(The Atlantic) The US Justice Department announced indictments of four members of China\u2019s People\u2019s Liberation Army for alleged involvement in the massive 2017 hack of the database of giant US credit rating agency Equifax.<\/p>\n\n\n\n
The Justice Department raised eyebrows on Monday when it unveiled charges<\/a> against four members of China\u2019s People\u2019s Liberation Army for hacking into the credit-reporting agency Equifax and stealing sensitive information on 147 million Americans. The charges are the latest in a campaign of indictments against Chinese-government-linked hackers that dates to 2014 but has ramped up considerably since 2017, the year the Equifax breach took place. Like the defendants in several prior hacking indictments, the men whose identities were revealed to the world this week are based in China and almost certainly will never appear in a U.S. court to stand trial. Taken alone, the indictments are a hopelessly anemic response to one of the largest personal-data breaches ever recorded.<\/p>\n\n\n\n The bigger picture doesn\u2019t look much better. As the Harvard law professor Jack Goldsmith and I have argued<\/a> before, if deterrence is the measure of success, the United States\u2019 Chinese-hacking indictment strategy has all the earmarks of a spectacular failure. A raft of media<\/a> and government<\/a> reports suggests that China\u2019s state-sponsored cybertheft has not meaningfully diminished in response to the U.S. indictment campaign. This shouldn\u2019t come as a surprise: The costs to China of being \u201cnamed and shamed\u201d are almost certainly dwarfed by the billions of dollars of value obtained from pilfering U.S. technologies and the untold intelligence benefits of cultivating a massive database on American citizens.<\/p>\n\n\n\n If not deterrence, what might be the purpose of these indictments instead?<\/p>\n\n\n\n Some have argued that one aim of the indictment strategy is to enforce a norm<\/a> against state-sponsored theft of intellectual property carried out to support a nation\u2019s commercial firms. The norm was articulated in President Barack Obama\u2019s September 2015 meeting<\/a> with Chinese President Xi Jinping, with each country agreeing that it would not \u201cconduct or knowingly support cyber-enabled theft of intellectual property, including trade secrets or other confidential business information, with the intent of providing competitive advantages to companies or commercial sectors.\u201d (This commitment was later endorsed<\/a> by the G20.) The cyber agreement followed on the heels of the first ever U.S. indictment of Chinese People\u2019s Liberation Army hackers, in 2014; many at the time credited the indictments with facilitating the establishment of the norm. In hindsight, however, the fact that China and other countries have continued their theft of U.S. commercial secrets with little penalty suggests that the cybertheft norm is not much of a norm at all.<\/p>\n\n\n\n Even if norm construction were the objective, the Equifax allegations do not obviously breach a standard that the United States has embraced. The 2015 U.S.-China agreement did not mention hacking for national-security purposes (as opposed to commercial benefits), and the U.S. government has hardly suggested that it would forgo stealing data to protect U.S. national security. Former Director of National Intelligence James Clapper illustrated this dilemma when discussing China\u2019s 2015 breach of the Office of Personnel Management, which compromised background-investigation files on 22 million Americans. Clapper observed<\/a>, \u201cYou have to kind of salute the Chinese for what they did. If we had the opportunity to do that, I don\u2019t think we\u2019d hesitate for a minute.\u201d<\/p>\n\n\n\n To be sure, the Equifax charging documents allege that customer data held by the company constituted \u201cproprietary business information.\u201d But this does not mean that the Justice Department is treating this breach as a violation of the norm against cybertheft for commercial purposes. If anything, recent developments\u2014including the ongoing national-security investigation<\/a> into the Chinese company that owns TikTok\u2014demonstrate that the U.S. government is treating personal data more and more as a \u201cdual use\u201d item with commercial and national-security value alike. As Attorney General William Barr put it<\/a>, \u201cThis data has economic value, and these thefts can feed China\u2019s development of artificial intelligence tools as well as the creation of intelligence targeting packages.\u201d<\/p>\n\n\n\n It is thus unlikely that the aim of the Equifax indictments is merely to restate the U.S. position on norms of acceptable state conduct in cyberspace. Nor is it plausible that the Justice Department would have sought this opportunity to articulate a new position that theft of personal data to this degree\u2014<\/em>in such massive quantities, with such expansive security and commercial implications\u2014represents conduct that all countries (even the United States) should forswear.<\/p>\n\n\n\n This is not to deny the legitimacy of enforcing U.S. domestic laws that prohibit \u201ccomputer fraud and abuse\u201d or \u201ceconomic espionage.\u201d But given the dim chances that this approach to enforcement will succeed in curbing Chinese behavior, we are left to wonder what other purposes (aside from deterrence) the indictments are intended to serve.<\/p>\n\n\n\n One possibility<\/a> is that the indictment strategy may be working in imperceptible ways in conjunction with the United States\u2019 new offensive posture in cyberspace. The unclassified summary<\/a> of the Department of Defense\u2019s 2018 cyber strategy pledges to \u201cdefend forward to disrupt or halt malicious cyber activity at its source, including activity that falls below the level of armed conflict.