Tag Archives: cybersecurity

Another Tightening Of The Cyberscrew

CHINA’S NEW CYBERSECURITY law, which takes effect from June 1, purportedly makes the country more secure from cyberattack and gives citizens greater protection from misuse of their personal information.

But, like so much Chinese legislation, the new law is so broadly and vaguely defined that it potentially affects virtually any person or business that conducts business using a computer network.

The new law also stipulates that data collected in China must be stored in China and only China. The corollary is that data cannot be transferred abroad unless specifically authorised by authorities. Does accessing it from abroad fall foul of this?

If data proposed to be moved out of China contains the personal information of more than half a million users or is “likely to affect national security or social public interests”, then a security review is mandatory.

Although the law applies to domestic and foreign firms alike, it is this ‘sovereignty of information’ that is so troubling to foreign firms: multinationals, especially those now using global cloud services, will struggle to operate efficiently without breaching the law, while the requirement to cooperate with state security services and other government authorities to investigate crimes and cybersecurity issues raises potentially difficult questions about trade secrets and intellectual property rights. Beijing will have the right to request proprietary source code as part of security reviews.

Separate draft legislation announced in April also proposes that the government can demand what is called decryption support, in effect forcing companies to decode encrypted data, “in the interests of national security”.

Authorities have denied that the new law is protectionist, although Alibaba’s cloud services seem a likely commercial winner. Foreign businesses’ lobbying to delay implementation of the new cybersecurity law has been brushed aside. Getting involved to the extent they can in the writing of the implementation of the law is the best they can now hope for.

What is likely, however, is that the new law — like most laws, written to be vague and sweeeping to give authorities the greatest freedom of action in their implementation — will be selectively applied to foreign firms, if nothing else, to be a warning to others.

Advertisements

Leave a comment

Filed under Technolgy

Win-Win Ways In Washington

China's President Xi Jinping addresses the United Nations General Assembly, September 2015

PRESIDENT XI JINPING’S visit to the United States delivered as little, in the eyes of the outside world, as had been expected. On that score, it did not disappoint.

The two headline outcomes, a cybersecurity dialogue and the announcement of a national cap-and-trade carbon market, were a fudge and a repackaging respectively. The two sides agreed not to support commercial cyber-espionage, although what one side sees as cybertheft the other regards as matters of national security. So we’ll see how far that goes. Meanwhile, China has long been running pilot cap-and-trade carbon projects in preparation for launching a national market.

Plenty of other areas of contention remain, from the impact of China’s recent stock market turmoil and currency devaluation on the U.S. Federal Reserve’s interest rate policy to questions of maritime sovereignty in the South and East China Seas.

Even the agreement to start a high-level dialogue on cybercrime, albeit narrowly defined, risks triggering another front in the simmering trade wars between the two, and especially with the U.S. going into a presidential election campaign that has already shown signs of inflammatory anti-China rhetoric before it has even got going.

The proposed cybercrime dialogue provides, though, another example, of how Xi is trying to define issues on Beijing’s own or parallel terms, not on Washington’s. The Asian Infrastructure Investment Bank initiative is another. The Beijing development model in Africa is a third.

Being seen at home to be writing new rules of the game not playing by the old ones and standing shoulder to shoulder with the U.S. as an equal was a significant purpose of Xi’s trip.

State media laid great emphasis for its domestic audience on Xi and Obama forging a new model for great power leadership, a theme echoed in the coverage of Xi’s address to the United Nations General Assembly where Xi was lauded for breathing “new life into the development of international relations, leaving a deep imprint in the history of China’s diplomacy.”

Win-win is the new watchword for China’s diplomacy. It is a portrayal of the country as an alternative to traditional great or colonial powers. China’s narrative is that it is a developing country that will be a partner to others not a master. This fits with a traditional commercial concept that negotiation is about building trust for long-term cooperation rather than resolving an immediate problem at hand.

