The indictments of five members of the Chinese military for computer hacking serve as a reminder that cybersecurity efforts may be bridging a gap between government and the private sector, but also blur a line between economic interests and national security.
The five individuals stand accused of stealing trade secrets from six American companies in the nuclear power, metals and solar products industries in order to allegedly give Chinese corporations a competitive edge in the marketplace or in litigation.
Wang Dong, Sun Kailiang, Wen Xinyu, Huang Zhenyu, and Gu Chunhui, officers in the Chinese People’s Liberation Army (PLA), were indicted by a grand jury in the Western District of Pennsylvania.
“This is a case alleging economic espionage by members of the Chinese military and represents the first ever charges against a state actor for this type of hacking,” U.S. Attorney General Eric Holder said during a press conference announcing the indictments.
“The range of trade secrets and other sensitive business information stolen in this case is significant and demands an aggressive response,” Holder continued. “Success in the global market place should be based solely on a company’s ability to innovate and compete, not on a sponsor government’s ability to spy and steal business secrets. This Administration will not tolerate actions by any nation that seeks to illegally sabotage American companies and undermine the integrity of fair competition in the operation of the free market.”
The indictment alleges that Wang, Sun, and Wen, hacked or attempted to hack into US corporations, while Huang and Gu aided in the conspiracy by managing domain accounts used for hacking. The entities affected included Westinghouse Electric, US subsidiaries of SolarWorld AG, United States Steel, Allegheny Technologies, the United Steel, Paper and Forestry, Rubber, Manufacturing, Energy, Allied Industrial and Service Workers International Union, and Alcoa Inc.
“For too long, the Chinese government has blatantly sought to use cyber espionage to obtain economic advantage for its state-owned industries,” said FBI Director James B. Comey. “The indictment … is an important step. But there are many more victims, and there is much more to be done. With our unique criminal and national security authorities, we will continue to use all legal tools at our disposal to counter cyber espionage from all sources.”
“State actors engaged in cyber espionage for economic advantage are not immune from the law just because they hack under the shadow of their country’s flag,” said John Carlin, assistant attorney general for national security.
According to Robert Anderson, FBI executive assistant director, the affected companies experienced “significant losses” due to the actions of the indicted hackers. He applauded the cooperation between the US government and the private sector in the investigation and warned that the US would not back down.
“This is the new normal. This is what you’re going to see on a recurring basis—and not just every six months. If you are going to attack Americans—whether for criminal or national security purposes—we are going to hold you accountable. No matter what country you live in,” he said.
The Chinese government quickly hit back at the indictment action, demanding the US withdraw the charges in order to preserve relations between the two countries.
One to watch
Gregory Guidice, founder of RazorThreat, an information security firm based in Pontiac, Mich., said the case should be interesting to watch unfold, since privacy laws differ in the US and China.
“It’ll be interesting to see if this becomes a landmark case,” said Guidice. Already, the case brings the private sector and the government together, encouraging communication.
“We are all victims and everyone is really interconnected,” he said. Criminals look for the weakest link, Guidice pointed out, and draw data from a variety of sources that, on their own, don’t look valuable but when combined can be damaging.
“We need to work together to provide this threat intelligence landscape that really blankets all of us,” he told Advisen. The public sector can benefit from cooperation with large aggregators of consumer data, while large enterprises would want to know about organized crime and cyber corporate espionage tracked by the government.
“That’s where the two relate to each other,” Guidice explained. However, consumer views of data sharing and privacy don’t always match government or corporate views.
Consumer opinion also varies by demographic, he noted, with younger generations having grown up in a “social media era.”
“That really opens up a whole other discussion about privacy rights,” Guidice said. “What’s considered private today?”
Guidice added the indictments should also help to raise awareness and force organizations to look at their data and determine what is critical to them.
“This is a great example that it is happening and it continues to happen on a daily basis,” he said. “You can turn on your computer every day and see that there’s another breach or a suspected breach every day. Organizations have to come to the realization that cybersecurity is a journey, it’s not a destination. The sophistication of the hackers continues to evolve faster than the technology to stop them.”
Erin is the managing editor of Advisen’s Front Page News. She has been covering property-casualty insurance since 2000. Previously, Erin served as editor-in-chief of The Standard, New England’s Insurance Weekly. Erin is based in Boston, Mass. Contact Erin at [email protected].
