News: 1657174323

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

FBI and MI5 bosses: China cheats and steals at massive scale

(2022/07/07)


The directors of the UK Military Intelligence, Section 5 (MI5) and the US Federal Bureau of Investigation on Wednesday shared a public platform for the first time and warned of China's increased espionage activity on UK and US intellectual property.

Speaking to an audience of business and academic leaders, MI5 director general Ken McCallum and FBI director Chris Wray argued that Beijing's Made in China 2025 program and other self-sufficiency tech goals can't be achieved without a boost from illicit activities.

"This means standing on your shoulders to get ahead of you. It means that if you are involved in cutting-edge tech, AI, advanced research or product development, the chances are your know-how is of material interest to the Chinese Communist Party," [1]said McCallum.

[2]

"And if you have, or are trying for, a presence in the Chinese market, you'll be subject to more attention than you might think," he added.

The Chinese Government sees cyber as the pathway to cheat and steal on a massive scale

McCallum described China's efforts to acquire Western expertise, technology, research as a planned and professional "coordinated campaign on a grand scale" that has been strategically executed across decades.

China's efforts have stepped up significantly, McCallum said, with MI5 running seven times as many investigations against Chinese activity today than in 2018.

[3]

[4]

"The most game-changing challenge we face comes from the Chinese Communist Party. It's covertly applying pressure across the globe," said McCallum. Threats MI5 is working to counter include covert theft of trade secrets, patient cultivation of contacts, and establishing a "debt of obligation." Advanced persistent threats are deployed when needed, too.

The MI5 director also warned that China was working to change attitudes to suit the Chinese Communist Party's interests and support it dominating the international order – and playing the long game to normalize mass theft as "the cost of doing business these days."

[5]

Wray added that in the US, China's efforts spare none and are visible in both big cities and small towns, Fortune 500s and startups, and across everything from aviation, to AI, to pharma.

The FBI director then referred to China's hacking program as "lavishly resourced" and "bigger than that of every other major country combined."

"The Chinese Government sees cyber as the pathway to cheat and steal on a massive scale," said Wray.

[6]

Wray said the efforts were not just big, they were effective, offering the following insight on cyber attacks:

Over the last few years, we've seen Chinese state-sponsored hackers relentlessly looking for ways to compromise unpatched network devices and infrastructure.

And Chinese hackers are consistently evolving and adapting their tactics to bypass defenses. They even monitor network defender accounts and then modify their campaign as needed to remain undetected.

They merge their customized hacking toolset with publicly available tools native to the network environment—to obscure their activity by blending into the 'noise' and normal activity of a network.

However, he warned, it's not just through hacking that the Chinese state-backed threats act, but "by making investments and creating partnerships that position their proxies to steal valuable technology."

[7]TikTok: Yes, some staff in China can access US data

[8]FCC: Applications for funds to replace Chinese comms kit lack evidence

[9]Tracking cookies found in more than half of G20 government websites

[10]Biden considers removal of Trump-era China tariffs to ease inflation

Wray described all Chinese companies as beholden to the Chinese Communist Party (CCP) in some form, with the government disguising its intent to obtain influence.

Efforts include creating elaborate shell games to outsmart government investment-screening programs, passing statutes like the 2015 critical infrastructure law that requires companies to store data domestically and convenient for government access. He cited a 2020 law that required malware-laden Chinese software be used by foreign companies filing taxes – forcing the companies into installing their own backdoors – as another example of the CCP at work.

On the same day as the two spook bosses issued their warnings, the US National Counterintelligence and Security Center issued a [11]bulletin [PDF] offering more detail of China's efforts by detailing tactics used by Beijing to infiltrate US business and government for the purpose of exerting influence.

Know your foe

The FBI, NCSC, and MI5 all warned against confusing the Chinese diaspora with the CCP and Beijing.

"If my remarks today elicit accusations of Sinophobia, from an authoritarian CCP, I trust you'll see the irony," said Wray.

Liu Pengyu, spokesperson for China's embassy in Washington, responded on Wednesday denying interference, accusing the US of cyberattacks itself and characterizing criticism as "US politicians who have been tarnishing China's image and painting China as a threat with false accusations."

