The Impact of China on Cybersecurity the Impact of China Jon R
Total Page:16
File Type:pdf, Size:1020Kb
The Impact of China on Cybersecurity The Impact of China Jon R. Lindsay on Cybersecurity Fiction and Friction The ubiquity and in- terconnectedness of computers in global commerce, civil society, and military affairs create crosscutting challenges for policy and conceptual confusion for theory. The challenges and confusion in cybersecurity are particularly acute in the case of China, which has one of the world’s fastest growing internet econo- mies and one of its most active cyber operations programs. In 2013 U.S. National Security Adviser Tom Donilon singled out Chinese cyber intrusions as “not solely a national security concern or a concern of the U.S. govern- ment,” but also a major problem for ªrms suffering from “sophisticated, tar- geted theft of conªdential business information and proprietary technologies . emanating from China on an unprecedented scale.”1 One U.S. congressman alleged that China has “established cyber war military units and laced the U.S. infrastructure with logic bombs.” He suggested that “America is under attack by digital bombs.”2 The discourse on China and cybersecurity routinely con- ºates issues as different as political censorship, unfair competition, assaults on infrastructure, and internet governance, even as all loom large for practical cyber policy. Although they involve similar information technologies, there is little reason to expect different political economic problems to obey the same strategic logic, nor should one necessarily expect China to enjoy relative ad- vantage in all spheres. Indeed, the intelligence leaks from Edward Snowden in 2013 underscored the sophistication and extent of internet surveillance by the United States and its allies against targets worldwide, including in China.3 The Snowden Jon R. Lindsay is an assistant research scientist at the University of California Institute on Global Conºict and Cooperation and an assistant adjunct professor at the University of California, San Diego School of In- ternational Relations and Paciªc Studies. The author would like to thank Ben Bahney, Michael Beckley, Tai Ming Cheung, Paul Cornish, Erik Gartzke, Derek Reveron, Julian Snelder, Jack Jiakun Zhang, and the anonymous reviewers for their helpful comments on this project. This research was supported by the Department of Defense Mi- nerva Initiative and Ofªce of Naval Research Grant N00014-14-1-0071. 1. Tom Donilon, “The United States and the Asia-Paciªc in 2013,” Asia Society, New York, March 11, 2013 (Washington, D.C.: White House, March 2013), http://www.whitehouse.gov/the-press- ofªce/2013/03/11/remarks-tom-donilon-national-security-advisory-president-united-states-a. 2. Charles Cooper, “House Hearing: U.S. Now Under Cyber Attack,” CNET, April 24, 2012, http:// news.cnet.com/8301-1009_3-57420229-83/house-hearing-u.s-now-under-cyber-attack/. 3. Jeffrey T. Richelson, ed., “The Snowden Affair: Web Resource Documents the Latest Firestorm International Security, Vol. 39, No. 3 (Winter 2014/15), pp. 7–47, doi:10.1162/ISEC_a_00189 © 2015 by the President and Fellows of Harvard College and the Massachusetts Institute of Technology. 7 International Security 39:3 8 revelations not only invigorated debate about the balance between security and privacy in a democracy but also undercut the moral force of American complaints about Chinese penetration of commercial, government, and de- fense networks.4 Chinese writers hasten to compare the United States to “a thief crying stop thief.”5 Meanwhile U.S. ofªcials attempt to distinguish be- tween acceptable data collection for national security and unacceptable crimi- nal economic espionage.6 Notably, a May 2014 grand jury indicted ªve alleged members of the Chinese People’s Liberation Army (PLA) on several counts of industrial espionage, but omitted mentioning that the same PLA unit targets military interests as well.7 Chinese critics reject the American distinction be- tween legitimate and illegitimate internet surveillance and deny allegations of hacking. They also call for the restriction of American internet ªrms from the Chinese domestic market in order to protect Chinese infrastructure from sub- version.8 Cyber operations and the rhetorical reactions to them on both sides of the Paciªc have undermined trust in the Sino-American relationship.9 Exaggerated fears about the paralysis of digital infrastructure and growing concerns over competitive advantage exacerbate the spiral of mistrust. Closer consideration of domestic factors within China and China’s strategic interac- over the National Security Agency,” National Security Archive Electronic Brieªng Book (Washington, D.C.: National Security Archive, George Washington University, September 4, 2013), http://www2 .gwu.edu/ϳnsarchiv/NSAEBB/NSAEBB436/. 