Amid trade war, US watching China for cyber theft

The U.S. accused China of cyber spying for commercial gain this spring as part of its justification for imposing tariffs on Chinese goods. Now that a trade war is fully underway between the two countries, Washington is waiting for China to do it again.

The State Department says it is “monitoring” China's commitment to a 2015 agreement that it wouldn't use cyber espionage for the commercial gain of its domestic industries. Trade officials were more blunt this year, alleging violations of the deal in support of tariffs the United States is placing on Chinese products.

The Office of the U.S. Trade Representative — in a “Section 301” report this spring that helped set the stage for the tariffs — claimed that China had violated the agreement between then-President Barack Obama and Chinese President Xi Jinping that state-sponsored cyber spying for the benefit of domestic industries was unacceptable.

Yet the U.S. has not used any tools related to the 2015 agreement to signal that it believes China has violated the accord, and State Department officials are assessing the situation in more cautious language than that used in the USTR “301” report.

“It's fair to say that [the agreement] had an effect on their behavior,” Christopher Painter, the top State Department cyber official at the time of the agreement, said in an interview. “It created a measurable expectation of behavior” that China has subsequently accepted in agreements with the G-20 and other countries.

“If the Chinese government is sponsoring [prohibited] activities, the U.S. has tools, including formally notifying them of violations and using sanctions,” Painter said. “China committed to no espionage to benefit the commercial sector and that created accountability. And the U.S. didn't give up anything to get that, our options are still on the table.”

Painter added: “The State Department is saying, 'we're looking closely, we have all these tools.' … If they violated the agreement, I support taking action. But it's not clear [from the “301” report] that they have violated the agreement.”

A State Department official, in an emailed response to questions about the 2015 deal, did not cite any specific violations.

“For the past several years, we have consistently raised our concerns to China regarding cyber-enabled intellectual property theft. Our persistent engagement led to an unprecedented set of cyber commitments announced during President Xi Jinping’s September 2015 state visit. Those commitments included an agreement that neither country’s government would conduct or knowingly support cyber-enabled theft of intellectual property for commercial advantage. … The United States is closely monitoring China’s adherence to these commitments.”

The State Department official noted the USTR report, but did not comment on the specific allegations. “We consistently and candidly raise our concerns regarding cybersecurity with the Chinese at every level. We remain committed to holding China accountable through a variety of mechanisms, and will pursue opportunities for continued dialogue when appropriate.”

U.S. officials have shown interest in resuming dialogue with China on cybersecurity, possibly with talks in September or October, according to James Lewis of the Center for Strategic and International Studies. Lewis said he learned of the U.S. interest from Chinese officials during a recent visit to Beijing.

The State Department didn't specifically confirm that such an offer is on the table, and neither have the departments of Defense and Homeland Security, which would be parties to the talks.

Lewis said that, contrary to the USTR conclusions in the Section 301 report, “most people think [the 2015 deal] is holding.”

“You'll know the agreement is broken when the PLA [People's Liberation Army] goes back to stealing commercial information,” said Lewis, a former Foreign Service officer and a key architect of highly-regarded cybersecurity recommendations written for the past two presidents.

An industry source added that, “There is a working consensus in U.S. circles that China’s observable theft of American firms’ [intellectual property] by cyber means has decreased but not gone away.”

The USTR report cited only one post-2015 example of Chinese spying for the benefit of domestic companies, the 2017 indictment of employees at a Chinese technology company, Boyusec, for cyber theft. The report said “cybersecurity firms have linked [Boyusec] to the Chinese government” but offered no verification of that charge.

“If [the Trump administration] can conclude that it was state action, not players 'associated' with the government, that's a real concern,” Painter said.

The USTR report did offer numerous examples of cyber-snooping detected by U.S. private-sector cybersecurity firms, although many of these cases may have fallen “in bounds” under the Obama-Xi agreement.

“It's really confusing but the consensus view is that the agreement doesn't ban espionage, it bans espionage for commercial purposes,” Lewis said. “It doesn't mean the Chinese stopped spying, but it does mean they put more resources toward traditional espionage.”

Painter, the former State Department cyber coordinator, suggested China would not resume state-sponsored cyber espionage for commercial gain even if the trade war with the U.S. intensifies. “If relations with the United States become so bad, China has a number of options. But the agreement [still] makes sense for them for a number of reasons, including that similar language was agreed to with other countries as well.”

CSIS' Lewis agreed and said the deal helped Xi advance his goal of “professionalizing” the Chinese military by getting soldiers out of the hacking-for-profit racket.

Painter argued that real cybersecurity progress has been made under the agreement, both for the U.S. and its allies, adding, “It took two years of pressure to bring them to the table in 2015.”