China faces cyber espionage charges

The Justice Department has brought its first charges of cyber espionage against a nation-state with the May 19 indictment of five officers in China’s People’s Liberation Army.

The five officers from a PLA hacking unit in Shanghai are charged with stealing proprietary economic information from six major U.S. companies and organizations, including producers of nuclear energy and aluminum.

Attorney General Eric Holder said the indictment was a shot across the bow to countries that would use intellectual property theft as a tool of statecraft.

“This case should serve as a wakeup call to the seriousness of the ongoing cyber threat,” Holder said at a press conference. “These criminal charges represent a groundbreaking step forward in addressing that threat.”

The six companies alleged to have been hacked are Allegheny Technologies Inc., Alcoa Inc., U.S. subsidiaries of SolarWorld, Westinghouse Electric Co., U.S. Steel Corp., and the United Steelworkers union.

The United States does not have an extradition treaty with China and the likelihood of the five defendants appearing in a U.S. court seems slim.

Prosecutors hope an indictment will yield better results than diplomacy has in deterring China from sponsoring cyberattacks on U.S. firms. A February 2013 report by U.S. security firm Mandiant pinpointed the same Shanghai offices as a launching pad for cyberattacks. Less than two months later, Washington and Beijing agreed to set up a cybersecurity working group in an effort to ease tensions on the issue.

American prosecutors appeared fed up with China’s alleged cyber transgressions. “For the first time, we are exposing the faces and names behind the keyboards in Shanghai used to steal from American businesses,” Assistant Attorney Gen. John Carlin said at the press conference. 

While U.S.-China cooperation on cybersecurity appears strained, the indictment “may create momentum on the international stage for some type of agreement on cybercrime” in forums such as the European Union’s Convention on Cybercrime, according to Matt Rhoades, a cybersecurity expert at the Truman National Security Project.

The Obama administration is “looking to be more aggressive in their prosecution” of economic cyber theft “because it is damaging to the U.S. economic recovery,” he said in an interview.

Administration officials said as much in announcing the indictment. “Our economic security and our ability to compete fairly in the global marketplace are directly linked to our national security,” Holder said. “Success in the international marketplace should be based solely on a company’s ability to innovate and compete, not on a sponsor government’s ability to spy and to steal business secrets.”

DOJ hinted that it could have more indictments of state actors in its quiver. “This first indictment of Chinese cyber actors clears the way for additional charges to be made. This is the new normal. This is what you’re going to see on a recurring basis,” said Robert Anderson, executive assistant director of the FBI’s Criminal, Cyber, Response and Services Branch.