How Chinese Developers Are Cracking The U.S.

To begin, could you please state your name, your position, and what your job consists in? Okay, so my name is John Demers, D-E-M-E-R-S, and I'm the Assistant Attorney General for National Security at the U.S. Department of Justice. Look, China represents 80% of the economic espionage cases that we have charged here at the department. Since the beginning of the economic espionage statute back in the 1990s. So why is there still no smoking gun? Massive and ongoing Chinese hack. Investigating a hack. Chinese hack. Hack of major telecommunications companies. Microsoft accusing Chinese state-sponsored hackers. The Justice Department is unveiling a series of criminal cases against a dozen Chinese hackers. In 2024, an FBI report indicated that half of all cyber attacks against critical infrastructure in the U.S. came from groups linked to China. The Chinese may not be as sophisticated as the United States, but on every level, China has been moving with substantial determination. It was recently discovered that private companies may be joining forces with the Chinese government. Last year, a Chinese cybersecurity firm had its secrets basically leaked online. It was really astonishing because it gave us an insight into the inner workings of Chinese cybersecurity. But the hidden intention behind all this could go beyond the simple economic sphere. Their goal in accessing and maintaining access to those systems is to provide military leadership the option to stop their function. The use of cyber espionage as a political and military tool by China began to be detected in the early 2000s. According to a 2012 Pentagon report, at least 40% of intrusion attempts into U.S. military networks had been traced back to servers located in China. During that same period, the most affected sectors were critical energy and telecommunications infrastructures. The perception in Washington was clear. Beijing was already preparing the ground for a scenario of unconventional warfare. Last week, Chinese hackers penetrated a high-level security agency responsible for maintaining and designing America's nuclear weapons. Internal documents indicated that in the event of a conflict, the ability to disrupt power or water systems in key cities could have the same impact as a physical attack. With the arrival of Xi Jinping to power in 2013, the strategy became explicit. That same year, Edward Snowden's leaks revealed how the U.S. National Security Agency used software vulnerabilities for global espionage operations. In Beijing, these revelations were interpreted as a sign that control of cyberspace could determine the stability of a regime, thus restricting access to the Internet. When Xi Jinping comes into power in 2013, Edward Snowden had already leaked documents from the NSA detailing U.S. offensive capabilities. They're watching the Arab Spring happen. They're very aware that regime instability can occur from lack of control over content on the Internet. Between 2015 and 2017, the Chinese government implemented reforms in more than 200 universities to improve cybersecurity programs, increasing enrollment in degrees related to forensic computing and network security by 70%. During this period, Chinese teams began to stand out in global hacking competitions. Teams from Tencent and Baidu consistently achieved leading positions. In several tournaments, Chinese teams were able to discover critical vulnerabilities in iOS in less than five minutes, a record that demonstrated their accumulated technical capacity. The success was such that, in 2017, 30% of the top positions in international competitions were occupied by Chinese teams. In 2018, the Chinese government decided that domestic researchers should stop participating in international competitions. They stopped in 2018 after the Chinese government decided to restrict Chinese teams being able to compete in competitions outside of China. Instead, the Tianfu Cup was created, a local tournament controlled by the state. The difference was substantial. While in international events, vulnerabilities were shared with manufacturers to fix them, in the Tianfu Cup, they were delivered directly to Chinese intelligence services. A revealing example occurred in 2019, when a team presented an iPhone exploit. Within weeks, the vulnerability was used to strengthen digital surveillance in Xinjiang, China's largest region. In 2021, China implemented the Regulation on the Management of Software Vulnerabilities. This regulation required any company operating in China The new law was approved in November by China's National People's Congress. China says it's necessary to safeguard cyber security and protect against hackers from within and outside the country. This ensured that the Chinese state had almost immediate access to global vulnerabilities, from Windows to Android. For critics, the regulation turned all foreign companies operating in the country into involuntary sources of intelligence. According to a report by the Atlantic Council, between 2004 and 2022, 130 hacking competitions were organized in China, many of them directly funded by state ministries. The Wang Ding Cup tournament hosted up to 35,000 participants, becoming one of the largest in the world. The scheme was clear, detect the best talents and channel them into intelligence agencies In 2024, the world learned in greater detail about the machinery behind this system through leaked data from the Chinese company iSoon. Chinese police are investigating hundreds of files leaked online last week. They purport to show Beijing's government agencies carrying out large-scale cyber attacks against foreign governments, companies and more. The documents showed contracts between this firm and local, provincial and national authorities. The files revealed that even police departments in medium-sized cities hired hackers for specific digital espionage operations. Internal chats showed engineers discussing probabilities of success when infiltrating email servers or water systems. In one case, a technician claimed to have an 80% chance of entering a system and minutes later confirmed, mail server compromised. The United States responded with formal accusations against iSoon employees and Chinese officials, while Beijing denied involvement. According to the U.S. Cybersecurity Agency, in 2023 and 2024, more than 12,000 intrusion attempts were detected in U.S. power, water and telecommunications networks linked to Chinese IP addresses. It is estimated that 60% of those attacks sought to map vulnerabilities to be exploited in a potential military conflict scenario. In a media scandal in 2023, international outlets reported that telephone companies and state agencies in India, Malaysia and Taiwan were targeted by operations attributed to groups linked to Beijing. At the same time, two state-backed hacker groups were identified in the U.S. Salt Typhoon, accused of breaking into the Treasury Department and telecommunications networks. Meanwhile, Vault Typhoon was accused of infiltrating critical infrastructure, particularly difficult to detect because they camouflaged themselves within normal system activities. The most alarming case of Vault Typhoon was recorded in Guam, a U.S. territory in the Pacific that hosts the closest military base to Taiwan. According to a Bloomberg investigation, this group compromised telecommunications, federal and military networks on the island, possibly with the goal of limiting the immediate response capacity of the U.S. in the event of a conflict in the Taiwan Strait. Experts point out that such attacks not only put local communication and power supply at risk, but also generate a domino effect. Power outages affect refineries, hospitals and backup systems, weakening critical infrastructure within days. China has gone after electrical grids, water treatment facilities and telecoms The scale of China's cyber operations program is what most worries Western analysts. The Federal Bureau of Investigation has described the hacking apparatus of the People's Republic of China as the largest in the world, surpassing the sum of all major nations combined. While the U.S. telecommunications sector has developed over seven decades, China's has been expanding for only 20 years, yet it has managed to scale much more aggressively. For analysts, this confirms that Beijing's main objective is not only to steal technological secrets, but also to ensure the ability to paralyze vital infrastructure in the event of war.