2010-2020: OPM and the Turning Point in the Chinese Cold War

[Wombaticus Rex]

Been going back over The Decade That Was to re-examine my priors and put models on paper, an exercise inspired by the strange but enjoyable book Geopolitical Alpha, a mixed bag of braggadocio and actionable advice.

I've run a few search strings here but there doesn't seem to be much on the OPM hack -- Office of Personnel and Management, basically the big dumb HR department for FedGov -- and it's perhaps the most important "cyberattack" that exists as a known known today. So I wanted to archive three primary sources, all by the excellent Zach Dorfman, who works the most improbable beat in the beltway, "counterintelligence scoops." So obviously every caveat you can imagine holds true on the narratives to follow; assume most of this is a carefully engineered cover story. Enjoy.

1st: https://archive.is/fpcvw#selection-883.0-893.317

China Used Stolen Data to Expose CIA Operatives in Africa and Europe
The discovery of U.S. spy networks in China fueled a decadelong global war over data between Beijing and Washington.

Around 2013, U.S. intelligence began noticing an alarming pattern: Undercover CIA personnel, flying into countries in Africa and Europe for sensitive work, were being rapidly and successfully identified by Chinese intelligence, according to three former U.S. officials. The surveillance by Chinese operatives began in some cases as soon as the CIA officers had cleared passport control. Sometimes, the surveillance was so overt that U.S. intelligence officials speculated that the Chinese wanted the U.S. side to know they had identified the CIA operatives, disrupting their missions; other times, however, it was much more subtle and only detected through U.S. spy agencies’ own sophisticated technical countersurveillance capabilities.

The CIA had been taking advantage of China’s own growing presence overseas to meet or recruit sources, according to one of these former officials. “We can’t get to them in Beijing, but can in Djibouti. Heat map Belt and Road”—China’s trillion-dollar infrastructure and influence initiative—“and you’d see our activity happening. It’s where the targets are.” The CIA recruits “Russians and Chinese hard in Africa,” said a former agency official. “And they know that.” China’s new aggressive moves to track U.S. operatives were likely a response to these U.S. efforts.

At the CIA, these anomalies “alarmed chiefs of station and division leadership,” said the first former intelligence official. The Chinese “never should have known” who or where these undercover CIA personnel were. U.S. officials, lacking a smoking gun, puzzled over how China had managed to expose their spies. In a previous age, they might have begun a mole hunt, looking for a single traitor in a position to share this critical information with the other side, or perhaps scoured their records for a breach in a secret communications platform.

But instead, CIA officials believed the answer was likely data-driven—and related to a Chinese cyberespionage campaign devoted to stealing vast troves of sensitive personal private information, like travel and health data, as well as U.S. government personnel records. U.S. officials believed Chinese intelligence operatives had likely combed through and synthesized information from these massive, stolen caches to identify the undercover U.S. intelligence officials. It was very likely a “suave and professional utilization” of these datasets, said the same former intelligence official. This “was not random or generic,” this source said. “It’s a big-data problem.”

The battle over data—who controls it, who secures it, who can steal it, and how it can be used for economic and security objectives—is defining the global conflict between Washington and Beijing. Data has already critically shaped the course of Chinese politics, and it is altering the course of U.S. foreign policy and intelligence gathering around the globe. Just as China has sought to wield data as a sword and shield against the United States, America’s spy agencies have tried to penetrate Chinese data streams and to use their own big-data capabilities to try to pinpoint exactly what China knows about U.S. personnel and operations.

This series, based on extensive interviews with over three dozen current and former U.S. intelligence and national security officials, tells the story of that battle between the United States and China—a conflict in which many believe China possesses critical advantages, because of Beijing’s panopticon-like digital penetration of its own citizens and Chinese companies’ networks; its world-spanning cyberspying, which has included the successful theft of multiple huge U.S. datasets; and China’s ability to rapidly synthesize—and potentially weaponize—all this vast information from diverse sources.

China is “one of the leading collectors of bulk personal data around the globe, using both illegal and legal means,” William Evanina, the United States’ top counterintelligence official, told Foreign Policy. “Just through its cyberattacks alone, the PRC has vacuumed up the personal data of much of the American population, including data on our health, finances, travel and other sensitive information.”

This war over data has taken on particularly critical importance for the United States’—and China’s—spy agencies. In the intelligence world, “information is king, and the more information, the better,” said Steve Ryan, who served until 2016 as deputy director of the National Security Agency’s Threat Operations Center and is now the CEO of the cybersecurity service Trinity Cyber. In the U.S.-Soviet Cold War, intelligence largely came in piecemeal and partial form: an electronic intercept here, a report from a secret human source there. Today, the data-driven nature of everyday life creates vast clusters of information that can be snatched in a single move—and then potentially used by Beijing to fuel everything from targeting individual American intelligence officers to bolstering Chinese state-backed businesses.

Fundamentally, current and former U.S. officials say, China believes data provides security: It ensures regime stability in the face of internal and external threats to the Chinese Communist Party (CCP). It was a combination of those threats that created the impetus for China’s most aggressive counterintelligence campaign against the United States yet.

The CIA declined to comment for this story. The Chinese Embassy in Washington, D.C., did not respond to multiple requests for comment.

In 2010, a new decade was dawning, and Chinese officials were furious. The CIA, they had discovered, had systematically penetrated their government over the course of years, with U.S. assets embedded in the military, the CCP, the intelligence apparatus, and elsewhere. The anger radiated upward to “the highest levels of the Chinese government,” recalled a former senior counterintelligence executive.

Exploiting a flaw in the online system CIA operatives used to secretly communicate with their agents—a flaw first identified in Iran, which Tehran likely shared with Beijing—from 2010 to roughly 2012, Chinese intelligence officials ruthlessly uprooted the CIA’s human source network in China, imprisoning and killing dozens of people.

Within the CIA, China’s seething, retaliatory response wasn’t entirely surprising, said a former senior agency official. “We often had [a] conversation internally, on how U.S. policymakers would react to the degree of penetration CIA had of China”—that is, how angry U.S. officials would have been if they discovered, as the Chinese did, that a global adversary had so thoroughly infiltrated their ranks.

