For years, intelligence agencies and private security experts have warned that Chinese hackers are trying to steal Western corporate secrets.
The cries have grown ever louder as the attacks have become bolder and signs of government involvement have surfaced.
In a forthcoming book, Eric Schmidt, the executive chairman of Google, reportedly brands China “the most sophisticated and prolific” hacker of foreign companies.
Chinese hacking has outraged many American politicians, leading to noisy hearings in Congress and a backlash against Chinese firms.
Earlier this month the Obama administration declared its intention to go on the cyber-security offensive.
Europe, China’s biggest trade partner, is angry, too.
The European Commission is considering forcing hacked companies to reveal their woes to the authorities.
The Chinese government has always hotly denied the accusations.
Its officials say the accusers have never produced hard evidence.
Now that has changed as Mandiant, an American cyber-security firm, released a detailed report on February 19th describing the activities of a curious group of hackers.
Through its work protecting Western firms, Mandiant observed how these hackers broke into dozens of company networks over many years to steal vast amounts of intellectual property (IP).
The bombshell is the claim, denied by the government, that this gang is actually an elite division of the People’s Liberation Army (PLA), known as Unit 61398, based in an innocuous white office building near Shanghai’s financial district.
The report is worth taking seriously for several reasons.
First, Mandiant has a sound pedigree: it shot to prominence by tracing the long-term hacking of the New York Times, revealed last month, back to Chinese officialdom.
And, unlike previous accusers, it has meticulously documented the hackers’ methods and malware.
Though the hackers (known as the “Comment Crew”) used nearly 1,000 remote servers in over a dozen countries, Mandiant traced them to networks in Shanghai near the army compound.
Not everyone is satisfied.
Jeffrey Carr of Taia Global, a security consultancy, argues that this new report suffers from a “blame China first” bias, and that its methodology is not rigorous enough.
Mandiant rejects this, though it accepts that the evidence points to Unit 61398’s district, rather than to its actual building.
However, it is unlikely that well-organised, well-funded cybercrooks are hacking the Fortune 500 from noodle joints outside the compound.
Still, it is surely right to challenge those who blame China for every ill.
Apple, Facebook and Twitter have recently been breached, for example, but it appears that hackers from eastern Europe may be to blame.
Iranians were probably behind a recent cyber-attack on Saudi Aramco, the world’s biggest oil firm.
Robert Bigman, formerly chief information security officer for the CIA, says that Russia, Bulgaria, Romania and Ukraine deserve to join China on cybercrime’s most-wanted list.
An American telecoms company recently asked Mr Carr to investigate a Chinese outfit acquired by one of its American vendors.
This client wanted to be sure that its new purchase did not have ties to China’s state-sponsored cyber-hackers.
It did not, but Taia discovered in the process that the Chinese company used a software-outsourcing firm that turned out to be a front for Russian intelligence.
Mandiant probably got it right, believes Dmitri Alperovitch of CrowdStrike, a security firm that got close to nailing the PLA’s hackers two years ago.
Mr Bigman, the ex-CIA officer, agrees.
It is unclear whether the hacking activity is orchestrated or merely tolerated by central authorities.
Another reason to think this report marks a turning-point is its timing, which suggests American official blessing.
Richard Bejtlich of Mandiant says the firm decided only a month ago to give away the report.
Normally, private clients would pay handsomely for the detailed technical information it contains.
But, mindful of the growing momentum among political leaders for action, and after discussing the report with intelligence experts, the firm released it as a way “to wage cyber war and to challenge the ‘benign China’ thesis”.
The report is part of a new American “naming and shaming” effort designed to push China to rein in its hackers, reckons Bill Bishop, a Beijing-based technology expert.
It might work, but he worries that if America pushes too hard the new Chinese leadership will feel boxed in.
Under pressure from the PLA and public opinion, it might choose to escalate things instead.
Adam Segal of the Council on Foreign Relations, an American think-tank, argues that America must be willing to use trade penalties, visa restrictions and financial sanctions to raise the cost of stealing IP.
“China must see it is vulnerable,” he insists.
On February 20th America announced a strengthening of its efforts to prevent the theft of trade secrets, and China was mentioned prominently.
In the past many firms have been reluctant to admit they had been hacked, because of the risk of tipping off competitors and alarming investors.
Perhaps Mandiant’s report will mark the moment when firms began to put collective security first.
Christian Murck, head of the American Chamber of Commerce in Beijing, likens the silence to the one that surrounded counterfeiting a dozen years ago.
Back then, fake goods were an enormous problem in China but Western companies did not want to speak out for fear of tarnishing their brands.
In time, though, firms got together, shared information and lobbied for stronger laws and enforcement.
Counterfeiting is still widespread but it is becoming a more manageable problem. Hacking might be too one day, says Mr Murck.
Western victims have one further hope.
Attitudes toward IP theft may be changing at the best Chinese companies.
Huawei and ZTE, Chinese telecoms-equipment vendors, are at each other’s throats in a row about stolen IP.
Mindray, a Chinese medical-technology pioneer, has taken former employees to court for ripping off its designs.
In short, Chinese firms are starting to generate their own valuable IP and will increasingly demand that the legal system protect their assets.
As they do so, they are starting to get their employees to respect IP as well.
Pressure on China from abroad will remain crucial, especially because decisions in Chinese courts can still be bought or manipulated.
This pressure and increased domestic awareness may start to make a difference, but change is still likely to be very slow in coming.