The reality is that great powers have national interests and it is their power to impose those interests that makes them great powers.

1 Comment

Filed under China-U.S.

Sony Cyber Attack: The China Connection

IT WAS, PERHAPS, only a matter of time before China was dragged publicly into the war of words between the U.S. and North Korea over Pyongyang’s alleged cyber attack on Sony Corp. in retaliation for the company’s provocative Hollywood comedy about a plot to assassinate North Korean leader Kim Jong Un. China is North Korea’s main onramp to the internet. North Korea runs the overwhelming majority of its telecoms traffic through Chinese state-owned telco China Unicom. Its own networks are limited, as are its telecoms connections to its other outlet to the world, Russia. To get its cyber warriors even close to the internet backbone, Pyongyang stations some of them over the border in China.

Now Washington has reportedly asked Beijing to rein in Pyongyang’s use of Chinese routers and servers for cyber attacks, including expelling North Korean hackers based in China — a request Beijing has met with polite silence or neutral platitudes. The Sony incident is another Pyongyang embarrassment it could do without — even if it doesn’t mind a company with one foot in Hollywood and the other in Japan being embarrassed even more. Yet it is not going to open that particular can of worms. And especially not in public.

Cyber warfare is almost as sensitive a topic in Beijing as even a fictional assassination attempt on the Beloved Leader is in Pyongyang. Washington has repeatedly accused Beijing of hacking into U.S. companies, charges Beijing has repeatedly denied, saying it is a victim of cyber attacks not a perpetrator. But for both countries’ cyber warfare has become the “fifth dimension” of defence, adding to land, sea, air and space military operations.

Pyongyang, for the record, has also denied that it cyber attacked Sony. It has demanded a joint investigation with the U.S., following that up with a predictable burst of typical bombastic rhetoric.

So far, Beijing has walked a fine line over the Sony incident. It has condemned both the movie as being culturally arrogant and cyber attacks and terror threats. But, it is equally aware that the U.S. has become more forceful this year in pressing cyber-attack allegations against Beijing. In May, Washington broke new ground in bilateral relations by bringing its first cyber-spying case against China, charging five Chinese army officers in May with hacking into U.S. companies. The following month a Chinese businessman was charged with hacking into the computer systems of U.S. defence contractors, including Boeing.

For North Korea’s part, it could now return to the U.S.’s list of state sponsors of terrorism, from which it was removed in 2008 after agreeing to verification of its nuclear sites. The incident has also thrown a spotlight on Unit 121 of North Korea’s military intelligence agency. This is an elite if shadowy group of cyber warriors, some of whom are based in the Chilbosan hotel, a Chinese-North Korean joint venture in Shenyang in Liaoning  province. Estimates of their number vary from a few hundred to several thousand.

Little is known definitively about the group outside its own circles. What there is comes from defectors from several years ago. In truth, not much if anything new about it has been learned lately despite Unit 121 being written about relatively widely in the Western press since the Sony attack. A sign of how active it is is that North Korea has reputedly carried out more cyber attacks than another nation. Denial of service attacks on South Korea are its weapon of choice, but it is believed to have hacked about in the U.S., penetrating both the U.S. Department of Defense and U.S.-based companies. Part of its brief is to cause North Korea’s enemies monetary loss.

Some note similarities between the Sony attack and a broad based hack of South Korean banking and media companies last year widely believed to be the work of Unit 121. If it was responsible for the cyber hack of Sony, as charged, that would mark its boldest and most sophisticated attack to date.

With or without Beijing’s help, U.S. President Barack Obama has promised “proportionate” retaliation for what he has called an act of “cyber vandalism.” It is difficult to know what that might be. The hermit kingdom’s internet isolation has long offered Unit 121 an unlikely degree of protection. There isn’t much internet infrastructure in North Korea against which to retaliate; there are barely a dozen web sites using the country’s domain, .kp, all state run. Washington’s best bet is to get China to lean on its ally — which isn’t much of a bet at all.

