The Department of Justice (DOJ) has released two indictments this week targeting Chinese individuals and companies allegedly involved in economic espionage, marking the latest in a string of cases involving both Chinese nationals and foreigners recruited by Chinese intelligence officials, and an increasing focus on Beijing’s alleged IP theft amidst the ongoing trade war. The first indictment, released Tuesday, charged ten Chinese nationals—including two Jiangsu-based intelligence officers and five hackers—for the years-long theft of aerospace secrets. It follows the unprecedented extradition of Yanjun Xu, a senior Ministry of State Security (MSS) official, for stealing aviation secrets from top firms like GE Aviation. Katie Benner at the New York Times reports on Tuesday’s indictment:
From January 2010 to May 2015, they stole turbofan engine plans and other confidential business information from 13 companies, according to court documents. They included Capstone Turbine, a gas turbine manufacturer based in Los Angeles, and other unnamed companies in Los Angeles and San Diego as well as Massachusetts, Arizona, Oregon and Wisconsin and overseas in Britain, France and Australia.
At the time, a Chinese government-owned aerospace company was developing a comparable commercial aircraft engine, the government said.
The officers worked in the Jiangsu Province office of the Ministry of State Security, China’s primary domestic and foreign intelligence-gathering agency. That office was also at the heart of the two other recent cases involving China’s efforts to steal information from the American aerospace industry.
The hackers sent spearphishing emails to company employees and planted malware into corporate computer networks, according to the indictment. They also turned their corporate websites into malicious sites that would compromise the computers of anyone who visited them, law enforcement officials said.
From November 2013 to February 2014, they also groomed Mr. Tian and Mr. Gu, employees in the French aerospace company’s China office, to work with Chinese intelligence officers, according to the indictment. [Source]
This string of high-profile indictments started in earnest in 2014, when the DOJ levied unprecedented charges of nation-state cyber-espionage against five PLA officers. At Cyberscoop, Sean Lyngaas details how the MSS is taking center stage over the PLA, and how Washington is increasingly focusing on the MSS:
The agency, the Ministry of State Security, is more professional and technical in its hacking operations than China’s People Liberation Army, according to CrowdStrike co-founder Dmitri Alperovitch.
[…] After a landmark 2015 agreement between the United States and China not to steal intellectual property, Chinese activity in that vein tapered off for about a year, according to Alperovitch. Now, he said, it is back in full force. “[W]e’re seeing, on a weekly basis, intrusions into U.S. and other Western companies from Chinese actors,” with the MSS responsible for much of that activity, he added.
The surge in cyber-espionage followed a reorganization of the Chinese government’s resources. In December 2015, the PLA established an integrated space, cyber and electronic warfare unit called the Strategic Support Force. After that, according to analysts, the MSS began taking a more robust role in targeting IP at foreign companies. (Beijing has denied allegations that it engages in state-sponsored IP theft.)
[…] With the 2015 agreement between then-President Barack Obama and Chinese President Xi Jinping apparently moot, DOJ is once again on the prosecutorial offensive. “We are going to see more to come,” Carlin [who announced the charges when he was DOJ’s assistant attorney general for national security] told CyberScoop. “That this is part of a concentrated, all-tools effort” to curb cyber economic espionage, he added. [Source]
In the second indictment, released yesterday, the DOJ’s press release and unsealed California court documents revealed that it had charged China’s Fujian Jinhua Integrated Circuit Co., Taiwan’s United Microelectronics Corp., and three individuals for theft of DRAM technology from U.S. chipmaker Micron Technology Inc. As the Wall Street Journal reports, the indictment prompted Attorney General Jeff Sessions to criticize China for refusing to honor the above-mentioned 2015 Xi-Obama agreement. David McLaughlin and Chris Strohm at Bloomberg detail the indictment:
[…] If convicted, each company faces a maximum fine of more than $20 billion, it said. The U.S. also sued to stop the companies from exporting to America any products that were created using the trade secrets.
Intellectual property theft is among the Trump administration’s chief complaints against China as it wages a trade war that’s rattled global markets and seen the world’s two largest economies slap tariffs on hundreds of billions of dollars of each other’s goods. On Monday, the Commerce Department restricted exports to Jinhua, one of several high-profile government-backed companies at the vanguard of China’s effort to become a major player in global semiconductors.
[…] The latest case was made public as the Justice Department announced a new initiative to respond to Chinese efforts to obtain U.S. technology and trade secrets, whether through hacking or theft by insiders. Sessions said the department’s National Security Division, led by John Demers, along with the FBI and a group of U.S. Attorneys will step up enforcement.
[…] Micron, based in Idaho, is the only U.S.-based company that manufactures DRAM. Prosecutors said Chen Zhengkun, also known as Stephen Chen, the president of a Micron subsidiary in Taiwan, resigned in 2015 and began working at UMC. While there, he arranged an agreement between UMC and Jinhua in which UMC would transfer DRAM technology to Jinhua to mass-produce, and the technology would be jointly shared by the companies.
[…] Micron last year sued UMC and Jinhua, claiming they stole trade secrets. UMC then took legal action against Micron in January, alleging that the company infringed on patents in China related to memory storage and other products. In July, a Chinese court banned Micron chip sales in the country, but the American company said that moratorium affected just 1 percent of its annual revenue. [Source]
At Wired, Garrett M. Graff highlights the five steps—spotting, assessing, developing, recruiting, and handling—that MSS officials use to recruit spies:
The majority of Chinese espionage cases over the years have involved ethnic Chinese, including Chinese students who came to the US for college or advanced degrees, got hired at tech companies, and then absconded back to China with stolen trade secrets. Historically, very few Chinese spying cases have featured the targeting or recruitment of Westerners. But this year has seen a rash of cases of Americans allegedly recruited to spy on China’s behalf, encouraged to turn over sensitive military, intelligence, or economic information—at least one of which started with a simple LinkedIn message.
[…] Once intelligence officers identify potential recruits, they then examine how they might encourage those targets to spy. Professionals often summarize the motives for espionage with the acronym MICE: money, ideology, coercion, and ego. Spies want to be paid for their work, or believe in the cause, or can be blackmailed, or want the ego boost that comes with leading a double life.
While it often relies on ideology or coercion in pressuring ethnic Chinese to spy on its behalf abroad, China has proved particularly successful in luring Westerners with cash.
[…] Karabasevic [a Serbian employee based in American Superconductor’s Austria subsidiary recruited to steal source code] was quite clear about his motives: As detailed in court documents, he wrote in one email to his new Chinese business partners, “All girls need money. I need girls. Sinovel needs me.” The Chinese firm ultimately offered Karabasevic $1.7 million to steal the turbine source code. He wrote to Sinovel in one text message: “I will send the full code of course.”[…] Intelligence officers generally don’t lead off by asking potential sources to betray their country or their employer. The third stage of espionage recruitment, instead, is known as “developing,” when recruiters begin to ask for trivial requests or favors to establish rapport. As former CIA director John Brennan said last year, “Frequently, people who go along a treasonous path do not know they are on a treasonous path until it is too late.” [Source]