The anger in Beijing wasn’t just because of the penetration by the CIA but because of what it exposed about the degree of corruption in China. When the CIA recruits an asset, the further this asset rises within a county’s power structure, the better. During the Cold War it had been hard to guarantee the rise of the CIA’s Soviet agents; the very factors that made them vulnerable to recruitment—greed, ideology, blackmailable habits, and ego—often impeded their career prospects. And there was only so much that money could buy in the Soviet Union, especially with no sign of where it had come from.

But in the newly rich China of the 2000s, dirty money was flowing freely. The average income remained under 2,000 yuan a month (approximately $240 at contemporary exchange rates), but officials’ informal earnings vastly exceeded their formal salaries. An official who wasn’t participating in corruption was deemed a fool or a risk by his colleagues. Cash could buy anything, including careers, and the CIA had plenty of it.

At the time, CIA assets were often handsomely compensated. “In the 2000s, if you were a chief of station”—that is, the top spy in a foreign diplomatic facility—“for certain hard target services, you could make a million a year for working for us,” said a former agency official. (“Hard target services” generally refers to Chinese, Russia, Iranian, and North Korean intelligence agencies.)

Over the course of their investigation into the CIA’s China-based agent network, Chinese officials learned that the agency was secretly paying the “promotion fees” —in other words, the bribes—regularly required to rise up within the Chinese bureaucracy, according to four current and former officials. It was how the CIA got “disaffected people up in the ranks. But this was not done once, and wasn’t done just in the [Chinese military],” recalled a current Capitol Hill staffer. “Paying their bribes was an example of long-term thinking that was extraordinary for us,” said a former senior counterintelligence official. “Recruiting foreign military officers is nearly impossible. It was a way to exploit the corruption to our advantage.” At the time, “promotion fees” sometimes ran into the millions of dollars, according to a former senior CIA official: “It was quite amazing the level of corruption that was going on.” The compensation sometimes included paying tuition and board for children studying at expensive foreign universities, according to another CIA officer.

Chinese officials took notice. “They were forced to see their problems, and our mistakes helped them see what their problems were,” recalled a former CIA executive. “We helped bring to fruition what they theoretically were scared of,” said the Capitol Hill staffer. “We scared the shit out of them.” Corruption was increasingly seen as the chief threat to the regime at home; as then-Party Secretary Hu Jintao told the Party Congress in 2012, “If we fail to handle this issue well, it could … even cause the collapse of the party and the fall of the state,” he said. Even in China’s heavily controlled media environment, corruption scandals were breaking daily, tainting the image of the CCP among the Chinese people. Party corruption was becoming a public problem, acknowledged by the CCP leadership itself.

But privately, U.S. officials believe, Chinese leaders also feared the degree to which corruption had allowed the CIA to penetrate its inner circles. The CIA’s incredible recruiting successes “showed the institutional rot of the party,” said the former senior CIA official. “They ought to [have been] upset.” The leadership realized that unchecked corruption wasn’t just an existential threat for the party at home; it was also a major counterintelligence threat, providing a window for enemy intelligence services like the CIA to crawl through.

This was a global problem for the CCP. Corrupt officials, even if they hadn’t been recruited by the CIA while in office, also often sought refuge overseas—where they could then be tapped for information by enterprising spy services. In late 2012, party head Xi Jinping announced a new anti-corruption campaign that would lead to the prosecution of hundreds of thousands of Chinese officials. Thousands were subject to extreme coercive pressure, bordering on kidnapping, to return from living abroad. “The anti-corruption drive was about consolidating power—but also about how Americans could take advantage of [the corruption]. And that had to do with the bribe and promotion process,” said the former senior counterintelligence official.

The 2013 leaks from Edward Snowden, which revealed the NSA’s deep penetration of the telecommunications company Huawei’s China-based servers, also jarred Chinese officials, according to a former senior intelligence analyst. “Chinese officials were just beginning to learn how the internet and technology has been so thoroughly used against them, in ways they didn’t conceptualize until then,” the former analyst said. “At the intelligence level, it was driven by this fundamental [revelation] that, ‘This is what we’ve been missing: This internet system we didn’t create is being weaponized against us.’”


There were other ripple effects. By the late 2000s, U.S. intelligence officials had observed a notable professionalizing of the Ministry of State Security, China’s main civilian intelligence agency. Before Xi’s purges, petty corruption within the agency was ubiquitous, former U.S. intelligence officials say, with China’s spies sometimes funneling money from operations into their own “nest eggs”; Chinese government-affiliated hackers operating under the protection of the Ministry of State Security would also sometimes moonlight as cybercriminals, passing a cut of their work to their bosses at the intelligence agency.

Under Xi’s crackdown, these activities became increasingly untenable. But the discovery of the CIA networks in China helped supercharge this process, said current and former officials—and caused China to place a greater focus on external counterespionage work. “As they learned these things,” the Chinese realized they “needed to start defending themselves,” said the former CIA executive.

By about 2010, two former CIA officials recalled, the Chinese security services had instituted a sophisticated travel intelligence program, developing databases that tracked flights and passenger lists for espionage purposes. “We looked at it very carefully,” said the former senior CIA official. China’s spies “were actively using that for counterintelligence and offensive intelligence. The capability was there and was being utilized.” China had also stepped up its hacking efforts targeting biometric and passenger data from transit hubs, former intelligence officials say—including a successful hack by Chinese intelligence of biometric data from Bangkok’s international airport.

To be sure, China had stolen plenty of data before discovering how deeply infiltrated it was by U.S. intelligence agencies. However, the shake-up between 2010 and 2012 gave Beijing an impetus not only to go after bigger, riskier targets, but also to put together the infrastructure needed to process the purloined information. It was around this time, said a former senior NSA official, that Chinese intelligence agencies transitioned from merely being able to steal large datasets en masse to actually rapidly sifting through information from within them for use. U.S. officials also began to observe that intelligence facilities within China were being physically co-located near language and data processing centers, said this person.

