U.S. Homes In on China Spying
WASHINGTONU.S. intelligence agencies have pinpointed many of the Chinese groups responsible for cyberspying in the U.S., and most are sponsored by the Chinese military, according to people who have been briefed on the investigation.
Armed with this information, the U.S. has begun to lay the groundwork to confront China more directly about cyberspying. Two weeks ago, U.S. officials met with Chinese counterparts and warned China about the diplomatic consequences of economic spying, according to one person familiar with the meeting.
The Chinese cyberspying campaign stems largely from a dozen groups connected to China's People's Liberation Army and a half-dozen nonmilitary groups connected to organizations like universities, said those who were briefed on the investigation. Two other groups play a significant role, though investigators haven't determined whether they are connected to the military.
In many cases, the National Security Agency has determined the identities of individuals working in these groups, which is a critical development that provides the U.S. the option of confronting the Chinese government more directly about the activity or responding with a counterattack, according to former officials briefed on the effort.
"It's actually a small number of groups that do most of the PLA's dirty work," said James Lewis, a cybersecurity specialist at the Center for Strategic and International Studies who frequently advises the Obama administration. "NSA is pretty confident of their ability to attribute [cyberespionage] to this set of actors."
In early November, the U.S. chief of counterintelligence issued a report that was unusually blunt in accusing China of being the world's "most active and persistent" perpetrator of economic spying. Lawmakers have also become more vocal in calling out China for its widening campaign of cyberespionage.
Still, diplomatic considerations may limit the U.S. interest in taking a more confrontational approach because some U.S. officials are wary of angering China, the largest holder of U.S. debt.
Chinese Foreign Ministry spokesman Liu Weimin said that Chinese law "clearly prohibits hacking" and that the Chinese government "cracks down on such behavior and actively participates in international cooperation."
"Accusations that China participates in such hacking, or that the Chinese government is behind it, are totally ungrounded," he said.
Chinese officials regularly dispute U.S. allegations of cyberspying, saying they are the victims, not the perpetrators, of cybercrime and cyberespionage. An NSA spokeswoman declined to comment.
Identifying adversaries has been difficult because it is easy to fake identities and locations in cyberspace. An inability to tie cyberspying activities with precision to a certain actor has in the past limited the U.S.'s ability to respond because it's hard to retaliate or confront an unidentified adversary.
The U.S. government, led by the National Security Agency, has tracked the growing Chinese cyberspying campaign against the U.S. for decades. Past government efforts have had exotic names like "Titan Rain," and "Byzantine Hades."
More recently, NSA and other intelligence agencies have made significant advances in attributing cyberattacks to specific sourcesmostly in China's People's Liberation Armyby combining cyberforensics with ongoing intelligence collection through electronic and human spying, Mr. Lewis said.
The U.S. investigation of China's activities is the latest round of spy-versus-spy in cyberspace.
The activity breaks down into cyberspying efforts by 20 groups with different attack styles that are responsible for most of the cybertheft of U.S. secrets, said the people briefed on the investigation. U.S. intelligence officials have given different classified code names to each group.
U.S. intelligence officials can identify different groups based on a variety of indicators. Those characteristics include the type of cyberattack software they use, different Internet addresses they employ when stealing data, and how attacks are carried out against different targets. In addition to U.S. government agencies, major targets of these groups include U.S. defense contractors, according to former officials.
A Chinese state TV report alludes to attacks on websites in the U.S.
Collectively, these groups employ hundreds of people, according to former officials briefed on the effort. That number is believed to be small compared to the estimated 30,000 to 40,000 censors the Chinese government is believed to employ to patrol the Internet.
The Chinese government is believed to have been behind a number of recent major cyberbreak-ins, including multiple hacks of Google Inc. and the EMC Corp.'s RSA unit, which makes the numerical tokens used by millions of corporate employees to access their network.
A cyberattack revealed this year on Lockheed Martin Corp. is also believed to have been traced to China, and the Chinese are believed to have been responsible for an infiltration a few years ago of the Pentagon's Joint Strike Fighter weapons program, which is also managed by Lockheed.
The counterintelligence report released last month predicted that China's espionage efforts will continue to grow.
