law enforcement, experts say. China culturally is loath to such public embarrassment, they say.

"The US is looking to get some sort of agreement from China... that moderates their behavior," Ryan says. "I don't think anyone would fault China for spying to protect its political and economic security... but you can't have it both ways. You can't be a capitalist nation but use a state-sponsored apparatus to create this uneven playing field. That's no different than China subsidizing all exports so no one [from other countries] can compete in China."

This new pressure on China to dial back its cyberspying for commercial profit is unlikely to yield major results anytime soon. "I wouldn't think these allegations will stop the Chinese in stealing trade secrets, as I'm sure they will change their TTPs [tactics, techniques, and procedures] and will likely start looking for a mole or any internal leaks," says John Pirc, CTO of NSS Labs and a former CIA agent.