China's foreign minister Wang Yi and US secretary of state Antony Blinken are scheduled to meet at the G20 Foreign Ministers' meeting this week. The agenda, according to Chinese [12]state-sponsored media is "to exchange views on current China-US relations and major international and regional issues." ®

Get our [13]Tech Resources



[1] https://www.mi5.gov.uk/news/speech-by-mi5-and-fbi

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Ysauwxsc0KXf92COGVSp8wAAAMA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ysauwxsc0KXf92COGVSp8wAAAMA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Ysauwxsc0KXf92COGVSp8wAAAMA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ysauwxsc0KXf92COGVSp8wAAAMA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Ysauwxsc0KXf92COGVSp8wAAAMA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[7] https://www.theregister.com/2022/07/02/tiktok_china_us_data/

[8] https://www.theregister.com/2022/06/16/fcc_says_applications_for_cash/

[9] https://www.theregister.com/2022/07/06/tracking_cookies_found_in_90/

[10] https://www.theregister.com/2022/07/05/biden_mulls_removal_of_trumpera/

[11] https://www.dni.gov/files/NCSC/documents/SafeguardingOurFuture/PRC_Subnational_Influence-06-July-2022.pdf

[12] https://english.news.cn/20220706/4ef9f933ecb34fdb9a3560adb140e497/c.html

[13] https://whitepapers.theregister.com/



Christoph

And you can believe what the US says - they are the world experts at hacking into other countries.

LogicGate

How many firms have you heard of, that have invested into setting up businesses in the US, only to turn around to find that the busyness (and the IP) suddenly does not belong to them anymore?

I have heard about at least 2 companies that we deal with having this happen to them in China.

Please drop the false equivalences. The US has some serious problems, but here we are talking about orders of magnitude worse.

Flocke Kroes

I will start the bidding with Maksym Polyakov's investment in Firefly Aerospace and the demands from the US Committee on Foreign Investment.

(For the time being I see China as a bigger problem than the US but if Trump wins the mid-terms Roe v. Wade will look like a mild introduction to what will happen next.)

LogicGate

I may be wrong, but I believe that he was "asked" to sell. Changing the locks over night is on another level.

Flocke Kroes

I agree with the false equivalence but believe I provided a valid example as requested. "Asked" with big quotes is about right. Firefly were effectively locked out of US government launch contracts and their launch facilities at Vandenberg. Firefly were effectively dead until they did as they were "asked". If holding that stick had not been sufficient, the US government would have found a bigger stick to shake at Firefly while politely asking Polyakov to sell.

LogicGate

Yep.

The only mitigating issue is that this was a business that was on the sharp end of strategic military importance, open to the same type of misuse as when a russian owned company emptied German gas reserves just before the invasion of Ukraine. (An ownership which should never have been allowed to happen in the first place)

What happens in China is much more widespread.

I think that it is wrong to declare the US innocent, but immediately stating that the US is worse than China is simply wrong.

Re: immediately stating that the US is worse than China is simply wrong

Flocke Kroes

Agreed, which is why I didn't do that. Mitigating circumstances although certainly valid were not required in the request for an example. At the moment, this is a case of a spider calling an aardvark an insectivore. Although the US has not gone any near as bad as China they have made real efforts to catch up and have a significant opportunity to close the gap further.

Anonymous Coward

> "setting up businesses in the US, only to turn around to find that the busyness (and the IP) suddenly does not belong to them anymore?"

What, like Apple stealing Samsung's rounded corners?

.

(tongue in cheek, but there is an element of truth behind it)

Flocke Kroes

The actual litigation was Apple accusing Samsung of copying glass to the edge of the device (which only Samsung could manufacture at the time), four columns of icons and the colour black. Not an example as requested and doubly so because Apple lost and were required to publish an apology on their website (had javascript to size the image above to hide the apology to where scrolling would be required to see it) and in newspapers (so unobtrusive and badly worded that they got a scolding from the judge).

LogicGate

Nope, like new locks and armed guards escorting you away.

Flocke Kroes

I haven't tried, but what do you think would happen if you tried to get into Vandenberg Space Force Base with and expired pass? (Date valid but serial number on a list of rescinded passes)

Anonymous Coward

Just because the US not acting /exactly/ now as China does isn't evidence they're better.

As a matter of fact, I've heard often enough about the US spying on its allies, both on political leaders and to steal technology, and applying pressure on foreign companies so they do ("voluntarily", as someone like you would say), what the US government wants.

Looking back at history, you'll notice that the US did in fact /exactly/ what they're complaining China is doing now, during the 19th century, when it was convenient for them. So see, this really is "do as we say, not as we did ourselves".

https://foreignpolicy.com/2012/12/06/we-were-pirates-too/

Anonymous Coward

So because the USA had slavery at one point in its history, we should not criticize nations which employ slavery today?

The topic is the CCP's current behaviour, not who else is guilty or innocent now or in the past.

Don't partake in whataboutism. CCP shills get paid to do that, you don't have to do it for them for free.

Anonymous Coward

How many firms have you heard of, that have invested into setting up businesses in the US, only to turn around to find that the busyness (and the IP) suddenly does not belong to them anymore?

Just about every company that partnered with Microsoft.* Novell for example.

