Saturday, September 5, 2015

• US to hit China hackers before Xi’s Washington visit By Demetri Sevastopulo, Gina Chon and Charles Clover

By Demetri Sevastopulo, Gina Chon and Charles Clover
Friday, September 04, 2015
* Washington Post: US Developing Sanctions Against China Cyber Crimes -By Evangeline Alfeche | September 6, 2015
* Financial Times: USA sanctions against Chinese companies could come next week - September 6, 2015 Sam Kerry
* Beijing expected to escape US hacking sanctions - By Katie Bo Williams - 09/06/15
* Officials: China cyber sanctions could come next week - By Tal Kopan and Jim Sciutto - Sat September 5, 2015
* U.S. could impose China cyber sanctions next week - By Amy R. Connolly | Sept. 5, 2015
* Why the U.S. and China are headed toward an escalating cyber war
* Inflated Cybersecurity Threat Escalates US-China Mistrust

​"If we are fearful of Chinese retaliation, then we are self-deterring." -- Bonnie Glaser
The White House is preparing to slap sanctions as early as next week on Chinese companies connected to the cyber theft of US intellectual property.

The Obama administration has for months been preparing a raft of sanctions to respond to mounting commercial espionage from China

Three US officials said the sanctions would probably be unveiled next week, just weeks before Xi Jinping makes his first state visit to America.

Officials have been divided over whether the administration should impose the sanctions before the Xi visit. Proponents argue that the US needs to show China that it is serious about tackling cyber espionage. But opponents worry that such timing would seriously damage the visit.

The state department had been pushing for the sanctions to come after it, according to people familiar with the situation. 
But law enforcement officials argued against waiting because of the serious nature of the cyber attacks.

One official said the move would probably come next week, after the US Labour Day holiday. 

He said the White House wanted to avoid slapping China with sanctions immediately before the visit, to give China time to cool down before Xi meets President Barack Obama in Washington.

Officials are participating in White House meetings this week to finalise plans for the sanctions, according to people familiar with the talks.

T​he sanctions are expected to focus on cases involving economic espionage and the theft of trade secrets, according to people familiar with the cases. 

They will also probably be used as additional punishment in cases where indictments have already been handed down.
When Xi lands in the US, he will be caught between three uncomfortable stories: the visit of Pope Francis, attacks against China on the presidential campaign trail, and the White House move to impose sanctions on Chinese companies and individuals.

China wants to boost Xi's status as a global leader, but his visit — which will include a 21-gun salute and a big banquet — will be overshadowed by the Pope's, which will attract huge media coverage, and also the move to impose sanctions.

Bonnie Glaser, a China expert at the Center for International & Strategic Studies, said sanctions would send a message that Washington was "really serious" about cracking down on commercial espionage. 

Some have argued that it would spark retaliation, but Ms Glaser said the US needed to accept the risk of retaliation to show the Chinese that it was serious.

​"If we are fearful of Chinese retaliation, then we are self-deterring," said Ms Glaser.

However, one pro-China US official said: "The cyber sanctions could really throw a spanner in things. There is no reason to embarrass the president of China. It would crater the visit."

When the US unveiled a new sanctions regime in April, sceptics wondered if they would be used against entities in China given the country's deep economic ties with the US. 
But concern about cyber incidents emanating from China has been increasing — the FBI recently blamed China for a 53 per cent rise in economic espionage cases.

The US is betting that sanctions would have a tough effect on those targeted, since it would cut them off from the global financial system. 

Banks and companies that do business in US dollars would be required to freeze their assets and would not be able to conduct transactions with them.

​The tough enforcement environment has already prompted banks such as JPMorgan Chase to get out of certain businesses, such as declining to house bank accounts for former and current foreign government officials because of money laundering and sanctions risks.

"There was a recognition that there needed to be more tools for deterrence and to raise the costs of these attacks," said Adam Golodner, a cyber expert at the Kaye Scholer law firm. 
"Sanctions are a powerful tool because it affects your ability to do business. There is a certain amount of symmetry in imposing economic sanctions on the actors that benefited economically."

There has been no reaction in China to the news about sanctions. 

Beijing has long argued that the revelations by former NSA contractor Edward Snowden prove it is a victim of US hacking, rather than the main aggressor. Documents released by Mr Snowden showed that the US planted backdoors in products from big US technology companies to spy on communications.

The sanctions will exacerbate a spat between the US and China over trade barriers in high-technology industries that has seen the US shut its domestic market to Chinese companies such as Huawei, while China has sought to institute controls on foreign IT purchases, particularly from US companies.

The tit-for-tat nature of the dispute was made clear last year when the US indicted five Chinese army officers over cyber-related economic espionage. 

China subsequently implemented measures such as a ban on Microsoft Windows 8, and attempted to put pressure on domestic banks to forgo purchases of foreign servers, particularly from IBM.

