PRC: “Don’t Look At Us, We’re Cybervictims Too!”

China has gotten a lot of tough press worldwide in recent years because of the cyberattacks originating from the PRC.

Some of the critics accuse the government here of State-sponsored hacking, having a shadow force of hackers, crackers, and smackers (I made the last one up) on the payroll. Periodically, they say, the cyberforce gets orders to either test their capabilities against formidable opponents like the U.S. defense establishment, or to actually take down sites.

While I do not discount the threat, some of the rhetoric does tend to be rather breathless and Cold War-ish:

Since 2003, Chinese military hackers have been causing havoc in the computer networks of some of America’s most secure military and nuclear centers.

The Chinese threat from cyberspace has developed at an alarming rate and for the Chinese military and intelligence services it has proved the most cost-effective way of stealing our nuclear, industrial and defense secrets.

In the past five years Chinese hackers, under the guidance of the People’s Liberation Army (PLA) cyber-warfare branch, have penetrated systems at the Pentagon and, more importantly, at Sandia Laboratories, the heart of America’s nuclear research and design facilities.

Scary stuff. I don’t profess to know what China is/is not doing in this area. Some of the critics are Red Scare nutjobs, others are acknowledged experts on the subject who have excellent track records. Certainly the government is involved in this subsector of security policy, but to what extent, and to what end (nefarious or otherwise) remains to be seen. I’ve always assumed that any country that has sufficient IT capabilities is into this stuff, just like every country engages in some form of spying, if they can get away with it.

Regardless of what Beijing is doing in this area, I have no doubt that there is a significant hacker population in this country and that they go after a wide range of “opponents,” including domestic targets.

Hackers that have been co-opted by the government (i.e. working for “The Man”), and I suppose the more nationalist 愤青 type guys, perhaps do not attack PRC government sites, but I’m sure that the other ones do so all the time. That’s their calling, after all, and how else are you going to make your name in the business?

So I saw the following in the paper yesterday:

Hackers have attacked 81 government websites in the past week leaving 29 still paralyzed, according to figures released by the National Computer Network Emergency Response Center of China(CNETCC).

The CNETCC also revealed in its report, that four provincial websites in Anhui, Jiangsu, Sichuan and Tibet autonomous region were down, Chinanews.com.cn reported on Wednesday.

The latest figure, covering May 10 to May 16, marks a decline in the cyber attacks compared to the previous week, May 2 to May 9, where the number of affected websites was 124.

In this CNETCC report, about 150 website with .CN suffix are blacklisted, five malice codes and five software loopholes are also included.

Again, I have no concerns about the accuracy of the report. Of course these sites are targeted, and based on their site designs alone, I’m sure their security sucks big time. However, I can’t help but wonder if there is an ulterior motive in publishing this sort of information.

Once this sort of report is out there in the public domain, and discussed among experts and commentators, it’s possible that it blunts some of the other criticism. China might be conducting studies into cybersecurity, and they might have hackers on the payroll, but how bad could they be? They’re victims too.

This is groundless speculation on my part (the best part of the blogger’s “job”), but even if this is just another news story, and the report’s publication was standard operating procedure, will this kind of information have any effect on the standard, current meme of China as the base of a malicious, State-sponsored group of cyberterrorists? Or is this sort of thing just ignored as irrelevant to the question of whether China is actively preparing for cyberwar?

Note that this is not the only “We’re victims too” story in the Chinese press. Among others, a similar piece, sourced directly from China’s Ministry of Defense, appeared in the Chinese press on March 16 and described incoming hacking attempts from overseas IP addresses, including some based in the U.S.:

A chief editor with the official website of China’s Ministry of National Defense (MOD), www.mod.gov.cn, said Tuesday the site still receives thousands of overseas-based hacking attacks everyday after more than six months of trial operations.

I personally don’t think this will in fact blunt the criticism. However, it will give the government something to use in deflecting such criticism. In the greater international conversation on this issue, you might end up with the appearance of balance (i.e., everyone does it, so China shouldn’t be singled out), facts notwithstanding.

In addition to this narrow bit of speculation, though, there is a more central issue, which for the sake of discussion I will pose in question form. To wit:

1. If cyberterrorism is a real threat, shouldn’t all governments ramp up their capabilities in this area? Therefore is the existence of a cybersquad, even a PLA-sponsored brigade of Red Bull-swilling, Cheeto-encrusted hackers, completely justified?1

2. Where do you draw the line between permissible “live fire drills” and impermissible attacks on foreign sites? I understand that causing blackouts and pushing sites over the edge with denial of service blitzes are no-nos, but what about less invasive test runs against potential foreign adversaries? (Techies might have a better feel for this than I do.)

3. Do we need, or should we have, an international agreement on this issue? I say absolutely, at least at some point, but then again, I never met an international law I didn’t like. I’m still waiting for the New World Order and the One World Government.