* Other greedy/evil US tech companies are available

DevOpsTimothyC

[1]Does the NSA spying on Airbus to give that information to Boeing count ? or NSA providing Thomson-CSF information to Raytheon on a Brazilian radar project? (Sorry I don't have links to hand for the second one)

[1] https://www.dw.com/en/airbus-to-press-charges-on-nsa-bnd-spying-claims/a-18422548

DevOpsTimothyC

I forgot to add that it would be a good idea for the previous post to lookup some of the concerns / whistle blowing that surrounded ECHELON

Anonymous Coward

Ferranti - a successful century-old British company, a major part of the UK defence industry, that collapsed after investing in a US company that turned out to be a front for iillegal activity by the US government.

https://en.wikipedia.org/wiki/International_Signal_and_Control

cantankerous swineherd

the US is a bigger threat than China so far as I'm concerned

Lis

@cantankerous swineherd

I am not sure "threat" is the right word.

They started and no doubt still carry on...

https://www.realclearmarkets.com/articles/2018/07/30/ip_theft_is_what_once_helped_make_america_great_103367.html

Ishy

S IP mple gix

The curmudgeonly one

Keep your vital material off the internet. Hit inconvenient, but worth the hassle

Re: S IP mple gix

John69

If your business relies on keeping something secret you really should keep it secret. If someone finds your secret they are not stealing from you.

Re: S IP mple gix

FILE_ID.DIZ

Well - that's simple to say. Way less simple to implement.

Even considerably locked down systems, such as some Federal Court electronic filing and case management system were breached via the monitoring tools used to maintain its uptime. [0] These are systems designed to handle court sealed documents, which is just about as close to "Top Secret" as you can get in the civilian side of the world.

I'm sure they did their due diligence. However, security is always a cat and mouse game and the crims only have to get lucky once and the company (or court) has to always get it right.

[0] - https://krebsonsecurity.com/2021/01/sealed-u-s-court-records-exposed-in-solarwinds-breach/

Re: S IP mple gix

Anonymous Coward

That is exactly the problem that patents were invented to solve.

Re: S IP mple gix

Roland6

Patents weren't intended to protect secrets, they were intended to protect exclusivity (for a period) in return for publiction.

Remember Coca-Cola's and KFC's recipes are business secrets not patents.

What is perhaps noteworthy is, unlike copyright, there is not a well-funded group lobbying to extend the life of patents to 70+ years.

Re: S IP mple gix

Anonymous Coward

If your business relies on keeping something secret, you need to reconsider your business model. It's possible to be profitable without being clandestine.

Corporate secrets are a vulnerability in and of themselves.

Let's be real here, if your business relies upon secrets, it is always a matter of time until someone else figures out how to do roughly what it is that you're keeping secret, certainly enough to be competitive in some regard, whether it's stolen or not. On a planet with 7.7 billion people, if you have a 1 in a million concept then there are approximately 7,700 other 1 in a million people that can figure it out too.

There is also performance improvements in tech to take into account. A shonky written rip off of a tool written now that mimics what a tool did 10 years ago will have a mostly imperceptible performance penalty for most garden variety computer users...all you have to do to compete for the most part is be cheaper and slap a nicer UI on it.

Look at Jira as an example...the UI is fucking terrible, the workflow is god awful and everyone hates it...people that hate Jira (most of the organisms that require oxygen to survive) tend to use something like Basecamp. Basecamp offers way less in terms of features than Jira, so on paper seems inferior...however, Basecamp is a lot more user friendly (so I'm told) and as a much slicker user experience. Ergo, they didn't have to compete directly with Jira feature for feature to convert Jira users into Basecamp users...they just had to cherry pick the bits people like, make the user experience slicker and off they went. Meanwhile, Jira can't do this because they probably have users all over the place that rely on niche features in the package...so they can't retract functionality because they will automatically lose subscribers...but if they don't try and retract things, make things slicker and so on, they will lose customers anyway and they are. Fucked if they do, fucked if they don't. Doesn't matter if they have corporate secrets or not. It also doesn't matter if those corporate secrets became public because it wouldn't give their competition any advantage they don't already have.

I would also go as far to say that most businesses probably couldn't care less if their competitions secrets landed in their laps somehow...as has been demonstrated time and time again...most notably when someone tried to leak a Coca Cola recipe to Pepsi. Pepsi immediately notified authorities, handed it back and did nothing with it.

https://www.theguardian.com/media/2006/jul/07/marketingandpr.drink

This is just one example of how competing businesses don't give a shit about the competitions product.

The money and success is out there...

*points out of the window where the customers holding money are*

Not over there...

*points at the company safe filled with "secrets" and bullshit*

The ability to acquire customers is linked to the quality of your product and your ability to listen to customer demands and requirements...not matching the competition and re-boxing their product. If you mirror the products your competition makes almost identically, the only ground you can really compete on is price...which puts you in a position where you can never be as profitable / cash rich as your competition. In which case you will always be seen as the cheap knock off not the industry leader.

