Google recently reported that a China-linked hacking group ran artificial intelligence tools inside compromised networks. The technique let the hackers use victims’ computing resources and credentials while reducing the traffic that might expose them. The group also targeted North American academic, medical, military, and technology-research institutions. That is a serious warning.
The disclosure followed a Justice Department and FBI operation against QScan and QTRouter, two platforms allegedly used by a Chinese state-sponsored group known as QTFY. Prosecutors say the group, employed by Nanjing Xinjiuwei Network Technology, sold hacking services to customers that included China’s Ministry of State Security and People’s Liberation Army.
Chinese cyberattacks are only going to get more capable. We need a concerted plan to protect our infrastructure and private information before it’s too late.
Court records identify NASA, the Federal Reserve, the Departments of Energy, Justice, and Health and Human Services, the National Institutes of Health, and the U.S. Senate among the targets. They also list hospitals, telecommunications providers, power companies, financial institutions, and defense contractors. The public evidence does not show that every listed network was breached. Still, it’s a major concern.
The operation illustrates how Beijing can combine government direction, private contractors, compromised devices, and commercial infrastructure in a sustained espionage campaign. Diplomatic engagement with Chinese leaders does not eliminate that threat, and cybersecurity policy must account for it regardless of the state of bilateral relations.
On Aug. 26, the same day officials announced the QScan and QTRouter seizures, the White House declared a national emergency involving foreign-produced bulk-power equipment. The order lets the government restrict transactions involving equipment that poses an unacceptable security risk as well as identify, isolate, monitor, or replace vulnerable components.
The risk is substantial. Grid operators increasingly depend on networked sensors, controllers, and other devices associated with the “internet of things.” Connectivity can improve efficiency and monitoring, but it also expands the attack surface. The fear is less that China will shut off the lights tomorrow than that it will slowly gain the ability to cause blackouts and spread panic — a security advantage it can leverage.
The administration’s Cyber Strategy for America calls for hardening critical infrastructure and its supply chains, including the energy grid, data centers, water utilities, hospitals, and telecommunications systems. The recent cases show why that work must extend beyond power plants to vendors, contractors, and the devices that connect essential services.
Cyber defense is only part of the problem. Washington must also decide how to evaluate Chinese companies whose technology enters sensitive American systems.
Nanjing Xinjiuwei is a useful example: The government alleges that the company employed QTFY and received payments from China’s Ministry of State Security. No surprise that plenty of other Chinese companies have also engaged in espionage.
The Pentagon this summer added Alibaba and BYD to its list of entities it identifies as Chinese military companies operating in the United States, effectively banning them from securing defense contracts. What took so long?
RELATED: America’s adversaries are using top American tech — without telling their customers
Smederevac/iStock/Getty Images
Huawei presents a more dangerous case. The Justice Department has accused Huawei and several subsidiaries of racketeering, trade-secret theft, and concealing business in countries subject to sanctions. Separately, federal law restricts agencies and contractors from using specified Huawei telecommunications equipment, and regulators have designated the company’s equipment a national-security risk.
The company’s U.S. research affiliate, Futurewei, also drew congressional scrutiny after lawmakers said it shared a California office complex with Nvidia for years. Nvidia has said its operations remained separate. Huawei’s past relationships with American universities likewise prompted several institutions to review or end research funding arrangements.
The American economic system is open by nature, and this risks allowing easy access to malefactors like Huawei.
Successive administrations have maintained or expanded restrictions on Huawei while encouraging alternatives in the global telecommunications market. National-security officials also cited competition with Huawei when supporting the Hewlett Packard Enterprise acquisition of Juniper Networks. That case illustrates how industrial policy can overlap with security interests.
The Center for Strategic and International Studies has catalogued 224 reported instances of Chinese espionage directed at the United States since 2000. Its survey excludes espionage against U.S. allies and more than 1,200 intellectual-property lawsuits brought by American companies against Chinese entities.
The policy challenge is broader than any single breach or company. The United States must secure critical networks, investigate firms on the evidence, enforce procurement and export-control rules consistently, and work with allies on interoperable alternatives.
Chinese cyberattacks are only going to get more capable. We need a concerted plan to protect our infrastructure and private information before it’s too late.
Read the full article here
