The Grave Cyber Threat Posed by China
In comparing the cyber threats posed by Russia and China, the CIA’s top cyber official used this analogy. “Russia is like a massive hurricane that can have very long-lasting damage and impact. But the PRC is like climate change with the potential for an epic event that could change lives. The FBI has stated that the economic espionage efforts emanating from the Chinese Communist Party are a grave threat to the economic well-being and democratic values of the United States. And the news is littered with examples of agents of the CCP who have infiltrated academia, corporate America and government, harvested our most valuable and sensitive intellectual property and then sent it home to grow the economic power of the Chinese State. Indeed, the Chinese State for years has repurposed many of its counterintelligence operatives away from traditional espionage and refocused on the theft of intellectual property from the U.S. companies and those of other economic powers.
To examine this issue, I spoke with former FBI Assistant Director Frank Figliuzzi. Frank’s last position in the FBI was head of Counterintelligence where he oversaw all espionage investigations for the US government. After retiring from the FBI, Frank spent 5 years as a corporate security executive for GE as head of intellectual property protection and insider threat for GE’s 200,000 employees in 200 nations, including 20,000 employees in China. For the past six years, he has been a national security contributor for NBC News.
Social media. Solar, wind and gas turbine technology. Genetically modified grains. Electric vehicle technology. Blockbuster pharmaceutical drugs formulations. Nothing seems to be off the table or out of reach.
What most people fail to realize is that not only is Chinese spying not kept in check by independent political bodies or the rule of law such as the case in Western countries, but there are actually national security laws in force in China that require Chinese businesses to work with Chinese intelligence agencies whenever such cooperation is “requested”. China’s mission is simple: steal as many scientific and technical secrets from the United States as possible to advance China’s position as a financial superpower.
I asked Frank if it is even possible to even the playing field or have we already lost the battle for economic supremacy.
The idea of totally neutralizing the threat from China is not something that security professionals approach or use as a mindset. Rather, it’s about risk mitigation moving forward. We are living with a pervasive threat and the list of things that China has stolen is real. We’ve got to understand that we have to stop treating the China threat as just another threat. They have too many resources and a national culture that is forced down onto the people from the Communist party that is about dominance through acquisition of your stuff. They have dug hybrid seeds out of the ground in America so that they could reverse engineer them. They’ve literally stolen the color white from DuPont Corporation because the chemical substance that they’ve come up is literally used in everything from airplane coatings to Oreos.
Frank offered some advice on what our most innovative companies and research institutions should do right now to try to mitigate the unrelenting assault on their innovations.
Companies often say they’ve got to do business with China. Saying China is bad is not the right approach. It’s unrealistic to the think that a global business can wall itself off from China. It’s a question of how do organizations protect themselves in that environment. Companies first need to understand what it is they’re trying to protect. Sounds simple enough. But in a major global company, determining all the things they make in all the unique ways they make them, can be a major undertaking. It is essential though to identify what those crown jewels are if you have any chance of preventing them from walking out the door. That is step one and it can be quite the exercise.
I’ve investigated multiple IP thefts and have come to realize that companies struggle with classifying what their crown jewels are, where they are physically located and the extent to which they are held to some sort of higher standard of security. I worked an investigation where the most prized intellectual property of a chemical company had been compromised and they were in that exact posture where they didn’t know where it was. I had them walk me through the research laboratory. They had all these research scientists seated together in a bullpen. On top of each of their unattended desks was a black and white composition notebook containing their most advanced research. Can’t get much more low tech than that. Unfortunately, locking up all of the composition notebooks is not the way of the future.
I asked Frank to elaborate on what our most innovative companies and research institutions should do right now to try to mitigate the unrelenting assault on their innovations. This is key because the sales force has numbers to meet every quarter and overseas mergers or acquisitions drive growth and that’s understandable. But you also have to develop a risk acceptance approach. Put simply, how much risk is your organization willing to accept as a company when you do this deal with China? Often security professionals in corporations wring their hands because they don’t directly contribute to the bottom line and are viewed as a cost center. How do they measure their success? One way to measure success is in the extent of their interaction with other core operational and revenue generating parts of the company, the value of a given deal, and what the company is willing to invest in IP protection activities to protect that value. Leaders must rethink how they view the interactions between those charged with protecting IP assets and dealmakers. They can no longer afford to view them negatively or worse, exclude them from having a seat at the table because they might say no. Instead, there needs to be recognition that their role is to make saying yes possible by mapping out the steps to take to protect the company and the value of the deal moving forward.