For U.S. intelligence personnel, these new capabilities made China’s successful hack of the U.S. Office of Personnel Management (OPM) that much more chilling. During the OPM breach, Chinese hackers stole detailed, often highly sensitive personnel data from 21.5 million current and former U.S. officials, their spouses, and job applicants, including health, residency, employment, fingerprint, and financial data. In some cases, details from background investigations tied to the granting of security clearances—investigations that can delve deeply into individuals’ mental health records, their sexual histories and proclivities, and whether a person’s relatives abroad may be subject to government blackmail—were stolen as well. Though the United States did not disclose the breach until 2015, U.S. intelligence officials became aware of the initial OPM hack in 2012, said the former counterintelligence executive. (It’s not clear precisely when the compromise actually happened.)

When paired with travel details and other purloined data, information from the OPM breach likely provided Chinese intelligence potent clues about unusual behavior patterns, biographical information, or career milestones that marked individuals as likely U.S. spies, officials say. Now, these officials feared, China could search for when suspected U.S. spies were in certain locations—and potentially also meeting secretly with their Chinese sources. China “collects bulk personal data to help it track dissidents or other perceived enemies of China around the world,” Evanina, the top U.S. counterintelligence official, said.

Many felt the ground give way immediately. For some at the CIA, recalled Gail Helt, a former CIA China analyst, the reaction to the OPM breach was, “Oh my God, what is this going to mean for everybody who had ever traveled to China? But also what is it going to mean for people who we had formally recruited, people who might be suspected of talking to us, people who had family members there? And what will this mean for agency efforts to recruit people in the future? It was terrifying. Absolutely terrifying.” Many feared the aftershocks would be widespread. “The concern just wasn’t that [the OPM hack] would curtail info inside China,” said a former senior national security official. “The U.S. and China bump up against each other around the world. It opened up a global Pandora’s box of problems.”

Others were more resigned, if no less disturbed. “You operate under the assumption that good tradecraft”—and not the secrecy provided, in theory, by cover—“will protect your assets and operations,” said Duyane Norman, a former senior CIA official. “So OPM wasn’t some kind of eye-opener. It was confirmation of new threats we already knew existed.”

There were other bad omens. During this same period, U.S. officials concluded that Russian intelligence officials, likely exploiting a difference in payroll payments between real State Department employees and undercover CIA officers, had identified some of the CIA personnel working at the U.S. Embassy in Moscow. Officials thought that this insight may have come from data derived from the OPM hack, provided by the Chinese to their Russian counterparts. U.S. officials also wondered whether the OPM hack could be related to an uptick in attempted recruitments by Chinese intelligence of Chinese American translators working for U.S. intelligence agencies when they visited family in China. “We also thought they were trying to get Mandarin speakers to apply for jobs as translators” within the U.S. intelligence community, recalled the former senior counterintelligence official. U.S. officials believed that Chinese intelligence was giving their agents “instructions on how to pass a polygraph.”

But after the OPM breach, anomalies began to multiply. In 2012, senior U.S. spy hunters began to puzzle over some “head-scratchers”: In a few cases, spouses of U.S. officials whose sensitive work should have been difficult to discern were being approached by Chinese and Russian intelligence operatives abroad, according to the former counterintelligence executive. In one case, Chinese operatives tried to harass and entrap a U.S. official’s wife while she accompanied her children on a school field trip to China. “The MO is that, usually at the end of the trip, the lightbulb goes on [and the foreign intelligence service identifies potential persons of interest]. But these were from day one, from the airport onward,” the former official said.

Worries about what the Chinese now knew precipitated an intelligence community-wide damage assessment surrounding the OPM and other hacks, recalled Douglas Wise, a former senior CIA official who served deputy director of the Defense Intelligence Agency from 2014 to 2016. Some worried that China might have purposefully secretly altered data in individuals’ OPM files to later use as leverage in recruitment attempts. Officials also believed that the Chinese might sift through the OPM data to try and craft the most ideal profiles for Chinese intelligence assets seeking to infiltrate the U.S. government—since they now had granular knowledge of what the U.S. government looked for, and what it didn’t, while considering applicants for sensitive positions. U.S. intelligence agencies altered their screening procedures to anticipate new, more finely tuned Chinese attempts at human spying, Wise said.

The Chinese now had unprecedented insight into the workings of the U.S. system. The United States, meanwhile, was flying with one eye closed when dealing with China. With the CIA’s carefully built network of Chinese agents utterly destroyed, the debate over how to handle China would become increasingly contentious—even as China’s ambitions grew.

[Wombaticus Rex]

2nd: https://archive.is/8OpE9

Beijing Ransacked Data as U.S. Sources Went Dark in China
As Xi consolidated power, U.S. officials struggled to read China’s new ruler.

In early 2013, as Communist Party General Secretary Xi Jinping prepared to assume the Chinese presidency, very few people in the West had any idea what kind of leader he was. In January of that year, the New York Times’ Nick Kristof, an experienced China correspondent, wrote that Xi “will spearhead a resurgence of economic reform, and probably some political easing as well.”

It was a radically mistaken assessment. But even inside the U.S. government, knowledge of China—and its intentions—was at a low point. During the 2000s, U.S. intelligence had operated with relative confidence against Beijing. But during China’s biggest political transition in decades, American officials were looking through an increasingly opaque glass.

The twin disasters of the Office of Personnel Management (OPM) hack, which had helped the Chinese to identify undercover U.S. intelligence officials, and the obliteration of the CIA’s network of Chinese assets significantly “affected the quality of insight” into what the United States understood about events in that country, according to a former U.S. national security official. There was a noticeable decrease in high-quality intelligence reporting percolating up to senior policymakers, this source recalled. “Things weren’t the same.”

And as U.S. officials struggled to try and grasp what was happening on the other side of the Pacific, China was doubling down on a hacking spree that would see unprecedented amounts of data stolen and fed into an increasingly sophisticated intelligence apparatus.