  1. Well, there are no Cheetos in China. Perhaps some sort of nuts, dried fruit, or White Rabbit candy would be a more apt illustration. []


24 Comments

Stay in touch with the conversation, subscribe to the RSS feed for comments on this post.

  • Some HTML can be used to format your comment.
  • Add a picture to your comments with Gravatar.
  • Please be civil. Comments may be moderated.
  1. AndyR

    There ARE cheetos in China, not the classic kind but a variation to meet local tastes. I assure you. Keep a look out, Chester Cheetah has indeed arrived.

  2. jdmartinsen

    Don’t want to derail your hacking thread right off the bat, but there most certainly are Cheetos in China, although the ones I’ve encountered have been meat flavored. The Baidu Baike entry (http://baike.baidu.com/view/532128.htm ) is fairly nostalgic, so perhaps they’ve gone out of fashion lately.

    • The dignity of the Cheeto demands that I confirm what AndyR and Joel here have said. Cheetos are available in China, at least here in Shanghai, in weird whacky Chinese flavors as well as the traditional Cheesy and (though yellow packaging instead of the orange packaging I remember — which may mean its a slightly different cheesy) Flamin’ Hot. The other one I remember off the top of my head is some kind of meat flavor, forgot exactly what but a big cooked chicken was the symbol.

      • Apparently the product selection at my local supermarket is sorely lacking. Then again, my idea of fun is dropping 10 kuai on sweet potato snacks at the 果多美 dried fruit and nut stand. Gotta get me a life one of these days.

  3. King Tubby

    Stan. Working for The Man. You really are a sixties dude. Reminds me of the first pre-digital phone hacker Captain Crunch with his cereal box whistle.

  4. B-real

    1 Yes all heavy hitting Nations should ramp up. Its not safe to have access to all this information that shouldn’t be out there. Imagine if it got into the wrong hands?

    2. I totally get what you are trying to say. Covert hacking is what I like to call it. You are hacking but no one knows you doing it until its too late.

    3. The lack of agreement is what makes it interesting for both sides. Cyber table tennis or cyber boxing or cyber Ninja. The US is always on the defense because of the information and the demand to acquire such information would be considered Platinum for those who can get it.

    I don’t really know the law in china as far as hacking goes. Im sure its illegal but who’s really enforcing? Since hacking is highly illegal and Highly enforced in the states it very hard for the average citizen to get away with hacking anything within the borders. Like China the US is starting to give incentives for free lance hackers just check out the Home Land Security web site. They are stationing Network Analyst all over the world for lucrative amounts of money.

    Let the games begin.

  5. 博客Smackers, i love it!

    We are all victims,

    I wear that same damn uniform!

    So for some real time real red propaganda,

    I put up,

    A classic picture “Dont hate affiliate” up on the Chinese Communist of China Facefuck site,

    I wonder how long it will take to get removed,
    am counting the days…

    still makes you wonder how the CCP got past their own damn Firewall!!??

    but a 五毛党 cant!

  6. I wonder, whatever happen to enterprising initiative? OMG, who outlawed spying? If Apple leaves extremely valuable prototypes lying about a bar; well, are we to blame the guy who picked it up? Seems to me we have all become careless is our over-reliance on immature technologies. The presumption that we are safe in a dangerous world is just that, a presumption!

  7. lolz

    Government sponsored hacking is just another method of spying. Everyone does it, know that other governments do it, but all want to pretend to be victims.

    I would be extremely disappointed if regional powers such as US, Israel, France, etc. do not employ large group of hackers whose goals are to hack foreign governments computers looking for secrets. Isn’t it the government’s duty to learn the secrets of other nations so that they can protect its citizens better?

  8. Let’s not kid ourselves – P.R. China has yet to face a serious attack on the level of the Estonia or Georgia incidents. It will be then, and only then, when the world gets to see if the “GFW” and/or the “cyberPLA” are up to the task of defending P.R. China’s computer assets or not.

    Why mention the Estonia incident? An interesting paper written about how it was conducted:

    http://www.theregister.co.uk/2010/04/28/web_war_one_anonymity/

    Could P.R. Chinese mobilize without too much centralized control from Beijing to counter such a threat?

    • King Tubby

      Three observations Matthew.

      The online escalation factors mentioned can also be observed even on this site.

      The Russians were totally justified re Estonia, and in the case of Georgia were also provoked over passport issue, relating to a small area within Georgia’s border traditionally allied with Russia.

      Not that Vladimar “Chuck Norristi” Putain is a good guy: on the contrary, he is an authoritarian thug.
      The Chechens will blow up his cojones sooner or later: they have very long memories.

      I also wonder about the coordionational levels of all wings of the PLA in a real conflict situation.

      • All it will take is a loud mouth CCP official getting caught on an open mike with Russian television or radio – either boasting about P.R. China’s eventual take over of Vladivostok or laughing how they are getting the Russian Mafia to clear the Siberian Forests – then the fur will fly with abandon. There is no love in Sino-Russian relations, from what I can see.