Frank believes companies are not vetting their applicants enough and offered a best practice that he’s seen work. Background investigations are fundamentally different from one country to the next and China can be a challenging jurisdiction – but not impossible. The sources of information are different and so are the risks. As a result, the process needs to align with the most potentially impactful risks and what information is needed to mitigate those risks. It also requires an understanding and acceptance that those types of investigations in China will cost a little bit more than simply running a credit check and verifying someone’s last known employment. Frank cited examples of when he learned that a candidate’s father was a colonel in the Chinese People’s Liberation Army, or another candidate who went to a university from which the Chinese intelligence services are known to recruit operatives. Armed with that information, organizations can make informed decisions such as not hiring someone who’s gone to the university that the Chinese MSS recruits from or who’s parents are high ranking officials in the PLA or CCP.
In academia, students and professors pose a risk to our academic institutions who are involved in sensitive research. Yet locking down admissions and denying employment opportunities based on ethnic origin isn’t something we do here. I asked Frank how our academic institutions can continue their “open campus” cultures while still preventing their most prized research and development assets from being picked clean.
According to Frank, this is particularly sensitive because not only is there the potential for backlash related to racial profiling or discrimination, classifying sensitive data in academia is tricky due to something Frank terms pre-classified research. Pre-classified research is sensitive data but for which the application is not yet known. Certain categories of research in a university setting are already locked down because the research is being funded by the Department of Defense, for example. What is more concerning though is what’s not locked down and what has dual use or even applications about which we’re not yet aware.
Further amplifying the risk to academia is the fact that Chinese intelligence agencies have directed graduate students toward specific research studies for the purpose of harvesting the results of the research. Chinese grad students studying in the U.S. are monitored closely by the Chinese government and they report to a handler often at the nearest Chinese consulate. There’s also a Chinese student association at the universities and with group members who report back to the Chinese government. Their techniques are heavy-handed and Chinese citizens are obligated to cooperate with government intelligence agencies or face severe consequences. Understanding that dynamic usually causes a light bulb to go on with security professionals in the university setting.
The Chinese State is widely considered to have been responsible for the 2014 hack of the U.S. Office of Personnel Management’s U.S. Government Security Clearance files affecting nearly 20 million current, former and prospective employees and contractors. Then, in 2017, consumer credit bureau Equifax was hacked with 150 million people’s credit profiles lost including personal identifying data, details of their consumer spending and buying power and any adverse information is also believed to the work of the Chinese state. We may never know the full extent of the damage to U.S. intelligence this caused but it’s safe to say, it has guided and continues to guide the Chinese government’s unrelenting efforts at recruiting U.S. persons to spy on their own government. These catastrophic data losses and the resulting vulnerabilities to our national security seem obvious. Which brings me to TikTok which on its face, may seem fairly benign. I wanted hear from Frank what is it about TikTok’s Chinese ownership that has the U.S. Government concerned and what safeguards can each of us take to make sure our social media information doesn’t fall into the wrong hands. Frank sees all these seemingly separate threats and activities as all being tied together. It may seem like these are very different aspects of things, but it’s all about the collection process on a level that boggles the American mind because we simply don’t have those resources, nor do we have our resources dedicated to hoovering up everything we can get our hands on. It’s not who we are or what we do, but recently the FBI director pointed out that, look, if the FBI were to turn every one of its cyber employees over to focus on the China threat and nothing else, they would still be outnumbered at something like 50 to one. Russia and China are the two biggest cyber threats we have but there are differences.
If intellectual property was sand on a beach, Russia would come in with a steam shovel. They would scoop up as much as they could, and they would leave. You would see the big hole in the ground, you would hear the steam shovel and you would know what happened. The Chinese approach is to go and send people each to take one grain of sand from the beach until the beach is gone, no matter how long it takes.
The Chinese spy balloon which U.S. warplanes shot down over U.S. airspace was one of the stranger manifestations of the China threat. Was this simply aerial reconnaissance collecting data from communications satellites or ground targets or was this a tactical move to test the security of our airspace, take a measure of our government decision-making, track media coverage and assess our military response capabilities and tactics? Frank’s response was “all of the above”. We’re in a strange place in our country right now. Literally everything politicized and is looked at in terms of blue versus red. Our response to the spy balloon immediately became political fodder when it should’ve brought the parties to counter the emergence of a new threat. What we have learned about the spy balloon through legitimate journalistic channels is that our military and intelligence community decided with the White House to let this thing keep going. If you shoot it down over a populated area, that’s a problem. But more importantly, the US Intel community gathered more information from that balloon incident than the Chinese government gathered. And yes, they were trying to assess and look at our military facilities but they could have done that much less noticeably via spy satellites. There was more going on there which was the desire to test American reactions. They wanted to send the message that they can do whatever they want over US airspace and were eager to collect and analyze data on how we responded. And did we prove ourselves as tough, resilient, and united against an adversary? No, we got on cable news and screamed at each other. So did they glean something about us? “Oh, hell yes. But I think we got more out of it than the Chinese did.”
To hear my entire conversation with Frank Figliuzzi, you can access it here.
###