Goodwell Gong, founder of the Chown Group, a Chinese information security forum, and a founding member of China's hacking community, said China would probably take no action until the US provided a list of individuals and entities who fell under the sanctions.

US sanctions on Chinese firms could hit next week
US to hit Chinese hackers with sanctions
China moves to modernise its army
National Crime Agency hit by revenge hack
2016 candidates take aim at China
Scott Walker talks tough on China after courting Beijing as governor

Washington (CNN)The White House is preparing a slate of sanctions it could bring against Chinese enterprises in response to cyberattacks against American businesses, a government official familiar with the process told CNN.

The move is a show of force on the issue just a few weeks ahead of a state visit by Chinese President Xi Jinping, and comes amid growing tensions between Washington and Beijing over China's increasingly assertive national security posture.

Preparing the sanctions is the latest in a series of steps the administration has taken to try to show that it takes cyberattacks on U.S. business seriously -- but following through with sanctions would take the issue to a new level.

The U.S. official, however, said the administration had not made a final decision on a timeline to impose the sanctions.

The Washington Post on Monday first reported that the United States was weighing such action.

The sanctions, if imposed, would go after Chinese entities that steal American business secrets, a practice U.S. companies have long complained of. But they would also come on the heels of a massive hack of the U.S. Office of Personnel Management that compromised more than 21 million sensitive government employee records and background checks. The United States has accused China of being behind the hack.

The sanctions authority that would be invoked -- via an executive order signed by President Barack Obama in April, which gives the administration the ability to sanction entities worldwide for engaging in cyberattacks against U.S. targets -- doesn't address traditional government espionage hacks like OPM, but that breach looms over the decision.

Experts said it's no coincidence that word of the preparations is coming out just a few weeks before Xi's state visit at the end of the month. The threat of sanctions, they indicated, is designed to give the United States some leverage going into those talks.

"The main point here is to send a message to the Chinese," said James Lewis, a cybersecurity expert at the Center for Strategic and International Studies.

"It lets them know that there's a cost to doing this, which is something they didn't have to think before," he explained. "It helps reframe the debate."

He continued, "It's not like Xi's going to come in and say, 'I'm sorry, you're right. It'll never happen again.' But it does tell the Chinese: 'You're not going to be able to try to pretend (cyberespionage) didn't happen.'"

Lewis said the administration began seriously talking about what it wanted to do on China early this summer, with some parts of the government, like the military, looking for more aggressive action. But sanctions have the appeal of being both flexible and tangible, Lewis said.

In the meantime, the volatile Chinese economy has proved to be an unexpected factor, with the threat of a Chinese economic crisis making Xi's visit even more important for China and adding pressure on the United States to tread carefully.

The April executive order allows the Treasury Department, in consultation with the Justice and State Departments, to go after the assets of any individuals or organizations that engage in or economically benefit from stealing trade secrets from American companies by hacking.

Though the United States has sanctioned individuals in China in the past for offenses including supporting terrorism, and has added sanctions to its existing penalties on North Korea for the country's cyberattack on Sony Pictures Entertainment, the United States. has never before sanctioned individuals for an act of cyberespionage. That has frustrated American companies, which complain the Chinese government has engaged in unbridled attacks on U.S. targets to steal any intellectual property it can get its hands on.

China has repeatedly denied involvement in cyberattacks on the United States, even as the United States has placed greater pressure on China to fess up.

"It is the consistent position of China to firmly combat all forms of cyberattacks," Foreign Ministry spokesman Hong Lei said in June when asked about the OPM hack. "We hope that the U.S. side would discard suspicions, refrain from making groundless accusations and show more trust and conduct more cooperation in this area."

The White House has tried to send the message to China before that it won't tolerate such attacks. Obama raised the issue with Xi in a meeting in California in 2013, and his Cabinet has continued to convey that message in talks with China. The Justice Department also indicted five Chinese military officials in 2014 on accusations they hacked U.S. businesses to steal trade secrets, upping the ante on publicly calling out Beijing for engaging in cyberespionage.

But even the administration has not expressed high hopes of bringing those individuals to the United States to stand trial, and many hard-liners have questioned why the White House wasn't using the highly detailed indictments to go after the businesses in China that alleged benefited from the stolen intellectual property.

Now, sanctions would be the first time the United States imposes a tangible cost on China for the economic cyberattacks the administration has spoken against for years. And officials hope the message hits home even before the state visit of Xi, whether or not the sanctions are imposed before then.

Norma Krayem, a former Clinton administration Commerce and State Department official, predicted the sanctions would come after the state visit, but the leak of their preparation gives the United States leverage going into those talks.