At the time, White House officials trying to craft new China policies debated Xi’s character and intentions, a senior Obama-era official said. Administration officials were split in their views on Xi. There was a “set of analysis” that led some to argue that Xi was a possible reformer: a product of the Chinese Communist Party (CCP), yes, but a leader capable of ameliorating some of the excesses of the Chinese system, this former official recalled. Others, however, argued that Xi was a “neo-Maoist”: that is, a dangerous hard-liner. The difference in views was “very stark,” this person recalled.

Other officials who served under U.S. President Barack Obama recall more consensus regarding the new Chinese president. “There was never any romanticism about Xi,” said the former national security official. But ultimately, this source said, “no one was able to foresee the kind of leader he was to become.” And, as the Xi-led purges soon revealed, “the Communist Party leadership didn’t see it either,” this official recalled.
Inside the CIA, senior officials were also divided about Xi’s rise, if perhaps more skeptical than at the White House, a former senior CIA official recalled. “There was some wishful thinking that Xi would come in and promote some kind of continued reform,” this source said. “But the vast majority [within the agency] thought the party was moving toward the strongman model, [the idea] that China should stand up and become more aggressive in its viewpoint. Within elite party corners that was a big debate at the time.” But “what CIA was hearing from sources pointed to a re-centralization for the party to maintain power,” this person recalled.

“There was concern in Washington about what Xi was going to pursue, both in terms of domestic liberties, but also his approach to America,” said Gail Helt, a former CIA China analyst. “The Chinese Communist Party is corrupt, to put it mildly, but there were initial indicators that he was going to clean up that corruption, there was a little glimmer of hope. Then it was clear that he was going to purge and create a personality cult.”

Some of the gaps in intelligence were because U.S. officials had grown more cautious. There was “reluctance or concern or anxiety about putting our officers in the field given that our protective shield had been punctured [by the OPM breach],” recalled the former national security official. “We didn’t fully know what they knew about us.” Subsequently, “dozens of postings” for CIA officers scheduled for assignments in China were canceled, according to The Perfect Weapon, a 2018 book by David Sanger. “CIA, for many years, was not willing to do forward facing ops in China,” because its confidence was so shaken by the asset roll-up and other breaches, said a former senior intelligence analyst.

China was also hardening its digital defenses against U.S. spying during 2012-2014, the former analyst said. It was “a gradual change over a year or two, as Chinese leaders started incorporating insights into increasing their control over their own internet space.” Intelligence collection by U.S. cyberspies suffered as a result. China’s tightening domestic-focused digital surveillance dragnet—like its increasing use of biometrics and closed-circuit TV—also made U.S. intelligence gathering there more difficult, former officials say.

Prior leaks had accentuated the difficulty of even routine communications by U.S. officials with their Chinese counterparts. The release of a massive tranche of U.S. diplomatic cables by WikiLeaks in 2010 and 2011 left some Chinese officials, whose relatively frank discussions with their American counterparts were documented in the cables, dangerously exposed at home. (Two Chinese government or state media sources named in the cables, for instance, had their careers stymied after the leak.) In the past, this type of relatively open diplomatic intercourse had played an important role in helping U.S. officials form a picture of China. “Chinese officials became much more reluctant to talk after [the WikiLeaks cables], because they didn’t believe we could keep it a secret,” recalled a current State Department official with extensive experience in China.

And while the United States maintained significant eavesdropping and cyberspying capabilities against China, Chinese officials were becoming much more reluctant to talk on many channels. This wasn’t just out of the knowledge, revealed by the Edward Snowden leaks and other disclosures, that the United States might be intercepting communications; it was also out of fears that they were under surveillance by China’s own security services, according to a former Defense Intelligence Agency official. In the aftermath of the Bo Xilai affair in 2012—the first of Xi’s purges of the party, which felled both top-level government officials and army officers—Chinese officials became even more devoted to face-to-face meetings for any sensitive matter. “Disclosure of state secrets,” intentional or otherwise, was one of the most common charges brought against Xi’s targets.

As Xi began a comprehensive purge of the party and restructuring of the state, the answers about his character and intentions became clearer—at least to some members of the Obama administration. “The debates over what kind of leader Xi was going to be, that got settled pretty early for some of us,” the Obama-era official recalled. “Some did not see that as quickly.”

For this official, the meeting between Xi and Obama in 2013 in Southern California was an immediate revelation. It “wasn’t even an open question anymore” that Xi would rule with increasing authoritarianism, this person said. Over the next few years, Xi’s hard-line policies would extend into almost every area of Chinese life, from the estimated 1 million Uighurs subjected to detention, surveillance, and torture in Xinjiang; to a mass clampdown on freedom of speech; to supposed anti-corruption purges that swept up hundreds of thousands of Chinese officials. But the U.S. administration often remained reluctant to act, said the Obama-era official.

Meanwhile, the hacks continued. Beijing’s spies were ransacking Americans’ data at an almost Olympian scale. In addition to masterminding the OPM breach, hackers linked to Chinese intelligence would filch private information from over 383 million individuals, including passport and credit card data, in a massive 2014 compromise of the hotel giant Marriott; pilfer personal information from over 78 million Americans in a 2014 breach of Anthem, the major health insurance provider; breach the networks of American Airlines, United Airlines, and Sabre, a top travel reservation provider (and key target for China’s travel intelligence program); and burrow into computer systems belonging to the U.S. Department of the Navy, stealing sensitive data linked to over 100,000 naval personnel, among other penetrations of the U.S. private and public sectors. The Chinese “were always a Hoover, sucking up mountains of data beyond anything else in the world,” recalled a former senior National Security Agency official.

U.S. intelligence and national security officials, in particular, were becoming increasingly incensed by China’s actions. The Obama administration began to take more aggressive steps against Chinese cyberspying, indicting five Chinese military hackers in 2014 for a massive espionage campaign targeting U.S. companies—the first-ever public U.S. indictment of nation-state hackers—and threatening Beijing with sanctions. But senior U.S. officials under Obama still believed there were key, if narrowing, areas to carve out mutual cooperation with their Chinese counterparts.

