“Cyberattack” is one of the most misused terms in the discussion of Chinese hackers. With very few exceptions, China has not used force against the United States in cyberspace. What it has been doing is spying. And spying, cyber or otherwise, is not an attack or grounds for war, even if military units are the spies. Spying isn’t even a crime under international law, and it wouldn’t be in Washington’s interest to make it so.
Trying to cram Chinese hackers into antiquated cold war formulas doesn’t help, either. America’s relationship with China is very different from the one it had with the Soviet Union, in which contacts were extremely limited and there was no economic interdependence. The idea of “containment” for China is inane. How would you “contain” a major economic partner?
2. China’s hackers are unstoppable cyberwarriors.
The problem isn’t that the Chinese are so skilled; it’s that U.S. companies are so inept. A survey I published last monthfound that more than 90 percent of corporate-network penetrations required only the most basic techniques, such as sending a bogus e-mail with an infected attachment, and that 85 percent went undetected for months — another sign of lax security. (One more sign: They were usually discovered by an outsider rather than the victimized company.)
There is debate within the U.S. intelligence community about whether the Chinese have more sophisticated cyberattackers waiting in the wings or whether we’ve seen the best they can do. But it’s clear that so far, they haven’t had to bring their A-game to break into our networks.
3. China is poised to launch crippling attacks on critical U.S. infrastructure.
Obama’s State of the Union address included a line about how “our enemies are also seeking the ability to sabotage our power grid, our financial institutions and our air-traffic-control systems.” Similarly, a recent report by the security firm Mandiant suggested that China’s hackers are increasingly focused on companies with ties to U.S. critical infrastructure.
In peacetime, however, China is no more likely to launch a cyberattack on American infrastructure than it is to launch a missile at us. It has no interest in provoking a war it couldn’t win or in harming an economy it depends on. Even in wartime, China would want to avoid escalation and would be more apt to launch cyberattacks on the Pacific Command or other deployed U.S. forces than on domestic American targets.
China would attack civilian infrastructure only in extremis — if the survival of its regime were threatened.