    • Jones

      So far, the CyberPLA just cheats and uses mods in CS and tank rushes constantly in Red Alert. They’re a bunch of dicks.

      • LOL, although CS and Red Alert are not exactly my cup of tea. I’m holding out someday for a 3D Max Payne with a Natal-type control system. Mmmmm . . .

      • lolz

        Tank rush is a valid strategy in Red Alert series like zerg rushes in SC and SC2. The aimbot and maphacks in CS however are cheats. Get your RTS facts right.

        • Jones

          It’s a valid strategy for noobs with no ability to multi-task.

          • lolz

            If a “noob” with a good rushing strategy can kick your ass then you are the true noob because you didn’t scout well. If you see your opponent tech like crazy and don’t rush then you are the noob.

            When you rush you sacrifice income and will be behind in tech. Rushing is therefore simply a choice out of many, and the whole point of these games is to make the right choice.

  9. Stan, I just want to ask, do you really see American Free Press as representative of the foreign media critcizing China for its alleged cyberattacks? They’re the first link you quote from, but I don’t think they are at all representative of your typical US media. From their own “About” section:

    In the United States today, it is a select handful of super-rich families and tightly-knit financial interests—a plutocratic elite—who own the Big Media and who control the government through their ownership of that media. . . .

    Every single one of the major media outlets is controlled by this powerful interlocking combine.

    ABC, CBS, NBC, CNN, Time, Newsweek, U.S. News & World Report, The New York Times, The Washington Post, The Los Angeles Times, The Chicago Tribune—even such “regional” giants as The New Orleans Times-Picayune, The Miami Herald, The San Diego Herald-Tribune. . . . The list goes on and on.

    And these media powerhouses control dozens—actually thousands—of other daily and weekly newspapers, magazines, and radio and television outlets across America (and around the globe).

    PLUS: Did you know that every single supermarket tabloid is owned by just one, super-rich Wall Street banker?

    To consolidate their influence, the Masters of the Media and their international corporate allies reward obedient journalists with membership in the Council on Foreign Relations or the Trilateral Com mission where they rub shoulders with others in the international policy-making networks. A handful get promoted to the higher ranks of the secret Bilderberg Group.

    The so-called “mainstream” media is very much a “closed shop” and only those willing to do the bidding of the global power elite need apply. Tom Brokaw, Dan Rather and Peter Jennings and other puppets are just the public faces that the American people see.

    Behind the scenes are the shadowy owners and corporate power brokers who dictate what you will (or will not) see in your daily newspaper or on the evening news.

    The average American has no idea that super-rich predators with names like Rockefeller, Rothschild, Bronfman, Newhouse, Murdoch and Redstone are making vast profits and achieving immense power through their stranglehold on the American media (and, increasingly, on media around the globe.)

    � These shadowy media controllers decide which politicians are “in” and which politicians are “out.” (They made Bill Clinton overnight. They also broke Richard Nixon overnight.)

    � The Masters of the Media decide which issues can—or cannot—be debated. (Imagine a public de bate over the Federal Reserve system on Ted Coppell’s Nightline. It will never happen!)

    � The Masters of the Media promote the perverse, anti-Christian Cultural Communist ideology that permeates publishing and broadcasting today.

    � The Masters of the Media decide which are the “good wars” and which are the “bad wars.”

    � The Masters of the Media decide who is the “hero” and who is the “villain.”

    If the Big Media decides you will be the patsy, then the patsy you will be.

    It’s that simple. Ask Lee Harvey Oswald or James Earl Ray or Gordon Kahl or Randy Weaver or the victims of Waco.

    As we said: THE MEDIA IS THE ENEMY.

    I would expect everything a site like this says about China to be off the wall. And indeed it is. But I would be reluctant to point to this site as exemplifying the media “rhetoric” in regard to China. Reading your post, the reader is led to believe that this is the script they’ll find in the US media. Well, they will find it, but only in loony pseudo-journals like World Net Daily, Newsmax and American Free Press.

    • No, I would definitely not call them mainstream. For that first quote, I was looking for something from the Red Scare crowd, criticism that was “breathless and Cold War-ish.” While the Times and the Post run lots of stories on the subject, the language is not as colorful. I wasn’t (at least not purposely) trying to mislead and suggest that everyone in the press took that position, just “some critics.”

      • But Stan, I wouldn’t even put this in the “some critics” category. Maybe in the “some pathological fringe critics suffering from acute paranoid delusion” category. Even when you say ‘some critics” it sounds like this is mainstream. Sorry if that seems like nitpicking, but think about it. “The Mas­ters of the Media pro­mote the per­verse, anti-Christian Cul­tural Com­mu­nist ide­ol­ogy that per­me­ates pub­lish­ing and broad­cast­ing today.” No, I would not cite them as an example of anything but insanity.

      • Jones

        I think the “Red Scare” crowd here is very much smaller and less-existent than the “Red-Scare Scare” crowd.