One focus was on easing the visa process. In 2014, on a visit to Beijing, Obama announced that the United States and China had reached a reciprocal agreement to extend visas from their current one-year span to 10 years for business and tourist visas, and five years for student visas—a major potential boost for tourism and educational exchanges.

Some U.S. intelligence officials were aghast. On the Chinese side, the visa extension gambit was “an MSS-led endeavor,” said a current senior U.S. intelligence official, referring to the Ministry of State Security, China’s main civilian intelligence organization. “It was an intelligence-based process, where they wanted to get to a place where they could have a 10-year visa to the U.S., instant access in and out of the country without the U.S. government knowing.” There were “hundreds of meetings at the White House” on this issue, the official recalled. “Obama was hellbent on getting some negotiated pact. And the administration, as much as we argued with it, didn’t see the big deal. They saw it as a promulgation for trade and academia—all things that are true, but the entire [intelligence community] and FBI said, ‘Whoa whoa whoa, they’re going to increase their already excessive nontraditional collection activities.’”

A second area of attempted cooperation was in cyberspace. In September 2015, in another flourish of public diplomacy—this time coinciding with Xi’s first state visit to Washington—Obama and Xi announced a major new bilateral accord forbidding the hacking-enabled theft of trade secrets by either country. The agreement set up a formal bilateral mechanism for dialogue, led by senior officials from both countries, wherein one side could lodge complaints against the other for purported violations.

Even these discussions, however, were riven by conflicting or contradictory perspectives among senior U.S. officials regarding China’s actions—and the United States’ own interests. Internally, Obama officials had debated the proper scope of the negotiations and the administration’s red lines—“what we would insist on in terms of taking our foot off their neck,” recalled the former national security official.

Some within the administration had dreamed of a bigger deal. For instance, four former officials say, during the run-up to the 2015 agreement, senior Obama-era officials floated the idea of expanding the potential accord to include cyberespionage directed at personal information, like the data found in the Marriott and Anthem breaches.

U.S. intelligence agencies balked. They “were adamant that discussing theft of personally identifiable information was not on the table,” recalled the former national security official. “We had spent the last months being really pissed at the Chinese for stealing our shit. I realized we weren’t as exercised within the intelligence community as I thought.” The response by the intelligence community was “emphatic and unambiguous”: Other types of hacking must be excluded from the deal. Some of the pushback was because intelligence officials simply did not believe China would abide by the accord. “We thought it was policymaker masturbation,” said former Defense Intelligence Agency Deputy Director Douglas Wise, “because there’s not a penalty for noncompliance. We took a very cynical view.” (By 2018, U.S. officials would publicly state that China was in widespread violation of the deal.)

But much of the resistance from within the intelligence bureaucracy was because U.S. cyberspies also engage in widespread hacking of personal data abroad. “At one level it’s how the game is played,” said Michael Daniel, the Obama administration’s cybersecurity czar. “It’s called espionage.” Indeed, said the former senior intelligence analyst, “the reason we didn’t come out swinging on OPM was we didn’t want to set this precedent that you can’t use cyberoperations”—that is, hacking—“to get personally identifiable information out of a country’s citizens.” Intelligence officials would not assent to an agreement they wouldn’t keep themselves.

Fundamentally, at the time, U.S. officials wanted a lot more insight into the inner workings of the Chinese government.

What they already knew was disturbing enough. By the mid-2010s, U.S. intelligence agencies had secretly burrowed into online networks controlled by the Ministry of State Security—networks where data from hacked U.S. companies and U.S. government entities was being stored, according to three former officials. In some cases, U.S. intelligence operatives watched as “bits and pieces [of this data] were being used over time,” said a former intelligence official. But the information itself was fragmentary, and the United States’ access was uneven, former officials said, so it was unclear to U.S. officials from where, exactly, this information derived—until larger hacks like those of OPM and Marriott were discovered. (Occasionally, however, U.S. officials have been able to determine the genesis of data on networks controlled by Chinese hackers that were being secretly surveilled by U.S. spies—and have quietly alerted companies to the breaches, thereby preventing much larger hacks of sensitive personal information from occurring, according to the former senior intelligence analyst.)

U.S. cyberspies were already keenly focused on Chinese data storage and processing capabilities. Within U.S. spy agencies, there was “a lot of interest in [Chinese] data centers, the technology and the hardware going into facilities that are intelligence- or military-linked,” said the same former official. “If Alibaba is running a cloud, and they have data centers inside China, well, we’ve been targeting those for a long time,” recalled the former intelligence official.

But there were still gaps in the U.S. spy agencies’ knowledge. At the tail end of the Obama administration, officials tasked the intelligence agencies to “elevate the Chinese counterintelligence threat in relation to other national collection priorities,” recalled a former senior National Security Council official with knowledge of intelligence issues—that is, to devote more intensive resources, in “all sorts of collection,” to spying on China. The push was “driven in large part by their growing cyber-capabilities, and their growing aggressive counterintelligence activities,” this source said.

This wider effort, recalled by three former officials, was born of the consensus that—even amid Russia’s 2016 election interference campaign—China, not Russia, had emerged as the biggest long-term counterintelligence threat to the United States. By the end of the Obama administration, the former senior NSC official recalled, it was clear that in China’s “technical collection, in their very aggressive recruitment of U.S. operatives, [it had] outstripped Russia.”

Fundamentally, Beijing’s spy services simply operated on a much larger scale than Moscow’s—and Washington’s. “One of the things where China has the advantage over pretty much everyone in this space is: If you have a nearly inexhaustible supply of human capital, then maybe you can just grab as much [data] as you can grab,” said Steve Ryan, a former deputy director of the NSA’s Threat Operations Center. “So it’s a different model on their side.”

Russia’s successes in 2016 forced senior Obama-era national security officials to discuss the country’s wider vulnerabilities, former officials said. The concern was, according to the former senior NSC official, “Will the Chinese weaponize this data they’ve accumulated over the years?”
“If they do, it has far-reaching consequences, and could be far more damaging than what Russians have done. Because they have vastly larger quantities of data than Russia does,” the former official said.