Update: The internet went down in North Korea for nine and a half hours on Dec. 22 after more than a day of increasingly instability, suggesting an onslaught of denial-of-service attacks.  It could also be a result of a power failure, accidental or because someone pulled the plug. On either score, China has said it wasn’t its doing. The U.S. has declined to make comment. Well, both would, wouldn’t they — and hacktavist groups are just as likely suspects.

Leave a comment

Filed under China-Koreas, China-U.S., Defence

China And Its Double-Edged Cyber-Sword

The following is a guest post by Sean Noonan of the U.S. intelligence-analysis firm, STRATFOR. It is republished with permission.

A recent batch of WikiLeaks cables led Der Spiegel and The New York Times to print front-page stories on China’s cyber-espionage capabilities Dec. 4 and 5. While China’s offensive capabilities on the Internet are widely recognized, the country is discovering the other edge of the sword.

China is no doubt facing a paradox as it tries to manipulate and confront the growing capabilities of Internet users. Recent arrests of Chinese hackers and People’s Liberation Army (PLA) pronouncements suggest that China fears that its own computer experts, nationalist hackers and social media could turn against the government. While the exact cause of Beijing’s new focus on network security is unclear, it comes at a time when other countries are developing their own defenses against cyber attacks and hot topics like Stuxnet and WikiLeaks are generating new concerns about Internet security.

One of the U.S. State Department cables released by WikiLeaks focuses on the Chinese-based cyber attack on Google’s servers that became public in January 2010. According to a State Department source mentioned in one of the cables, Li Changchun, the fifth highest-ranking member of the Communist Party of China (CPC) and head of the Party’s Propaganda Department, was concerned about the information he could find on himself through Google’s search engine. He also reportedly ordered the attack on Google. This is single-source information, and since the cables WikiLeaks released do not include the U.S. intelligence community’s actual analysis of the source, we cannot vouch for its accuracy. What it does appear to verify, however, is that Beijing is regularly debating the opportunities and threats presented by the Internet.

A Shift from Offensive Capabilities

On Nov. 2, the People’s Liberation Army Daily, the official paper for the PLA and the primary medium for announcing top-down policy, recommended the PLA better prepare itself for cyber threats, calling for new strategies to reduce Internet threats that are developing “at an unprecedented rate.” While the report did not detail any strategies, it quoted a PLA order issued for computer experts to focus on the issue.

The Nov. 2 PLA announcement is part of a long trend of growing network-security concerns in China. In 2009, Minister of Public Security Meng Jianzhu emphasized that the development of the Internet in China created “unprecedented challenges” in “social control and stability maintenance.” In June 2010, the State Council Information Office published a white paper on the growing threat of cyber crime and how to combat it. Clearly, these challenges have been addressed this year. The Ministry of Public Security (MPS) announced Nov. 30 that it had arrested 460 suspected hackers thought to have been involved in 180 cases so far in 2010. This is part of the MPS’ usual end-of-year announcement of statistics to promote its success. But the MPS announcement also said that cyber crime had increased 80 percent this year and seemed to blame the attacks only on hackers inside China.

These were cases mainly of producing and selling “Trojan” programs (malware that looks legitimate), organizing botnets, assisting others in carrying out denial-of-service attacks and invading government websites. The MPS also closed more than 100 websites that provided hackers with attack programs and taught them various tactics.

The PLA already has two notoriously large and capable network security units: the Seventh Bureau of the Military Intelligence Department (MID) and the Third Department of the PLA. In simple terms, the MID’s Seventh Bureau is an offensive unit, responsible for managing research institutes that develop new hacking methods, train hackers and produce new hardware and software. The PLA Third Department, defensive in nature, is the third largest signals intelligence-monitoring organization in the world. STRATFOR sources with expertise in network security believe that China’s government-sponsored hacking capabilities are the best in the world. But this perception is based in part on the fact that China demonstrates these capabilities quite often. The United States, on the other hand, is much more restrained in exercising its offensive cyber capabilities and is not inclined to do so until there is a dire and immediate need, such as war.

