Trouble shooting

IF CHINESE spies broke into an American government building and stole important documents, or were seen planting explosives in the electric grid, uproar or worse would ensue. Yet state-supported Chinese hackers have, officials say, been getting away with the digital equivalent for years, with notably little response.

Now President Barack Obama’s administration has drafted economic sanctions against Chinese companies that it believes have profited from trade secrets stolen from American firms. Amid wrangles inside the administration, there are hints that they could come into force soon, though probably not before Xi Jinping, China’s president, visits Washington this month.

The new sanctions would be along the lines of those imposed on Iran: the named Chinese firms would be barred from doing business in America, doing them, and their bosses, real damage. They would be much tougher than the warning shots fired in May 2014 when, after years of careful case-building, the administration issued indictments against five Chinese military-intelligence officers. This was dramatic, but largely symbolic: China, which denounced the charges, does not extradite any of its citizens to America, let alone spooks.

Attempts to settle this diplomatically have failed. Two years ago an American security firm, Mandiant, published a report on an elite group of the People’s Liberation Army, code-named Unit 61398, which it said engaged in huge and systematic theft of American intellectual property. The administration, after years of privately urging the Chinese to back off, gave a strong hint that the report was true. China had agreed to hold regular high-level talks on cybersecurity—which were strained by revelations from Edward Snowden, a fugitive National Security Agency contractor, which suggested that the agency had itself been spying on Chinese companies. The talks were cancelled last year after the five Chinese officers were indicted.

Point and click

The administration is trying to distinguish between cyber-espionage, which America and all militarily advanced countries engage in, and state-sponsored theft carried out over the internet. The NSA’s defenders argued that though it may have spied on Chinese targets such as Huawei, a big maker of telecoms kit, it does so because these firms are handmaidens of the Chinese state. It does not steal their commercial secrets to benefit corporate America. During the post-Snowden backlash, few were willing to hear the American argument. Huawei insists it is independent; China says it is a victim of hacking, not a perpetrator. But now the administration is making its case once more.

Commercial hacking, at which China excels, is only one of three main threats to America’s computers and networks, which come from many adversaries. A second, newer, sort is to America’s intelligence agencies—as illustrated, in July, by news that Chinese hackers had stolen records of around 22m federal government employees from the sleepy and ill-run Office of Personnel Management (OPM).

The records of American spy-agency employees were not among those pilfered. Yet a simple process of elimination can identify those posted under diplomatic cover abroad: if regular diplomats are in the OPM database, any embassy employee who is not there is a likely spook. Other breaches make matters worse. Spies, however well-disguised, have health records, tax returns, utility bills and credit ratings. Hackers have successfully breached networks on which all such things are stored. This gives further clues to identities—and activities. As an open, advanced society, America now faces unprecedented—perhaps fatal—difficulties in maintaining a clandestine espionage service.

The third, and to some most troubling, worry is digital weapons, which disrupt the hardware and software that keep a country going. They may range from simple swamping attacks, of the kind used by Russia against Estonia in 2007, to elaborate efforts such as Stuxnet, a piece of malicious software that America and Israel used to destroy Iran’s nuclear centrifuges.

Digital weapons have their drawbacks. Iran’s nuclear programme was delayed, not derailed. But they present problems for America’s military planners. They involve discovering and exploiting weaknesses which potentially affect everyone, not just America’s enemies. The NSA, post-Snowden, is under fire for having deliberately weakened commercial cryptography to ease its espionage efforts. A digital weapon that sabotages power stations could also be discovered and used by America’s foes.

Attributing digital attacks is said to be getting easier. But it is necessarily harder than in the real, “kinetic” world. So is deciding on the scale and direction of any retaliation. Arms control is all but impossible: digital weapons have to be secret to be effective. Though officials are cagey about the details, they believe they have detected Chinese and other hackers snooping on (and perhaps interfering in other ways with) computers and networks which run important infrastructure. Efforts to strengthen the systems involved are under way; the creaky power grid is a particular worry. Working out who is ahead is hard. America is doubtless making similar efforts on infrastructure networks in Russia and China—which may be in some ways more vulnerable to attack.

Stux on the Hill

A sense of urgency is growing. An intrusion-detection system, misnamed “Einstein”, failed to protect the OPM. Hackers (Chinese, Russian and others) have breached unclassified networks in the White House, State Department and Pentagon. Experts fear many other, perhaps more serious and sophisticated, attacks may be going unnoticed on both government and private networks.

In response, America’s military, counter-intelligence and criminal-justice authorities are working together more closely. An alleged Chinese hacker in Canada, Su Bin, will be extradited shortly. An executive order signed by Mr Obama in April gives the administration wide-ranging powers to respond to foreign cyber-attacks.

But the outlook is still bleak. Even a bipartisan and widely supported measure to exempt information-sharing about cyberattacks from privacy and antitrust lawsuits has been stuck in Congress for three years. It fell foul of legislative deadlock in June and is now on the Senate’s overcrowded agenda for this month.

The deeper problem is that America’s woes stem from decades of bad decisions and bad habits. Until people in charge of sensitive data and computers see the threats more clearly, attackers will have a field day. Hillary Clinton’s casual attitude to her official e-mails while secretary of state (she kept them on her own private, insecure server) is just the tip of a big and dangerous problem.