Still, some China hawks remained frustrated over what they perceived of as a lack of focus on Beijing, and especially its industrial policies. “I was fighting people to get this done, more collection on China,” said Robert Spalding, who served as the top China strategist for the chairman of the Joint Chiefs of Staff during the late Obama administration. At Spalding’s request, in 2015 the Joint Chiefs organized meetings with a suite of top intelligence officials, as well as representatives from the Commerce, Treasury, and State departments around these issues. “The [intelligence community] refused to engage,” said Spalding, who subsequently served on the National Security Council during the Trump administration.

But other former national security officials, who emphasize the time lag between high-level strategic reprioritizing of different intelligence targets and on-the-ground results, say there was an intensified focus on China around this time—including on developing greater insight into the relationship between Chinese intelligence agencies and private Chinese companies. By 2016, senior U.S. national security officials had “tasked the [intelligence community] to develop answers, setting the wheels in motion” on “the sharing between private [Chinese] companies and the MSS,” one former national security official recalled. We “were looking at the forensic trail,” they said.

The Obama administration’s increased scrutiny of the Chinese telecommunications giant ZTE helped catalyze this process, this source said: “Part of the material that was obtained within that investigation provided a breadcrumb trail to Huawei’s practices in Iran and elsewhere. But the picture was still being colored in.”

After President Donald Trump took office in early 2017, this increasingly well-developed picture would spur U.S. intelligence officials, and senior Trump administration officials, to zero in on the symbiotic relationship between China’s security apparatus and its private sector leviathans.

[Wombaticus Rex]

3rd:

Tech Giants Are Giving China a Vital Edge in Espionage
U.S. officials say private Chinese firms have been enlisted to process stolen data for their country’s spy agencies.

In 2017, as U.S. President Donald Trump began his trade war with China, another battle raged behind the scenes. The simmering, decadelong conflict over data between Chinese and U.S. intelligence agencies was heating up, driven both by the ambitions of an increasingly confident Beijing and by the conviction of key players in the new administration in Washington that China was presenting an economic, political, and national security challenge on a scale the United States had not faced for decades—if ever.

Beijing was giving China hawks in the United States plenty of ammunition. That same year, hackers working for China’s People’s Liberation Army would mastermind a massive breach of Equifax, one of the United States’ largest credit reporting firms. The military-linked hackers absconded with a dizzying amount of personal data, including Social Security numbers, home addresses, birth dates, driver’s license numbers, and credit card information. Roughly 145 million Americans had their personal data exposed by the hack.

The Trump administration’s China policies were probably the most antagonistic of any U.S. presidency since the height of the Cold War in the 1960s. Still, even within the administration, key China advisors were divided. “In the first year [of the Trump era] at the National Security Council, we were arguing and debating the direction [of China policy],” recalled Robert Spalding, who served as the council’s senior director for strategic planning until early 2018. The environment shifted in 2018, Spalding said, after the advent of the administration’s National Security Strategy, its decision to escalate the trade war, and the departure of Susan Thornton, the State Department’s top Asia policy official, who Spalding says stymied attempts by the FBI and Department of Justice to take a more aggressive tack on China-related prosecutions. (Thornton declined to comment.)

But for some critics, the administration’s shifting rationales undermined its credibility on China and technology issues. A number of Trump administration officials emphasized the national security threats posed by Chinese tech giants, while others—most notably Trump himself—intimated that these companies’ access to U.S. goods and markets were bargaining chips in the ongoing trade war. ZTE, a major Chinese telecommunications firm, was almost driven out of business after the administration, citing national security, banned American suppliers from working with it—until Trump granted the company a reprieve, seemingly as part of trade-related negotiations with Chinese leader Xi Jinping. “President Xi of China, and I, are working together to give massive Chinese phone company, ZTE, a way to get back into business, fast. Too many jobs in China lost. Commerce Department has been instructed to get it done!” Trump tweeted in May 2018.

A full-court press by the administration on Huawei, the world’s largest telecom equipment firm, lost momentum after the president floated dropping an extradition request against a Huawei executive arrested in Canada for sanctions evasion in exchange for trade relief. Administration officials also shifted from hinting about the company’s current malicious activities on behalf of China’s spy services to emphasizing the threat it might pose in the future, once it had monopolized much of the world’s telecom infrastructure.

This was a fair worry. Chinese industry has always been, to some extent, subordinated or intertwined with the party-state, although the origins of these ties are often murky. The People’s Liberation Army was a dominant player in Chinese firms for decades, owning businesses from hospitals to condom factories; the Chinese Communist Party has itself repeatedly attempted to force military divestiture to fight corruption.
But the embrace between China’s intelligence services and Chinese businesses has gotten tighter, U.S. officials say. In 2017, under Xi’s intensifying authoritarianism, Beijing promulgated a new national intelligence law that compels Chinese businesses to work with Chinese intelligence and security agencies whenever they are requested to do so—a move that codified “what was pretty much what was going on for many years before, though corruption had tempered it” previously, a former senior CIA official said.

In the final years of the Obama administration, national security officials had directed U.S. spy agencies to step up their intelligence collection on the relationship between the Chinese state and China’s private industrial behemoths. By the advent of the Trump era, this effort had borne fruit, with the U.S. intelligence community piecing together voluminous evidence on coordination—including back-and-forth data transfers—between ostensibly private Chinese companies and that country’s intelligence services, according to current and former U.S. officials. There was evidence of close public-private cooperation occurring on “a daily basis,” according to a former Trump-era national security official. “Those commercial entities are the commercial wing of the party,” the source said. “They of course cooperate with intelligence services to achieve the party’s goals.”

Beijing’s access to, and ability to sift through, troves of pilfered and otherwise obtained data “gives [China] vast opportunities to target people in foreign governments, private industries, and other sectors around the world—in order to collect additional information they want, such as research, technology, trade secrets, or classified information,” said William Evanina, the United States’ top counterintelligence official. “Chinese technology companies play a key role in processing this bulk data and making it useful for China’s intelligence services,” he said.
In what amounts to intelligence tasking, China’s spy services order private Chinese companies with big-data analytics capabilities to “condition”—that is, work up or process—massive sets of information, including from hacks like the massive breach of the U.S. Office of Personnel Management (OPM), that have intelligence value, according to current and former officials. This data then promptly flows back to Chinese state entities, they say.