U.S. Probe Ties Chinese Cyberspying to Military - WSJ.com
WASHINGTONU.S. intelligence agencies have pinpointed many of the Chinese groups responsible for cyberspying in the U.S., and most are sponsored by the Chinese military, according to people who have been briefed on the investigation.
Armed with this information, the U.S. has begun to lay the groundwork to confront China more directly about cyberspying. Two weeks ago, U.S. officials met with Chinese counterparts and warned China about the diplomatic consequences of economic spying, according to one person familiar with the meeting.
The Chinese cyberspying campaign stems largely from a dozen groups connected to China's People's Liberation Army and a half-dozen nonmilitary groups connected to organizations like universities, said those who were briefed on the investigation. Two other groups play a significant role, though investigators haven't determined whether they are connected to the military.
In many cases, the National Security Agency has determined the identities of individuals working in these groups, which is a critical development that provides the U.S. the option of confronting the Chinese government more directly about the activity or responding with a counterattack, according to former officials briefed on the effort.
"It's actually a small number of groups that do most of the PLA's dirty work," said James Lewis, a cybersecurity specialist at the Center for Strategic and International Studies who frequently advises the Obama administration. "NSA is pretty confident of their ability to attribute [cyberespionage] to this set of actors."
In early November, the U.S. chief of counterintelligence issued a report that was unusually blunt in accusing China of being the world's "most active and persistent" perpetrator of economic spying. Lawmakers have also become more vocal in calling out China for its widening campaign of cyberespionage.
Still, diplomatic considerations may limit the U.S. interest in taking a more confrontational approach because some U.S. officials are wary of angering China, the largest holder of U.S. debt.
Chinese Foreign Ministry spokesman Liu Weimin said that Chinese law "clearly prohibits hacking" and that the Chinese government "cracks down on such behavior and actively participates in international cooperation."
"Accusations that China participates in such hacking, or that the Chinese government is behind it, are totally ungrounded," he said.
Chinese officials regularly dispute U.S. allegations of cyberspying, saying they are the victims, not the perpetrators, of cybercrime and cyberespionage. An NSA spokeswoman declined to comment.
Identifying adversaries has been difficult because it is easy to fake identities and locations in cyberspace. An inability to tie cyberspying activities with precision to a certain actor has in the past limited the U.S.'s ability to respond because it's hard to retaliate or confront an unidentified adversary.
The U.S. government, led by the National Security Agency, has tracked the growing Chinese cyberspying campaign against the U.S. for decades. Past government efforts have had exotic names like "Titan Rain," and "Byzantine Hades."
More recently, NSA and other intelligence agencies have made significant advances in attributing cyberattacks to specific sourcesmostly in China's People's Liberation Armyby combining cyberforensics with ongoing intelligence collection through electronic and human spying, Mr. Lewis said.
The U.S. investigation of China's activities is the latest round of spy-versus-spy in cyberspace.
The activity breaks down into cyberspying efforts by 20 groups with different attack styles that are responsible for most of the cybertheft of U.S. secrets, said the people briefed on the investigation. U.S. intelligence officials have given different classified code names to each group.
U.S. intelligence officials can identify different groups based on a variety of indicators. Those characteristics include the type of cyberattack software they use, different Internet addresses they employ when stealing data, and how attacks are carried out against different targets. In addition to U.S. government agencies, major targets of these groups include U.S. defense contractors, according to former officials.
A Chinese state TV report alludes to attacks on websites in the U.S.
Collectively, these groups employ hundreds of people, according to former officials briefed on the effort. That number is believed to be small compared to the estimated 30,000 to 40,000 censors the Chinese government is believed to employ to patrol the Internet.
The Chinese government is believed to have been behind a number of recent major cyberbreak-ins, including multiple hacks of Google Inc. and the EMC Corp.'s RSA unit, which makes the numerical tokens used by millions of corporate employees to access their network.
A cyberattack revealed this year on Lockheed Martin Corp. is also believed to have been traced to China, and the Chinese are believed to have been responsible for an infiltration a few years ago of the Pentagon's Joint Strike Fighter weapons program, which is also managed by Lockheed.
The counterintelligence report released last month predicted that China's espionage efforts will continue to grow.
U.S. Probe Ties Chinese Cyberspying to Military - WSJ.com
