China Hackathon* is Harmful to American National Interest

This piece, co-authored with Professor L. Ling-chi Wang, was submitted to New America Media and an edited version was posted on their website on Tuesday, February 26, 2013.  China's Global Times posted a version on March 6, 2013 and US edition of China Daily on March 13, 2013.
*We coined a term, hackathon, to connote on the one hand the alleged rampant hacking activity from China and on other the endless stream of accusations from the western media that seemed to preclude any possibility that hacking could come from elsewhere in the world.
------------------------------------------

Recent reporting of alleged hacking from China rapidly reached a crescendo. Led by the New York Times sensational disclosure of Chinese hacking since January 30, every publication of note or little note all seemed to have one or more stories on cyber attacks emanating from China.  

They were immediately followed by another headline-grabbing release of the Mandiant Report  on February 18, setting the stage for an announcement from the White House on February 20 that the administration was determined to protect American businesses and punish the perpetrators at home and abroad.

Is this an orchestration for a new policy initiative?  Or, is this just a reinforcement of Obama’s “pivot to Asia” and “Trans Pacific Partnership,” two major initiatives aimed clearly in response to the so-called “Rise of China”?

Since the nascent art of hacking and counter measures of cyber security are subjects too esoteric and beyond the comprehension of most except those skilled in the craft, the media focused on the more lurid details taken from the so-called Mandiant Report.

The report alleged that most of the cyber attacks levied against corporate America came from a 12-story building in Pudong Shanghai that belonged to a particular department of People’s Liberation Army.

Since the issuer of the report is in the business of selling their services to safe guarding company networks from cyber attacks, presumably it is in their interest to portray the attackers as menacing and sinister as possible. The PLA certainly fits the bill.

However, shortly after the Mandiant Report broke the news, articles that presented contrary points of view began to appear. The most comprehensive belonged to Jeffrey Carr, a cyber security expert in his own right, who pointed out that there are more than 30 nations with the capability to run “military grade network operations” necessary to mount the kind of sophisticated attacks found in the report. According to the U.S. National Intelligence Estimate, Russian, Israel, and France are among the leading countries in cyber hacking activities. 

Carr concluded that Mandiant was too quick to identify China as the culprit without performing rigorous analysis to eliminate other competing hypotheses and comparing its cyber espionage activities with those of other countries.

Two days after the New York Times article, the US edition of the World Journal, an ethnic Chinese daily, reported that 7 of the IP addresses identified by the Mandiant report as coming from the PLA office in Shanghai were actually from Hong Kong including one from the Hong Kong University of Science and Technology.

This was not surprising since hacking can come from anywhere in the world and easily misdirected to appear to come from somewhere else. What was surprising was that this finding came from a little noted ethnic paper and not from the major media stars.

Maybe Al Gore did not invent the Internet but it is an inconvenient truth that the US defense agency did and the Americans have since led the development and use of the Internet. As the world’s most advanced economy, the US has invested heavily and become most dependent on networks in the cyber space and thus most vulnerable to attacks.

The US also led in the development and use of weapons in cyber warfare. For example, the American developed Stuxnet worm has been credited with causing the centrifuges to spin out of control in the Iranian nuclear enhancement facility. Being the first known to use cyber attack in peacetime and in the absence of any international treaty and protocol, the US has lost the moral high ground to define appropriate conduct in cyber space.

This is of course not the first time that the US is reaping the consequences of what they sowed. The US has been the first (and to date) only country to use the atomic bomb. Since then, the US has had to devote decades of diplomatic efforts to promote nuclear non-proliferation and now live in fear of nuclear weapons falling into the hands of rogue nations or terrorists.

The next Pandora’s box that the US has already opened and soon will be trying to close shut is the use of drones for transnational surveillance and assassinations of terrorist suspects without due process. Friends and foes alike have seen the cost effective capability of a drone in rendering destruction and killing and all are rushing to develop their me-too ability.

The day is nigh when the Americans will be troubled by the prospects of encountering drones of unfriendly intentions controlled by someone holding a grudge against America. Then the US will once again have to expend much diplomatic efforts proselyting the idea of “do as I say and not as I do.”

From time to time, China has been trying to tell the US that they do not hold any grievances against the US. In typically understated ways, China has let the US know that China possesses silent running submarines, stealth planes and missiles capable of downing communication satellites. China even went out of their way to make sure that American intelligence got a full picture of China’s nuclear weapon technology as suggested by nuclear scientist Daniel Stillman of the Los Alamos National Laboratory. Latest airshows in China are displaying a large array of drones being made in China.

China appears to be practicing a porcupine defense strategy, i.e., peaceful intentions but beware of the ability to retaliate in kind. Some have suggested that the alleged PLA hacking has been deliberately sloppy, thus leaving visible trails to let the US know that China has cyber warfare capability.

Cyber espionage and warfare are serious problems here to stay.  The U.S. needs to develop effective, long-term counter measures and thoughtful and balanced diplomacy.  Singling out China as the sole villain without critically examining what other nations are doing, including us, is counterproductive, potentially misleading and in the long run, harmful to our national interests and world peace.