Michale S. Schmidt, David E. Sanger, and Nicole Perlroth at the New York Times report that Chinese hackers may have breached the Office of Personnel Management’s network, which contains personal files on all federal employees:
Chinese hackers in March broke into the computer networks of the United States government agency that houses the personal information of all federal employees, according to senior American officials. They appeared to be targeting the files on tens of thousands of employees who have applied for top-secret security clearances.
The hackers gained access to some of the databases of the Office of Personnel Management before the federal authorities detected the threat and blocked them from the network, according to the officials. It is not yet clear how far the hackers penetrated the agency’s systems, in which applicants for security clearances list their foreign contacts, previous jobs and personal information like past drug use.
In response to questions about the matter, a senior Department of Homeland Security official confirmed that the attack had occurred but said that “at this time,” neither the personnel agency nor Homeland Security had “identified any loss of personally identifiable information.” The official said an emergency response team was assigned “to assess and mitigate any risks identified.”
One senior American official said that the attack was traced to China, though it was not clear if the hackers were part of the government. Its disclosure comes as a delegation of senior American officials, led by Secretary of State John Kerry, are in Beijing for the annual Strategic and Economic Dialogue, the leading forum for discussion between the United States and China on their commercial relationships and their wary efforts to work together on economic and defense issues. [Source]
While cyber espionage was one of the key issues that John Kerry raised at the Strategic and Economic Dialogue, the Secretary of State claimed that he was not aware of the new office hacking until shortly before his departure to Beijing. The Wall Street Journal reports:
Secretary of State John Kerry, in Beijing for diplomatic talks this week, said he was notified about the breach “only minutes” before heading to China, where he discussed cybersecurity issues that have been a point of tension between the two countries.
[…] Revelations about the potential personnel office hacking came as Mr. Kerry was wrapping up a meeting in Beijing with senior government officials known as the U.S.-China Strategic and Economic Dialogue.
Mr. Kerry on Wednesday raised U.S. concerns about other alleged instances of cyberespionage with Chinese State Councilor Yang Jiechi, urging the government to restart a special working group on the issue. China canceled the special working group after U.S. prosecutors indicted five Chinese military officers in May for cybertheft.
“These issues are sufficiently important to warrant us rolling up our sleeves and tackling them,” a senior U.S. administration official said after Mr. Kerry’s meeting, adding that U.S. officials in meetings described “our concerns and our hope that the Chinese will themselves take necessary action to put an end to this kind of activity.” [Source]
At the New York Times, Jane Perlez reports that Chinese officials dismissed claims that Chinese hackers sought data on US government employees:
The Foreign Ministry dismissed assertions in an article in The New York Times that Chinese hackers had infiltrated United States government computer systems that house personal information of federal employees.
A Chinese Foreign Ministry spokesman said the article was part of what he called an irresponsible anti-China smear campaign.
[…] Asked about the article at a regular Foreign Ministry press briefing, a spokesman, Hong Lei, repeated China’s longstanding position that it opposes cyberhacking.
“This is what we say and what we have been doing,” he said. “Recently, some American media and Internet security firms keep playing the card of China Internet Threat and smear China’s image. They cannot produce tenable evidence. Such reports and comments are irresponsible and are not worth refuting.” [Source]
At the Strategic and Economic Dialogue, China maintained that the United States’ cyber spying allegations against five PLA officers are unjustified fabrications. The US filed criminal charges against the PLA officers in May for state-sponsored economic cyber espionage. Teddy Ng at South China Morning Post reports:
Beijing has called on Washington to “correct its wrong act” in alleging PLA officers were involved in hacking US businesses and stop interfering in regional maritime sovereignty disputes.
[…] “We believe [the charges] are … intentionally fabricated by the US. That move shows that the US lacks sincerity in working with China through dialogue to address cybersecurity,” Zheng said in a press briefing on the annual talks, adding the indictments damaged mutual trust.
“We urge the US to correct its wrong act and create conditions for dialogue and cooperation on cyberspace. At the same time, we also urge the US to stop its cybertheft against the Chinese government, institutions, organisations and individuals.” [Source]
Meanwhile, German Chancellor Angela Merkel voiced her concerns about industrial spying while on a visit to China amidst warning that some European firms are facing a growing threat from industrial espionage by the Chinese government. Stephen Brown at Reuters reports:
A German intelligence chief warned, as Chancellor Angela Merkel embarks on her latest visit to China, that some firms in Europe’s biggest economy face a growing threat from industrial espionage by Chinese government agencies with huge resources.
“Many German Mittelstand companies are easy prey,” Hans-Georg Maassen, head of the BfV domestic intelligence agency, told a Sunday newspaper, referring to the small and medium-sized family firms that are the backbone of the economy.
[…] “They are up against very powerful adversaries. The Chinese technical intelligence agency alone has over 100,000 employees,” Maassen said, in an excerpt of an interview to be published on Sunday, when Merkel begins her seventh trip to China. [Source]
While Merkel did not single out China in her comments, she made it clear that Germany is against industrial espionage no matter where it comes from. From South China Morning Post:
“Germany is against that – regardless of where it comes from,” Merkel said, in reference to industrial espionage.
“We have a duty as the state to protect our economy … We are for the protection of intellectual property.”
Li repeated his government’s denial that Beijing was involved in such activities.
“China and Germany, it can be said, are both victims of hacking attacks. The Chinese government resolutely opposes hacking attacks as well as the use of the internet to steal commercial secrets or intellectual property,” Li said. [Source]
Also see prior CDT coverage of cybersecurity, cyberespionage, US-China relations, and Germany-China relations.
