US hacking charges show China trade deal’s unfinished business

The Trump administration’s indictment of Chinese military personnel over one of the biggest data thefts in U.S. history highlights a key source of animosity remaining between the two sides after their “phase one” trade deal.

The U.S. Department of Justice announced the charges Monday against four People’s Liberation Army members over a 2017 hack of credit reporting agency Equifax Inc., which exposed the personal information of almost half of all Americans. The legal action—denounced by Beijing on Tuesday—represented the latest salvo in U.S. efforts to slow what it says are a wave of China-based cyberattacks that have only grown in reach.

The charges come at a sensitive time between Beijing and Washington, with the coronavirus outbreak battering the Chinese economy and making it harder for Xi Jinping to the meet ambitious purchasing goals set out last month in his preliminary trade agreement with President Donald Trump. And they point to a problem business groups hope will be part of any follow-up talks: intellectual property theft.

“It’s significant in the sense that it’s part of the administration’s China initiative, their broad push against the Chinese theft of intellectual property,” said Adam Segal, director of the digital and cyberspace policy program at the New York-based Council on Foreign Relations. “But it is unlikely to have any effect on Chinese hacking. The U.S. has indicted PLA hackers before, and it did not change behavior or deter future attacks.”

‘Double Standard’

The announcement by Attorney General William Barr on Monday followed an indictment in Atlanta accusing four members of the PLA’s 54th Research Institute of conspiring with each other to hack into Equifax’s network. They were charged, among other things, with three counts of conspiracy to commit computer fraud, conspiracy to commit economic espionage and conspiracy to commit wire fraud.

Chinese foreign ministry spokesman Geng Shuang deflected a question about the case Tuesday, repeating the country’s long-held assertion that “Chinese government, military and relevant personnel never engage in cybertheft of trade secrets.” Geng then accused the U.S. of having a “double standard” on cybersecurity, citing the spying revelations by former National Security Agency contractor Edward Snowden.

The U.S. said the Chinese hackers exploited a vulnerability in the Apache Struts Web Framework software used by Equifax’s online dispute portal to obtain login credentials and navigate the company’s broader network. They obtained names, birth dates and Social Security numbers for some 145 million American citizens.

The hack was an example of China’s state hackers diversifying their traditional targets, according to John Hultquist, the senior director for intelligence analysis at FireEye Inc., a global cybersecurity firm.

“The Equifax incident is just one example of a shift by Chinese state hackers towards organizations that aggregate data,” Hultquist said. “Government bureaucracies, hospitality, and travel organizations have been targeted alongside telecommunications firms and managed service providers in intrusions designed to allow access to huge amounts of data and proprietary information.”

Equifax Chief Executive Officer Mark Begor told Bloomberg News on Monday that “having China indicted for this really changes the stakes” for the company. “It definitely raises the bar for all of us on what we need to do to defend the sensitive data that we have,” Bregor said.

Still, the indictment was unlikely to change Chinese behavior, since similar actions in the past have had little effect. In 2014, the U.S. charged five Chinese military officers with hacking American companies and trying to steal trade secrets from American companies including Westinghouse Electric Co.

The following year, Xi and then-President Barack Obama agreed that neither government would “conduct or knowingly support cyber-enabled theft of intellectual property, including trade secrets or other confidential business information, with the intent of providing competitive advantages to companies or commercial sectors.” Xi pledged to “strengthen cooperation and avoid confrontation,” he said at the time.

Beside the Equifax hack, China has also been linked to a 2018 cyber-attack at Marriott International Inc., yielding data on 500 million guests. There was also a 2015 incident in which data on 21 million individuals was stolen from the federal Office of Personnel Management, including Social Security numbers and 5.6 million fingerprints.

In the “phase-one” deal announced last month, China affirmed its commitment to “establishing and implementing a comprehensive legal system of intellectual property protection and enforcement,” without making a new promise on hacking.

Barr’s comments represented the second time in a week that he has raised criticism of China’s behavior on technology issues. Last week, he gave a speech warning of the threats he said are posed by Chinese technology, focusing on Huawei Technologies Co.’s 5G networks, saying the U.S. should consider investing in competitors Nokia Oyj and Ericsson AB.

“Unfortunately, the Equifax hack fits a disturbing and unacceptable pattern of state-sponsored computer intrusions and thefts by China and its citizens that have targeted personally identifiable information, trade secrets, and other confidential information,” he said.