WASHINGTON – It sounds like the plot of the next big action movie: Americans have to design a logic bomb to destroy the enemy’s computer before they get away with stealing American intelligence.
But what may sound like cinematic hype is an actual form of military response to cybersecurity threats.
“If we wanted to, we can do what’s called offensive information warfare. For example, we can steal our secrets back – we can lace our secrets with a logic bomb. So you steal my trade secrets and it wipes out your computer.” said Mark Rasch, former chief privacy officer at Science Applications International Corporation and an attorney who specializes in cybersecurity.
Offensive information warfare is just one option for the United States to consider in order to protect itself from Chinese cyber-espionage of corporate intellectual property.
Secretary of State John Kerry visited China in July for a strategic and economic dialogue. During his visit, the New York Times reported Chinese hackers broke into the U.S. Office of Personnel Management’s networks earlier this year. Kerry said he had “frank” discussions with Chinese officials over matters of cyber security.
In May, five Chinese officials were indicted by U.S. prosecutors for cyber-theft against U.S. firms, such as Alcoa Inc. and Westinghouse Electric Co.
“If you want to achieve some political objective, informational knowledge is power,” said Rasch, who also worked at the U.S. Department of Justice within the Criminal Division’s Fraud Section from 1983 to 1992.
“The goal of espionage is to obtain knowledge and information, based on political decisions, based on economic decisions,” he said “So, it can have a national security impact on the United States.”
In the case of cyber-espionage to take intellectual property, the objective is for the Chinese government to give a commercial advantage to the government, he said. That would be similar to the U.S. government breaking into a Chinese car manufacturer and handing the information over to Ford or General Motors, which U.S. officials report they do not do.
The threat to the prosperity of domestic corporations is a problem the U.S. has been experiencing for almost a decade, said Catherine Lotrionte, visiting assistant professor of government and foreign service at Georgetown University.
“The level of the threat has indicated that this is something that is at the point where it is harmful to US national security – particularly the economic viability of the United States,” said Lotrionte, who also worked as a lawyer for the CIA, the Justice Department and the Senate intelligence committee.
The Chinese hope that by gaining American intellectual property and trade secrets, China can get a leap ahead – without spending a lot of money on research and development, she said.
The U.S. economic stability may be threatened by Chinese cyber-security breaches, but response strategies are limited. Lotrionte said escalation can be an issue in the cyber world, which could damage the relationship between U.S. and China.
“That is the whole point of why we want to get to a place where we could resolve this in a peaceful matter,” she said, “particularly in cyber, although you don’t have to respond in cyber in countermeasures.”
There can be a variety of responses the U.S. could take from military to legal to economic. Cyber responses to cyber-espionage are not always necessary, Lotrionte said.
“Once you open that box it will be very hard to pull everyone back,” she said.
Responding with cyber-attacks can be risky and result in escalation, which has the potential to lead to more cyber-attacks or a cyber-war, which the U.S. Cyber Command was created in 2010 to defend against.
Recently, the U.S. took a legal action against China by indicting five military officials. And Lotrionte said the U.S. could also seek help from international legal regimes or impose economic sanctions.
“The WTO [World Trade Organization] regime is especially established so these disputes don’t escalate,” she said, “but there are other options and everyone is considering them and balancing them against the cost or the fallout of doing that.”
Rasch said that the U.S. shouldn’t discount looking for solutions to defend domestic companies technologically by developing new security or encryption technology. This idea isn’t flawless. The opposition only needs to find one way to navigate around all the security measures.
“You cannot defend against everything, but it’s very helpful and useful anyway,” he said.
While most countries commit cyber-espionage for political purposes, they shouldn’t be using it for commercial advantage – and that’s the difference that the U.S. needs to emphasize, Lotrionte said.
“While we can all live with political military espionage, the economic espionage is fundamentally deteriorating the sovereignty of states,” she said. “That is in violation of principles of sovereignty on convention, state responsibility. It’s violating international law. It’s not good for anyone.”
The Chinese economy may be benefiting from the theft, but it may be in the country’s best interest to stop taking U.S. intellectual property.
“They want to play in the global community, which means they have to play by the rules of the global community,” Rasch said.
Not following the rules of the World Trade Organization, which China is a part of, and falling out of favor with the member nations could harm China’s global economic situation, Lotrionte said.
In the end, it’s a cost-benefit analysis for China.
“It’s just a game of figuring out does the benefit of conducting the economic espionage – and continuing to conduct it – outweigh all these bad affects based on what the US is willing to do,” Lotrionte said.