Of course, this doesn't exclude the reality that people that want to steal corporate secrets actually exist...but it does highlight how stupid it is to try and steal "secrets" in the first place and how rediculous it is to consider that something should be held as a "secret".

Re: S IP mple gix

FILE_ID.DIZ

I disagree with your oversimplification of the problem. Much (but not all) of this data isn't "on the internet". It is protected by firewalls. However, if an employee (or other account with appropriate access) is breached, then data can be 'exfiltrated' via the internet .

I'm sure that companies like Boeing aren't hanging QNAP's on the internet...

And that exception "but not all" has to deal with email. There is a lot of sensitive data that we pass through email and is stored in our inbox and sent box that's hanging off the internet for any opportunistic hacker.

US & UK Governments

deadlockvictim

If China is such a threat, then simply forbid your multinationals from doing business in China.

China benefits from them too, you know.

The multinationals will surely wail that their profit margins will fall and that they will only make $200 profit rather than $500 profit on an iPhone, you know what to tell them.

It will also be nice, for a change, to see some films with Chinese people as the bad guys or possibly even criticising the Chinese government.

"China cheats and steals at massive scale"

Pseudonymous Clown Art

LLoyd Christmas: No way?!

Clarification Please .....

amanfromMars 1

.... Lest Ambiguity Presents and Promotes Piss Poor Preparations Planning Pathetic Performances

"And if you have, or are trying for, a presence in the Chinese market, you'll be subject to more attention than you might think," he added.

Is that a Wild Wacky Wicked threat from the West or an Exotic Erotic Ethereal treat from the East?

With a novel engaging market in the sum of billions, in both reward and persons, a presence in the Chinese market is a no-brainer for any entrepreneurial enterprise delivering a leading advantage over both hostile opposition and subversive competition alike.

There is one simple way to try and prevent the brain drain of anything worthy of the Chinese billions ...... and that is surely the most generous of home team purchases of such enterprises .... with the tacit agreement from proprietary intellectual property sources to not deliver leading advantage to foreign forces first .... unless and until the advantage be abused and misused to create a perverse inequality and corrupt inequity ....... which always delivers an unwelcome disruptive and mutually assured destructive conflict and thus is gravely to be regarded and always best avoided and prevented.

"painting China as a threat with false accusations"

Pascal Monett

There's a laundry list of Chinese nationals caught stealing secrets red-handed that says that those accusations are not entirely false.

Re: "painting China as a threat with false accusations"

FILE_ID.DIZ

China, like all the super powers, states anytime they get caught red-handed, that the accusations are false, so no surprise here. (That same doubt should be assumed for your home country's statements.)

However, it is known that these tears from Chinese officials are really crocodile tears. China still gets third-world shipping cost preferences due to UPU (Universal Postal Union) rulings, but they're literally the second biggest economy in the world today (by a considerable margin).

While what I posit may represent a tenuous relationship between shipping costs and espionage, I see that China has no problem still trying to paint themselves as some agrarian Nation, which they are clearly not (anymore).

deevee

The USA spy agencies hate competition, same as the US navy & Military do.

So hypocritical that the USA whinges when China says it might establish some bases in the Pacific, when the USA has HUNDREDS of bases already scattered around the Pacific!

J.G.Harston

Isn't that US flag 60 years out of date?

Colour me surprised

Trigun

This has been known of and said for two decades, particularly by the IT and electronics industries, with the red alert sirens going off for the last decade.

Not that I blame China: They are doing what everyone else is doing and succeeding.

I do have issues with our governments and companies who turned a blind eye to all of this then looked and sounded shocked and horrified when finally, FINALLY, they woke up to the fact that they'd actively empowered a competitor to build up to the point of a economic and military threat who's dominating political system & culture is antithetical to the west. Stupid.

The Bigger Picture

amanfromMars 1

But today is the first time the Heads of the FBI and MI5 have shared a public platform. ..... I’ll lead off; then hand over to Director Wray; [Director of the FBI] ...... And then there’s Cyber. ..... I’ll leave Chris to say more on cyber; his teams have led the way in taking the fight to those behind the keyboards. ...... [1]https://www.mi5.gov.uk/news/speech-by-mi5-and-fbi

Here's a link for those who want to hear/read/see what Chris said ...... [2]https://www.fbi.gov/news/speeches/directors-remarks-to-business-leaders-in-london-070622

[1] https://www.mi5.gov.uk/news/speech-by-mi5-and-fbi

[2] https://www.fbi.gov/news/speeches/directors-remarks-to-business-leaders-in-london-070622

Is death legally binding?