Google has alleged that a recent hacking attack emanated from China

Google has, once again, alleged that it has been the victim of a hacking attempt emanating from China.  The internet giant claims that it has identified an extensive electronic surveillance campaign directed against hundreds of users of its Gmail email system, including senior American and Asian officials, journalists and Chinese activists.

This echoes Google’s 2010 claim that hackers based in China attacked the company’s own systems.  This led to Google refusing to co-operate with Chinese government censorship requirements.  Both this and the latest allegations have been vehemently denied by the Chinese government which has claim that China itself is actually a victim.  A spokesman for the Chinese foreign ministry argued that blaming China for such actions is “unacceptable”.  He continued to state the Chinese government’s view that hacking “is an international problem and China is also a victim. The claims of so-called support for hacking are completely unfounded and have ulterior motives”.

Whoever was responsible for the latest phishing attacks, it seems likely that they will prompt greater security awareness among U.S. officials, who, it seems, were tricked into disclosing their password details, allowing their mail to be followed by someone in China.  The U.S. Secretary of State, Hillary Clinton, expressed her concern regarding the allegations and one assumes that several memos have been sent reminding officials to stick to their work accounts when discussing official matters.

While China has declared its innocence, analysts agree that given the sophisticated nature of the attack and the identities of those targeted, financial gain can be ruled out.  Google did not discount the possibility that the attack may have been state-sponsored.

Why, then, has China been blamed for this attack?  Firstly, and most obviously, because Google claims to have traced the attack to a school in Jinan in Shandong province.  This is not the first time that Lanxiang vocational school has been implicated in such attacks.  While its national reputation is built upon its cookery and beauty industry training, the school, which has an annual intake of 20,000 students, also boasts a large computer studies class.  Indeed, the school makes much of its 10 large computer laboratories and at one time claimed to hold a Guinness world record for the room with the most computers.

In 2010 the school was named by the New York Times as one of two schools suspected of hacking attempts against American companies and human rights activists.  The other school was the prestigious Shanghai Jiaotong University.  Raising suspicions, the NYT reported that the Lanxiang vocational school was established with military support and trains some computer scientists for the military.

This, of course, is merely circumstantial evidence at best, but the Chinese military does have some form when it comes to hacking.  It sponsors hacking competitions between teams from rival provinces.  A team representing the Sichuan Military Command, for example, was implicated in attacks on the U.S. Department of Defence in 2006.

Moreover, Chinese strategists have written at length on the necessity of pursuing asymmetric strategies.  Acknowledging that U.S. military supremacy rest upon its networked command and control resources, the PLA has focused on tactics that will allow it to mitigate such an advantage by paralyzing American networks.  The most obvious manifestation of such a strategy is the 2007 missile test which saw China use a ballistic missile to destroy a weather satellite.  This was seen as a test of China’s ability to destroy American satellites should hostilities arise.  Without access to GPS, it would be much more difficult for U.S. forces to accurately strike Chinese targets.  Hacking, too, could also potentially be used to similar effect.  Such information warfare could attack the networked U.S military at its weakest point without firing a shot.

As for this particular attack, however, it seems unlikely that the culprit will ever be definitively identified.  Analysts have highlighted that the school’s computers could have been used by a third party, such as nationalist hackers unsanctioned by the government, or even by a third country hoping to camouflage its efforts.

Online nationalists have certainly taken it upon themselves in the past to attack those they perceive to be China’s enemies.  For example, in 1999, over 7,200 attacks were launched against Taiwanese websites in response to a statement by then President Lee Teng-hui.  Attacks were also launched against U.S. government sites in the wake of the accidental missile attack on the Chinese embassy in Belgrade.  In addition, a 2000 Osaka history conference which questioned the historical veracity of the Nanjing Massacre prompted attacks against Japanese sites, including that of the Bank of Japan which suffered 1,600 strikes within seven minutes.

Whatever their source, these latest attacks come as the Pentagon seems to be considering a more muscular policy toward hacking attacks.  The Wall Street Journal has reported on the existence of a classified document which suggests that the U.S. may respond to an online attack from a foreign country with traditional military methods.  The report points to concerns regarding U.S. infrastructure such as electrical grids and nuclear reactors.  It quoted one official as stating “If you shut down our power grid, maybe we will put a missile down one of your smokestacks”.

Such a policy, of course, raises all manner of thorny issues, such as how to identify the origin of such an attack and whether accusations of an attack may be used to justify a pre-determined military action.  It also raises the danger of being seen as indecisive if a hacking attack of considerable significance is not met with a military response.  It is difficult to imagine that an attack from China, for example, would prompt a military response, even if it could be proved beyond doubt that the attack was state-sponsored.    In addition, it is not altogether obvious that the leaders in Zhongnanhai are in complete control of subordinates in distant provinces.  An attack could be sponsored by official elements without permission from the centre.

Finally, it is unlikely that China is the only country involved in such activities.  Russia, too, has been accused in the past of at least turning a blind eye to, if not sponsoring, hacking attacks, while the recent Stuxnet attack on Iran’s uranium enrichment infrastructure implicated the United States and Israel.  The British government has also set aside £650m to deal with computer security.  As part of this, the Ministry of Defence plans to recruit hundreds of experts to protect British interests as adversaries threaten the networks the British armed forces depend upon.  Indeed, claimed the Ministry, future “conflict will see cyber operations conducted in parallel with more conventional actions”.

In short, it seems safe to conclude that the internet, if not already militarised, seems set to become so.