"I think the administration is making it clear prior to that visit that this is an issue of great import, and that the U.S. will stand behind its assertions that China and other nations need to stand down on its actions in cyberspace," Krayem, a senior policy adviser at Holland & Knight, said. "The biggest issue for the U.S. is making it clear on the international stage that they will do what they have to protect U.S. businesses. On the global arena, you cannot tell your opposition to stand down and, when they don't, take no action."

Lewis agreed: "In some ways that's the shrewdest way to do it, because it gives you a little leverage in the summit in terms of what they can ask for from Xi, where you can get some mileage."

But another government official cautioned against placing bets on how much of a role the state visit would play in the timing of any sanctions.

"There's always a reason not to do it," the official said. "I don't think any particular one event is going to drive it."

The White House would not officially comment on the sanctions preparation.

One senior administration official did note, however, that the new executive order allowed "the use of economic sanctions against malicious cyberactors," and that "the administration is pursuing a comprehensive strategy to confront such actors."

The official emphasized, "We are assessing all of our options to respond to these threats in a manner and timeframe of our choosing."

FILE - U.S. President Barack Obama delivers 
remarks at the White House.

Last updated on: August 31, 2015 7:37 AM - WASHINGTON
The Washington Post reported Sunday the Obama administration is preparing “unprecedented” economic sanctions against Chinese companies and individuals who benefit from the cybertheft of valuable U.S. trade secrets.

Such action would follow President Barack Obama’s executive order declaring such activities a “national emergency,” and precedes the state visit of Chinese President Xi Jinping.

The Post, quoting several administration officials, said the United States has not yet decided to issue the sanctions, which could involve asset freezes and blocking the financial transactions of those engaged in cyberattacks.

State visit
However, they said a final call is expected, perhaps in the next two weeks, about the time Xi arrives on his first state visit to Washington.

It said the timing of the sanctions to the visit indicates how frustrated U.S. officials have become over persistent cyberplundering.

The paper added that while China is not the only country that hacks computer networks for trade secrets, it is by far the most active.

The Post cited the Federal Bureau of Investigation (FBI), which said economic espionage cases surged 53 percent in the past year, and China accounted for most of that.

The Post said it is unclear how many firms or individuals will be targeted, though it cites one official who said the Chinese firms would be large and multinational.

Government hacked
It said the hacking last year into the U.S. government’s Office of Personnel Management (OPM) databases did not directly benefit Chinese industry, but its severity convinced officials that firm action was warranted.

In May 2014, U.S. authorities charged five Chinese military officers of the secretive hacking unit 61398 of gaining access into the networks of American nuclear, metal and solar firms to steal trade secrets.

In 2013, the U.S.-based internet security firm Mandiant accused Beijing of involvement in a sophisticated campaign of cyberattacks against American businesses, government and other critical infrastructure.

China has denied such allegations and insists it is the victim of cyber-attacks. In 2013, former National Security Agency (NSA) contractor Edward Snowden revealed a secret, global mass surveillance program by U.S. intelligence.

In April 2015, Obama issued an executive order launching the first-ever sanctions program to financially punish individuals and groups outside the United States who engage in malicious cyber-attacks.

No cyberwar
Ankit Panda, editor of the Asia-Pacific current events publication The Diplomat, said the U.S. is not declaring cyberwar on China.

"I think this is an attempt to moderate China’s behavior, to impose costs, to show China there will be costs for individuals and companies that are seen to be engaging in cyber-espionage and cybertheft," Panda said.

"I think Washington has charged the Chinese military of facilitating the theft of U.S. intellectual property for the advantage of Chinese firms and, I think, it’s trying to state here with this move of economic sanctions that this behavior will not be tolerated," Panda added.

But, the Post, quoting U.S. officials, said while sanctions alone will not change China’s behavior, if done in tandem with other diplomatic pressure, law enforcement, military and intelligence, it will start to impose costs.

But, it warned the risk includes Chinese retaliation.

Greg Austin, a China specialist at the Australian Center for Cyber Security, said such sanctions are warranted if Washington can prove Chinese individuals or entities gained a clear competitive advantage from the theft of U.S. trade secrets, but noted the difficulties of presenting proof.

"There are very few cases where this can be proven in the public domain," Austin said.

"It’s quite one thing to be able to prove where a company has clearly copied or stolen a design of a Gucci handbag. But it’s quite a different thing to prove conclusively that a company has stolen trade secrets simply by cyber-espionage when, in fact, there is a whole range of public domain information about patents, the detail of commercial activity, and business designs already in the public domain. ...," he said, adding, "It’s a very complex field."

He said there is no question Chinese intelligence and its global counterparts are scooping up commercial information by the terabyte, but he questions the rate at which that data can be converted into competitive advantage by Chinese commercial firms.

Austin added the Obama administration will need to find the right balance between targeting specific Chinese corporations and more inflammatory rhetoric about Chinese government complicity in commercial espionage.