“Just imagine on any given day, if NSA and CIA are collecting information, say, on the [Chinese military], and we could bring back seven, eight, 10, 15 petabytes of data, give it to Google or Amazon or Microsoft, and say, ‘Hey, condition this on the weekend. We want all these analytics; get it back to us next week.’ That’s what they do. They have Alibaba and they have Baidu. We don’t have that,” a current senior intelligence official said.

By co-opting Chinese companies’ data-processing capabilities, U.S. officials say, Beijing’s spy agencies can rapidly sift through massive amounts of information to find key nuggets of intelligence value—for example, to help identify an undercover CIA operative by cross-checking real-time travel intelligence with other sources gathered by China’s Ministry of State Security (MSS). And by outsourcing these expensive data-processing functions to private companies, Chinese intelligence agencies can also exploit these commercial capabilities at a scale they don’t possess themselves or don’t want to build in-house, officials say. Alibaba and Baidu did not respond to multiple requests for comment.

The cooperation hasn’t always been frictionless. “The private companies are hostages to it,” a former counterintelligence executive said. “Arguments ensue.” Sometimes, U.S. intelligence officials would learn about “pissed-off employees” at Chinese companies upset about “doing extra work” on behalf of Chinese intelligence, the former executive said. But they were obligated to comply. “All the major Chinese firms have benefited from knowing, at various points, how to not be too big to fail the party,” the former senior CIA official said. The companies’ at-times begrudging cooperation with Beijing’s intelligence agencies is still, in the end, a subordination to them.

Many Chinese tech firms “probably want to be normal tech companies, and don’t want to deal with these ideological expectations, or the national security expectations,” said Elsa Kania, a China expert and adjunct senior fellow at the Center for a New American Security. “Most Chinese tech companies are not that dissimilar to their counterparts in Silicon Valley. The difference is they are trying to operate within a system where there are incentives and expectations to cultivate closer relations with the government, or the potential for retribution should they step out of line on some front.”

Chinese companies walk a tricky line when talking about such ties. Publicly, and especially in English, they deny any links to Beijing’s intelligence or military apparatus. Huawei, which has faced a flood of accusations about these links, implausibly claims to be owned by its employees. At home, though, the same companies repeatedly avow their loyalty to the party and willingness to assist the security services.

Some connections are more deep-seated. For instance, the former senior CIA official said that, based on “high-confidence reporting,” the CIA concluded that the Chinese tech giant Tencent, which operates the ultrapopular WeChat messaging service, received funding from the Ministry of State Security early on in its foundation. The organization, China’s chief civilian intelligence agency, provided a “seed investment,” this former official said, “when they were trying to build out the Great Firewall and the monitoring technology.”

“This is entirely false,” Tencent said. “Our history as an entrepreneurial start-up is well known, funded first by our founders and then IDG and PCCW, and we’ve been a public company with transparent ownership for over 16 years.”

Cooperation picked up “when WeChat became a thing; the MSS came to them regarding monitoring things and shutting them down when necessary,” said the former senior CIA official. “It’s not that Tencent or [its founder] Pony Ma are dancing to the tune of what the MSS says, but if at any point China’s security services need assistance, they are providing it.”

“Tencent, like any other company operating in China, complies with [Chinese] law in a transparent way,” Tencent said. “The allegations beyond this are completely false.”

Economic espionage by China’s spy agencies has benefited mainland companies for many years, with data hacked or otherwise stolen by China’s intelligence services flowing toward the private sector to give Chinese firms a leg up against the competition. While intellectual property theft is common—and often driven by the private sector—in China, the state has long played a key role in industrial espionage. America’s firms, with their hefty government and military contracts, became juicy targets in the online era. “It’s well understood that you’ve had some flow of information from Chinese intelligence agencies to private sector entities,” said Sean Kanuck, who served as the U.S. national intelligence officer for cyber issues from 2011 to 2016.

As far back as 2000, according to Steve Ryan, the former deputy director of the National Security Agency’s Threat Operations Center, U.S. officials observed Chinese cyberoperations aimed at piercing U.S. defense contractors—something that was occurring “on a regular basis” by around 2006 onward, Ryan said. The Chinese were “just robbing the defense industrial base blind, in certain areas, in certain technologies,” he recalled. “And then we would just watch them form a company that would then put that U.S.-side interest out of business. We saw that time and again.” These cyber-incursions became ubiquitous, with Chinese state hackers successfully compromising the networks of contractors to the Pentagon’s U.S. Transportation Command 20 times in a single year, according to a 2014 Senate Armed Service Committee report. In 2018, Chinese operatives successfully hacked a U.S. Navy contractor, pilfering highly sensitive information related to the development of submarine missiles.

American officials stewed as China rolled out new fighter jets and other weapons systems copied from stolen U.S. designs. Using their own technical spying capabilities, U.S. intelligence officials also observed hacked information being transferred from data centers controlled by Chinese intelligence agencies to quasi-private, quasi-public Chinese defense businesses. Years ago, though, this purloined data would remain with Chinese companies for “competitive uses,” said a former senior NSA official. It was like “a gift to be used effectively” from Chinese intelligence to its defense sector partners, this person recalled. This earlier model of cooperation, however, was unidirectional, with data passed from China’s spies to its own industrial base, as part of Beijing’s race for technological parity with Washington.

But the use of private Chinese conglomerates to provide the know-how and data-processing firepower for China’s intelligence apparatus represents a new stage in this evolution, U.S. officials say. “The companies they are using are portraying themselves as large, legitimate, multinationals that have footprints across jurisdictions,” said the former Trump-era national security official. “These are not simply tiny little . . . defense contractors working inside China. They are major multinationals with footprints all over the world.” China’s “use of their private sector entities furthers not only their intelligence gathering, but processing,” said Ryan, the former top NSA official.