4. See, for example, Ofªce of the National Counterintelligence Executive, Foreign Spies Stealing US Economic Secrets in Cyberspace: Report to Congress on Foreign Economic Collection and Industrial Espio- nage 2009–2011 (Washington, D.C.: Ofªce of the National Counterintelligence Executive, October 2011). 5. Zhong Sheng, “The United States Bears Primary Responsibility for Stopping Cyber War,” People’s Daily Online, February 7, 2013. 6. For example, the United States forbids “the collection of foreign private commercial informa- tion or trade secrets...toaffordacompetitive advantage to U.S. companies and U.S. business sec- tors commercially.” See Ofªce of the Press Secretary, White House, “Signals Intelligence Activities,” Presidential Policy Directive/PPD-28 (Washington, D.C.: White House, January 17, 2014). 7. U.S. Department of Justice, Ofªce of Public Affairs, “U.S. Charges Five Chinese Military Hackers for Cyber Espionage against U.S. Corporations and a Labor Organization for Commercial Advantage,” press release, May 19, 2014, http://www.justice.gov/opa/pr/2014/May/14-ag- 528.html. For further details on the Second Bureau of the PLA General Staff Department Third Bu- reau (3/PLA), see Mandiant, “APT1: Exposing One of China’s Cyber Espionage Units” (Alexan- dria, Va.: Mandiant, February 2013), http://intelreport.mandiant.com/Mandiant_APT1_Report .pdf. 8. Michael D. Swaine, “Chinese Views on Cybersecurity in Foreign Relations,” China Leadership Monitor, September 20, 2013, http://carnegieendowment.org/2013/09/20/chinese-views-on- cybersecurity-in-foreign-relations. 9. Kenneth G. Lieberthal and Wang Jisi, “Addressing U.S.-China Strategic Distrust” (Washington, D.C.: Brookings Institution, March 2012). The Impact of China on Cybersecurity 9 tion with the United States reveals a more complicated yet less worrisome situ- ation. This article argues that for every type of purported Chinese cyber threat, there are also serious Chinese vulnerabilities and Western strengths that rein- force the political status quo. Cyberwar between the United States and China, much like U.S.-China conventional war, is highly unlikely. Nevertheless, the economically driven proliferation of information technology enables numer- ous instances of friction to emerge below the threshold of violence. From a technical perspective, cyber operations are often thought to be inexpensive and effective, but there are underappreciated institutional costs involved in their employment. Moreover, even if actors can overcome the operational bar- riers associated with ambitious cyber penetrations, they still have incentives to moderate the intensity of their exploitation in order to preserve the beneªts that make exploitation worthwhile in the ªrst place. This logic culminates in a relentlessly irritating but indeªnitely tolerable stability in the cyber do- main. China and the United States can look forward to chronic and ambiguous intelligence-counterintelligence contests across their networks, even as the in- ternet facilitates productive exchange between them. This article proceeds in six sections. The ªrst section marshals debates about cybersecurity and the rise of China to frame four prominent threat narratives. The next four sections analyze the empirical manifestations of, respectively, political, espionage, military, and institutional cyber threats in the case of China. The concluding section draws out generalizations about interactions across these categories and offers reasons to expect a measure of restraint in cyberspace. Cybersecurity and International Relations Claims about Chinese cyber threats fall at the intersection of two different de- bates, one about the impact of information technology on international secu- rity and the other about the political and economic future of a rising power. The technological debate centers on whether ubiquitous networks create revolutionary dangers or just marginal evolutions of computer crime, signals intelligence, and electronic warfare.10 One side of this debate argues that inter- 10. For collections of perspectives on both sides of the debate, see Franklin D. Kramer, Stuart H. Starr, and Larry K. Wentz, eds., Cyberpower and National Security (Washington, D.C.: Potomac, 2009); and Derek S. Reveron, ed., Cyberspace and National Security: Threats, Opportunities, and Power in a Virtual World (Washington, D.C.: Georgetown University Press, 2012). For balanced introduc- tions to cybersecurity policy, see P.W. Singer and Allan Friedman, Cybersecurity and Cyberwar: What International Security 39:3 10 connected infrastructure and easily accessible hacking tools make advanced industrial powers particularly vulnerable to serious disruption from weaker states or even nonstate actors.11 The other side argues that the defense industry and