Piracy Vulnerability

The details of China’s escalating effort to improve network security are still murky, but one recently announced campaign against software piracy is notable. On Nov. 30, Deputy Commerce Minister Jiang Zengwei announced a new six-month crackdown on illegally copied products in China. He said the focus was on pirated software, counterfeit pharmaceuticals and mislabeled agricultural products. The Chinese public has pushed for more regulation of pharmaceuticals and food due to a rising number of cases in which people have become sick or even died because of falsely labeled or tainted products, such as melamine-contaminated milk. But Beijing seems to be even more concerned about the vulnerabilities created by running unlicensed and non-updated software, and publicizing the crackdown is clearly an attempt by Beijing to appease Western governments and businesses that are placing growing pressure on China.

Indeed, China has a sizable counterfeit economy, much to the ire of Western businesses. While Beijing may placate Westerners by announcing crackdowns for the benefit of international audiences, it takes more forceful measures when it sees a larger threat to itself, and the security emphasis now seems to be on the threat of running insecure software on government computers. The problem with unlicensed software is that it does not receive automatic updates from the manufacturer, which usually are sent out to fix vulnerabilities to malware. Unlicensed software is thus left open to viral infiltration. It is also cheap and easy to get, which makes it pervasive throughout both government and private computer networks.

One of the measures Beijing has started to implement is requiring licensed software to be installed on new computers before they are sold, which also gives the government an opportunity to install censorship measures like Green Dam. One persistent problem is that much of the pre-installed software still consists of pirated copies. While China has released statistics showing that the use of legitimate software in China has increased dramatically, the Business Software Alliance, an international software industry group, estimates that 79 percent of the software sold in China in 2009 was illegally copied, creating a loss to the industry of $7.6 billion in revenue. Even more important to Beijing, these statistics mean the vast majority of Chinese computer systems — government and private alike — remain vulnerable to malware.

At the same Nov. 30 news conference at which Jiang announced the new anti-piracy initiative, Yan Xiaohong, deputy head of the General Administration of Press and Publication and vice director of the National Copyright Administration, announced a nationwide inspection of local and central government computers to make sure they were running licensed software. While this suggests Beijing’s major concern is the security of government computers, it also emphasizes how widespread the unlicensed software problem is.

This new focus on using legitimate software, however, will not be a complete solution to China’s Internet vulnerabilities. There has been little effort to stop the selling of copied software, and it is still very easy to download other programs, licensed and unlicensed, and malware along with them (such as QQ). Moreover, the new security measures are dealing only with the symptoms, not the underlying problem, of a counterfeit-heavy economy. A six-month crackdown will not undermine or eliminate software piracy in China; to do so would require an immense and sustained investment of time, money and manpower. Indeed, China has been a hub for pirating software, films and other copyrighted material for so long that the enormous domestic economic base that has grown up around it would be virtually impossible to dismantle. In any case, vulnerabilities still exist in legitimate software, even if it is better protected against novice hackers. New vulnerabilities are constantly being found and exploited until software companies come up with the appropriate patches.

From Nationalist Hackers to Dissident Threats

China’s highly developed hacking capabilities, more offensive than defensive, include Internet censorship measures like the infamous Great Firewall, and the official police force run by the MPS specifically to monitor Chinese Internet traffic and censor websites is 40,000 strong. China also has developed two unofficial methods of censorship. First, operators of private websites and forums must follow certain government regulations to prevent statements critical of the government from being disseminated, which encourages private operators to be their own censors. Second, there is a veritable army of nationalistic computer users in China that include “hacktivist” groups such as the Red Hacker Alliance, China Union Eagle and the Honker Union, with thousands of members each. They became famous after the 1999 “accidental” bombing of the Chinese embassy in Belgrade, which prompted China-based hackers to attack and deface U.S. government websites. The Chinese government, state-owned enterprises and private companies also engage public relations firms to hire, deploy and manage what have become colloquially known as “Party of Five Maoists.” These are individuals who get paid half a yuan (5 mao) for every positive Internet post they write regarding government policy, product reviews and other issues.

