The Perils of Cyberwar Rhetoric

The US government is ratcheting up its rhetoric against China, claiming that state-sponsored Chinese hackers are involved in massive-scale campaigns to steal trade secrets over the Internet. The Chinese government denies this, of course, while claiming that it has discovered numerous attacks against its networks and infrastructure originating from the United States.

The allegations fired back and forth between the world's two largest economic powers are largely true, of course. As we have reported, network spying has been taking place for years. (See: America's Declared (& Undeclared) Cyberwar.) It is also a modern extension of classic cross-border espionage and spying, which is considered to be the second-oldest profession. But recently, cyberattacks by foreign governments, especially from China, seem to have emerged as an unprecedented threat, according to vocal outcries by US officials and a surge in media coverage about the "China hacking menace."

Sticky fingers

In the worst possible outcome, the war of rhetoric could lead to an
all-out cyber war that ends the relative freedoms of data exchange.
(Source: George Thomas, Flickr)

Pointing fingers
Without condoning trade secret theft by China or any other country, I feel the agendas of those responsible for inciting a call to arms in United States to combat China's covert cyberwar against US intellectual property interests need to be carefully scrutinized. Lobbying groups and elected officials representing those hurt by the flow of technology and jobs from the United States to other countries, especially to China, certainly have a stake in playing up fears about purported cyberthreats.

However, something to watch out for is when politicians start to use false or dubious allegations to play on the fears of the populace as an excuse to restrict or more tightly control cross-border exchanges of data with China or any other country.

One worrisome example of a largely unfounded allegation against China is the publication of a report from US-based security firm Mandiant about alleged Internet attacks by the Chinese army. While Mandiant's allegations are worrisome on the surface, they are not completely grounded in fact, according to South Africa-based security firm Thinkst. (See: Cyberwarfare & the Battle to Protect Supply Chain Data.)

According to Mandiant, a China-based army unit of hackers is behind the so-called "APT1" attacks, which it says have involved over 1,900 assaults targeting mainly US and Canadian networks. Over 97 percent of the attacks originated from IP addresses in the Shanghai region, where Mandiant estimates there are possibly hundreds of hacker operatives involved.

Faulty facts?
But according to Thinkst, Mandiant's metrics are at fault. The main issue is that Mandiant failed to conclusively demonstrate that the IP addresses corresponded to a single organization, which has set a dangerous precedent. Thinkst writes:

We are not saying the Chinese government does not hack the US. Our concern is with this specific report; it is the first concrete public attribution of ongoing espionage against the US, and, if the report sets the standard for attribution, future events will be highly muddled as competing hypotheses all meet the low standard set out in Mandiant's APT1 report. Unfortunately it seems that contrary opinions are being subjected to a level of diatribe usually reserved for arguments of faith, not facts.

Following the publication of Mandiant's report in February, the US State Department published "Administration’s Strategy on Mitigating the Theft of U.S. Trade Secrets," which outlines policy measures and proposals to help organizations protect their data from foreign attacks. Both reports were released just a few days after The New York Times reported that a group of hackers originating from China had penetrated its networks.

The US government outlines voluntary and seemingly benign best-practices to help organizations protect their sensitive data in "Theft of U.S. Trade Secrets." But what happens when the elected officials decide to take the next step and force organizations to follow certain procedures?

Chilling effects
The risk is when lobbyists convince Congress to create mandates that require organizations to spend a lot of money on software or hardware they do not want or need in the name of security. They might also mandate that companies with supply chain partners in China comply with unreasonable and expensive compliance procedures beyond the alphabet soups of regulatory compliance protocols that organizations must already follow when exchanging and storing data abroad.

Heavy-handed laws and regulations put in place under the guise of blocking Chinese hackers from stealing trade secrets would have obvious implications for supply chains that rely on cross-border data exchange over the Internet. And they would almost certainly prompt Beijing to retaliate, prompting it at a minimum to more heavily regulate and censure data communications than it already does.

In the worst possible outcome, the war of rhetoric and empty allegations could lead to an all-out cyberwar levied multilaterally, while ending the relatively freedom of data exchange that we have come to expect from the Internet.

Organizations are rightfully concerned about losing their competitive edge when hackers steal data over the Internet and obviously hope the government has a plan in place to head off these kinds of thefts in an appropriate way. But forcing organizations to comply with stricter and obtrusive laws and regulations that do not help much, based on irrational fear mongering, is not a viable solution.

Hopefully, Washington will taper off its war of words and learn how to better nab and shutdown black hat hacker networks that operate from China or anywhere else, in a way that remains transparent and unobtrusive to the non-combatants.

Related posts:

• America's Declared (& Undeclared) Cyberwar
• Trade Secrets for Sale
• When Is IP Theft OK?