\u201d This turn of phrase may signal an effort to shift from deterrence toward disrupting and degrading the capabilities of malicious actors. The \u201cdefend forward\u201d strategy was countenanced<\/a> by Congress in a statute that authorizes \u201cappropriate and proportional action in foreign cyberspace to disrupt, defeat, and deter\u201d an active campaign of cyberattacks against the United States committed by one of four nations, including China.<\/p>\n\n\n\n Read: China\u2019s spies are on the offensive<\/a><\/p>\n\n\n\n It is conceivable that Justice Department hacking indictments provide a legal predicate that aids the Pentagon (through U.S. Cyber Command) in certifying the legality of forward-defense options in response to a \u201ccampaign of attacks.\u201d Attribution of cyber operations is a notoriously complex and difficult enterprise. But if prosecutors can convince an impartial grand jury about Chinese cyber intrusions against U.S. interests, that public record could help justify the decision of defense officials to green-light disruptive operations in Chinese networks. Such an approach would align with former Assistant Attorney General John Carlin\u2019s 2016 remark<\/a> that \u201cin some cases \u2026 a prosecution may not be the right option, but attribution [by the Justice Department] opens the door for sanctions, disruption operations and bilateral diplomacy.\u201d<\/p>\n\n\n\n Even if this speculation is correct, however, it remains unclear why attribution must be done publicly, with the attendant risks that the U.S. government will appear feckless to third parties and invite further malicious activity on U.S. networks. Perhaps indictments are intended to lay the groundwork to justify future sanctions<\/a> against China should the U.S. administration choose to exercise this authority as it has in connection with cyber activity by Iran, North Korea, and Russia. But sanctions would leave U.S. companies that operate in China vulnerable to retaliation at a delicate moment<\/a> in bilateral trade relations, which may explain why they have never been triggered.<\/p>\n\n\n\n Or maybe indictments serve a more precise signaling function by temporally linking U.S. \u201cdisrupt and degrade\u201d operations to the (indicted) activities they aim to counter. The United States and China are immersed in a cybersecurity dilemma<\/a> in which all sides are at pains to distinguish acts of preemption and retaliation. Concepts of cyber offense and defense are blurry<\/a> at best. Thus, the signaling effect of an indictment followed closely by a disruptive cyberattack could potentially help avoid misperception and mitigate escalation risks. But the opposite could also be true. If perceived by China as part of a coordinated \u201cwhole of government\u201d effort to thwart China\u2019s rise, indictment plus disruption could aggravate the dangers of an escalation spiral. Has the U.S. factored these considerations into its strategy?<\/p>\n\n\n\n Ultimately, efforts to discern the calculus behind the Chinese-hacking indictments are necessarily speculative and perhaps less illuminating than the simplest version of reality: that indictments are one of the few tools a vulnerable United States is willing to employ to show the public that it is \u201cdoing something\u201d about persistent cyberthreats. It is fair to wonder whether and when the resources being devoted to this effort will be complemented by equally energetic policies to incentivize companies to adopt the basic cyber hygiene that could have prevented the Equifax breach in the first place. (The Atlantic) The US Justice Department announced indictments of four members of China\u2019s People\u2019s Liberation Army for alleged involvement in the massive 2017 hack of the database of giant US credit rating agency Equifax. The Justice Department raised eyebrows on Monday when it unveiled charges against four members of China\u2019s People\u2019s Liberation Army for hacking into the credit-reporting agency Equifax and stealing… Read more »<\/a><\/p>\n","protected":false},"author":150,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-3868","post","type-post","status-publish","format-standard","hentry","category-article"],"_links":{"self":[{"href":"https:\/\/baileyonlineclassroom.com\/eastasiaandoceaniablog\/wp-json\/wp\/v2\/posts\/3868","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/baileyonlineclassroom.com\/eastasiaandoceaniablog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/baileyonlineclassroom.com\/eastasiaandoceaniablog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/baileyonlineclassroom.com\/eastasiaandoceaniablog\/wp-json\/wp\/v2\/users\/150"}],"replies":[{"embeddable":true,"href":"https:\/\/baileyonlineclassroom.com\/eastasiaandoceaniablog\/wp-json\/wp\/v2\/comments?post=3868"}],"version-history":[{"count":3,"href":"https:\/\/baileyonlineclassroom.com\/eastasiaandoceaniablog\/wp-json\/wp\/v2\/posts\/3868\/revisions"}],"predecessor-version":[{"id":3873,"href":"https:\/\/baileyonlineclassroom.com\/eastasiaandoceaniablog\/wp-json\/wp\/v2\/posts\/3868\/revisions\/3873"}],"wp:attachment":[{"href":"https:\/\/baileyonlineclassroom.com\/eastasiaandoceaniablog\/wp-json\/wp\/v2\/media?parent=3868"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/baileyonlineclassroom.com\/eastasiaandoceaniablog\/wp-json\/wp\/v2\/categories?post=3868"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/baileyonlineclassroom.com\/eastasiaandoceaniablog\/wp-json\/wp\/v2\/tags?post=3868"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
<\/p>\n","protected":false},"excerpt":{"rendered":"