Key legal restrictions and cultural norms mean American spy agencies cannot induce U.S. firms to sift through the fruits of its own cyberspying; they have had to build these data analysis capabilities for themselves, U.S. officials say. And they cannot, for example, commandeer private U.S. companies’ data-processing power to help them create a composite picture of what the Chinese know about, say, U.S. government employees based on Beijing’s prior hacks. But synthesizing these parallel databases has been a priority for U.S. officials, who have worked to mirror image at least some of what they believe the Chinese possess, according to three current and former senior officials. This can be a laborious process. “It took us forever to condition” the data from the OPM breach, the current senior intelligence official said.

But when U.S. officials eventually analyzed all this data, the picture that emerged about what, in fact, the Chinese knew was not a pretty one. U.S. intelligence reporting on the subject is “sickening to your stomach,” the senior intelligence official said.

“Look at Equifax. Add Anthem, the financial stuff, Marriott, there’s nothing they don’t know about us,” said the current official, referring to a series of breaches of U.S. firms perpetrated by Chinese hackers. “We are constantly trying to mimic what they do know” about Americans who might be targets for Chinese spies, they said. “And then we marry that up with intelligence that we get about what their interests are. Then we go back and give defensive briefs” to these potential targets, the current senior official said. “That’s kind of the new business model we have right now.”

China might be testing out a “new business model” as well, Trump-era officials fear. During the first few years of the Trump administration, conversations “bounced around” at the National Security Council and within U.S. intelligence agencies on how China’s hunt for security through data—through, for instance, synthesizing data from Marriot, Equifax, OPM, and other hacked organizations to identify U.S. spies—may have converged with its larger economic objectives, according to the former Trump-era national security official. The thinking “is still relatively immature” in that area, this source said. But U.S. officials believe China may be leveraging stolen personal information to attempt to undermine the American economy, through putting companies under financial stress in strategically important business sectors, even if these companies don’t perform classified work.

These datasets might also be used to benefit Chinese businesses in other ways, officials say. “If I’m looking to expand a hotel chain or expand into the international travel market, having United Airlines, Marriot, or American Airlines customer records” could provide Chinese firms clear potential advantages “for due diligence and market research purposes,” said Kanuck, the former top U.S. cyber-focused intelligence official. Likewise, Kanuck said, the hack of Anthem could give Chinese firms obvious insights into the U.S. health care market. The massive data tranches could also be used as inputs to build better algorithms for artificial intelligence programs, officials say.

While some of this weaponized data could be derived from hacks, Trump-era officials also worried that attempted investments in U.S. firms by some Chinese businesses was aimed at gaining control over personal data in U.S. companies’ possession—which could then be passed back to the Chinese intelligence services. The Trump administration’s increased use of the Committee on Foreign Investment in the United States process—in which an interagency group reviews foreign purchases for national security threats—to block takeovers of some U.S. companies by Chinese firms was partially driven by these fears, officials say.

Navigating the U.S.-China relationship will be the most momentous foreign-policy challenge for the incoming Biden administration. But in the vanishingly small world of bipartisan officialdom, the integrated threat posed by Beijing may represent the last great unifying issue in the national security sphere. The Biden administration’s China strategy seems likely to be a difference in degree from its predecessor, not in kind.

For American national security officials, deep worries about the Chinese government’s relationships with its world-spanning private sector companies—including telecom giants like Huawei, massive e-commerce platforms like Alibaba, and social media behemoths like ByteDance, which operates the TikTok platform—will increasingly influence the U.S.-Beijing relationship. China has already succeeded in isolating one out of every five humans on the planet from the global data ecosystem; now, in a defensive mirror image, U.S. policymakers are instituting more stringent controls aimed at segregating Americans’ data from Chinese companies—and, by extension, Beijing’s formidable intelligence apparatus.

Driven by fears over internal instability and external threats to its rule, the Chinese Communist Party has determined that data security is tantamount to regime security. But this strategy creates some internal tensions for Beijing. “The Chinese cybersecurity system today requires backdoors into every single company and individual in China,” said a former senior intelligence analyst. “And they are willing to admit that these [backdoors] could enable attackers and may decrease the cybersecurity of the companies.”

This is a trade-off China’s leaders seem willing to make, at least for now—even though these policies may catalyze an economic decoupling with China’s most important trading partner, and even though this decoupling might itself drive domestic instability. Meanwhile, the bear hug between Chinese intelligence and Chinese industry continues to squeeze together ever more tightly. After all, said the former senior intelligence analyst, “this is a country with omnipresence in its companies.”

[Harvey]

Is there no possibility that the Chinese simply bought everything they needed to do this, quite legally (one assumes) in the market place of user data?

[Wombaticus Rex]

Not in terms of the OPM files, but your horse sense is quite right that any private actor with the money and scale could use publicly available data to build an effective rat-catcher. Want to know where every car in America is, right now? There is a market.

A lot of that is because US state capacity in this field is laundered out through spinoff & front corporations. Building an empire on third party logistics is nothing new, though, and you could draw a straight line from the East India Company to our current clusterfuck.

Infosec as a field is heavy on social engineer, aka bluffing and lying. Some firms, like Crowdstrike, basically just exist to push narratives. Many of the biggest breaches of the past two decades are attributed to "hacking" but involved bribery and blackmail, not computers and code. The truth of the OPM debacle may be the same story.

[Wombaticus Rex]

The 2013 leaks from Edward Snowden, which revealed the NSA’s deep penetration of the telecommunications company Huawei’s China-based servers, also jarred Chinese officials, according to a former senior intelligence analyst. “Chinese officials were just beginning to learn how the internet and technology has been so thoroughly used against them, in ways they didn’t conceptualize until then,” the former analyst said. “At the intelligence level, it was driven by this fundamental [revelation] that, ‘This is what we’ve been missing: This internet system we didn’t create is being weaponized against us.’”

That is either lazy desk job rambling or deliberately deceptive: https://en.wikipedia.org/wiki/Unrestricted_Warfare