But as China’s Internet-using population nears 400 million, with nearly 160 million using social networking, Beijing recognizes the risk of all this spiraling out of control. Censors have not been able to keep up on the social-networking front. Even with limited or banned access to sites like Twitter and Facebook, their Chinese versions, Weibo and Kaixin, for example, are expanding exponentially. While the government may exercise more control over the Chinese-based sites, it cannot keep up with the huge number of posts on topics the CPC considers disharmonious. The recent announcement of Liu Xiaobo’s Nobel Peace Prize is an example of news that was not reported at first in Chinese media but through social networking sites, spreading like wildfire. And the censorship is not exclusive; even non-dissidents can be censored, such as Prime Minister Wen Jiabao when he recently called for limited political reform.

China’s large Internet population will not all be nationalists. And if those who learn skills from informal hackers turn into dissidents, Beijing would consider them a serious threat. The Internet presents exactly the type of tool that could pose a major threat to the CPC because it spans regions, classes and ethnicities. Most social grievances are local and economic or ethnic-based. The potential for one opposition group to be united nationwide over the Internet is one of Beijing’s gravest concerns. It has realized that a weapon it once wielded so deftly against foreign powers and business entities can now be used against Beijing.

Outside Issues

At the same time Beijing reached this realization, WikiLeaks demonstrated the possibility for sensitive government information to be spread globally through the Internet. Beijing saw that if the United States, with its expertise in signals intelligence and security, could be vulnerable to such a threat, so could China. Stuxnet demonstrated the vulnerability of important infrastructure to cyber attack, one reason for China’s new emphasis on licensed software (Iran is known to run unlicensed Siemens software). China’s recent emphasis on network security is likely linked to all of these factors, or it may be due to a threat seen but as yet unpublicized, such as a cyber attack or leak inside China that the government has been able to keep quiet.

Other countries have also been implementing new network security measures, most notably the United States. On Oct. 31, the Maryland-based U.S. Cyber Command became fully operational, and its commander is also the head of the National Security Agency, the premier U.S. government entity for signals intelligence. (Thus, China’s giving Internet security responsibility to the PLA should come as no surprise to the United States.) And as China realizes the difficulties of defending against attacks in cyberspace, which tends to favor the offense, the United States is wrestling with the same problems and complexities as it tries to shield government, civilian and commercial computer systems, all of which require different degrees of control and operate under different laws. As cyber espionage and cyber sabotage become even greater concerns, China will be forced to face the far more difficult task of not only pecking away at the Pentagon’s firewalls but also providing for its own internal system security.

These new efforts all contradict China’s long-standing policy of cultivating a population of nationalistic computer users. This effort has been useful to Beijing when it sees a need to cause disruption, whether by attacking U.S. sites after perceived affronts like the Chinese embassy bombing in Belgrade or preventing access from powerful foreign entities like Google. But China has also recognized that developing these public capabilities can be dangerous. Nationalist Chinese hackers, if motivated by the right cause and united through the pervasive Internet, can always turn on the government. And the situation seems to have more and more governments on edge, where simple mistakes can raise suspicions. China’s redirection of a large amount of Internet traffic in April caused an outcry from the United States and other countries, though it may well have been an accident.

It is hard to tell what Beijing sees, specifically, as a first-tier cyber threat, but its decision to develop an effective response to all manner of threats is evident.

China and its Double-edged Cyber-sword is republished with permission of STRATFOR.

