On 19 May, the US Department of Justice (DOJ) indicted five officers of People's Liberation Army (PLA) on charges of hacking the computers of six US entities to benefit China's state-owned enterprises. This marked the first 'criminal charges against known state actors for hacking,' according to the DOJ.
This move reflects the mounting frustration of the US Government and industry at allegedly ongoing cyber espionage by the Chinese. To be recognised as cyber-attack victims in public in this way is a big step for these six US companies, which would be concerned about the unfavorable impact on their reputation and business operations (including stock prices) that comes from hacking revelations. But the US Federal Bureau of Investigations reportedly warned some 3000 US companies of hacking, most of which is believed to originate in China, so Beijing may not feel pressured by the small number of companies involved here.
US law enforcement will not be able to arrest the suspects. There is no extradition treaty with China and China would not comply with any request to hand over alleged members of a PLA unit even if there was one. So the indictment is an attempt to send a message that the US Government does not tolerate economic espionage and it is willing to take legal action even against foreign governments.
Nevertheless, this landmark event will likely produce more near-term negative consequences than positive ones on the diplomatic front, for US commercial activities in China, and for US intelligence operations. [fold]
First, the indictment further strains the relationship between China and the US, and dialogue will become more difficult at a time when bilateral ties are already tense, with what many see as China's provocative and belligerent behaviour in the East and South China Seas. Beijing has reacted strongly to the DOJ statement. China's Defence Ministry denied the allegations on its website, arguing that the Chinese Government and PLA never engage in commercial cyber espionage. The Chinese Foreign Ministry criticised the US claim as groundless and demanded Washington withdraw the charge. It also declared that the Chinese Government is suspending its participation in cyber security talks with the US, which began last June, because it sees the US government as lacking the sincerity needed to cooperate on solving cyber security issues.
This statement sets a high bar for the Chinese Government, since the denunciation will make it hard for Beijing to find a way to return to the dialogue without losing face. Even though neither Chinese nor US government officials can expect such cyber dialogues to allow completely frank discussions, the consultative mechanism can enable both governments to build personal, confidential relationships and identify appropriate channels to share concerns. Now, that opportunity is lost.
Second, the US indictment could trigger retribution by China. China's Assistant Foreign Minister Zheng Zeguang told US Ambassador Max Baucus that China 'will take further action on the so-called charges' by the US.
The leaks by Edward Snowden provided the Chinese Government with the upper hand to accuse the US of cyber espionage and US companies of cooperating with such operations. Thanks to Snowden, US technology companies are already suffering sales decreases in China (Cisco Systems expected its revenue in China to drop 10% in fall 2013 and continue to go down toward the middle of 2014) and the DOJ's legal action could lead to an even worse business environment for US companies in China. China's State Internet Information Office recently announced it would begin vetting IT products to prevent wiretapping and malicious disruption to those products and users. Companies which fail the overhaul will be required to stop providing products and services in China. This procedure reflects Chinese fear that US IT products may have 'back doors' for surveillance.
Finally and ironically, the indictment could harm intelligence operations by the US Government and industry, and make it difficult to pursue future similar indictments, because the DOJ indictment and the information revealed by Snowden show what the US government is looking at in terms of China's cyber espionage. China is likely to change its cyber espionage tactics as a result. This April, the PLA was ordered to overhaul loopholes in the management of classified activities, documents, and facilities due to 'an increasingly complicated security environment and intensified competition'. Although it is unknown if the development is related to the Snowden effect, the PLA is now more keen to enhance its operational security and cyber defences. This will make it challenging for the DOJ to gather evidence for future cases.
The outlook for China-US relations is bleak. Cyber espionage by state and non-state actors, including the Chinese, is likely to endure, and neither party seems to have found a way to get out of the trap of naming and shaming. In the meantime, what the US can do is improve cyber defences at the governmental and industry level. What China can do is to reach out to the US to start an unofficial dialogue that maintains personal and institutional channels. This is crucial to mitigate misunderstandings and potential escalation, not only for China and the US but other countries.
Image courtesy of the FBI.