Leave a comment

Filed under Politics & Society

Cablegate: Details Of The Google Hack Published

The allegation that a Politburo member irked by finding critical comments after googling his name was behind the hacking of the U.S. search media company Google late last year was trailed when the publication of the U.S. State Department cables by WikiLeaks first started. Now the cables in question have been made public (via Guardian).

The source of the accusation is a “well placed contact” of an officer at the U.S. embassy in Beijing. The operation against Google was reported to have been coordinated out of the State Council Information Office without having “been discussed more widely in the Party”. It started with orders to the three big state-owned telecoms companies to stop doing business with Google. When this failed to get Google to remove the link on its (censored) Chinese site to (uncensored) google.com, the pressure was escalated into the December 2009 cyberattack. Google went public about the hacking, which was when, the cable suggests, the broad party leadership became aware of events.

The campaign, according to this contact was “100% political”. However, other contacts of the embassy claimed that a top leader was working with Google’s domestic rival Baidu against the American company and that there was a perception, promoted by the government, than the U.S. government and Google were working together to undermine Chinese government controls on the Internet and thus exerting “cultural hegemony” and interfering in the country’s internal affairs. U.S. Secretary of State Hillary Clinton’s speech last January on internet freedom in which she came down in support of Google, without giving any indication that her officials suspected a top-level Chinese leader as being behind the attacks on it, may, perversely have reinforced that view. Given the concerns in Beijing about about the high-resolution satellite imagery on Google’s mapping software, Google Earth, that would not have taken much doing.

The cable also reported that contacts in the technology industry had told embassy officials that that Chinese interference in the operations of foreign businesses is widespread and often underreported to U.S. parent companies.

[Name redacted] noted the pronounced disconnect between views of U.S. parent companies and local subsidiaries. PRC-based company officials often downplayed the extent of PRC government interference in their operations for fear of consequences for their local markets. Our contact emphasized that Google and other U.S. companies in China were struggling with the stated Chinese goal of technology transfer for the purpose of excluding foreign competition. This consultant noted the Chinese were exploiting the global economic downturn to enact increasingly draconian product certification and government procurement regulations to force foreign-invested enterprises (FIEs) to transfer intellectual property and to carve away the market share of foreign companies.

Leave a comment

Filed under China-U.S., Industry, Politics & Society

Google, Hacked, Takes A Rare Public Stand

Google, market cap $143 billion, vs China, nominal GDP of $4.6 trillion (2008) at current exchange rates. Not exactly an even match up. Yet David is taking on Goliath, not that Google is used to playing the David role.

The American search media company says it might pull out of China after it discovered that in December the Gmail accounts of Chinese human rights activists had been breached, albeit at a low level. In a blog post, Google’s top lawyer, David Drummond said that “we have discovered that at least 20 other large companies from a wide range of businesses–including the Internet, finance, technology, media and chemical sectors–have been similarly targeted.”  In a separate post Google, which runs a distant second in the 7 billion yuan ($1 billion) China search market to Baidu’s 60%, added that it was “no longer willing to continue censoring our results” on its Chinese search engine, as the government requires, a practice it had engaged in since 2006 to obtain its Chinese license despite its “Do No Evil” self-image.

Google is not alone among foreign companies in bowing to Beijing’s wishes over matters the government considers sensitive (although it has stopped short of directly accusing the government of being behind the Gmail attack). And it will likely meet with government officials in the near future to discuss whether it will be allowed to offer an uncensored Chinese search engine. It is also embroiled in a copyright dispute over including Chinese authors in its Google Books project. But it may be better positioned than most to take a high-profile stand that will benefit it more in the places where it makes its money, and it may also be gambling on Beijing not wanting to be seen to be drumming one of the world’s best-known multinationals out of the country.

Update: a Foreign Ministry spokeswoman said Wednesday that “China welcomes international Internet companies to conduct business within the country according to law” and that the “government administers the Internet according to law and we have explicit stipulations over what content can be spread on the Internet”.

2 Comments

Filed under China-U.S., Media, Politics & Society