A Chinese flag hangs near a security camera outside of a shop in Beijing on October 8, 2019. The United States blacklisted a group of Chinese tech companies that develop facial recognition and other artificial intelligence technology that the US says is being used to repress China’s Muslim minority groups. Photo: AP
Outside In
by David Dodwell
Outside In
by David Dodwell

Is China a cybersecurity threat the US should lose sleep over?

  • A close reading of a report on cyber capabilities and national power raises questions about whether China really has the offensive aspirations that keep the US intelligence community awake at night, rather than a defensive obsession built on a century of turmoil at the hands of foreign powers
Over four decades of working as a journalist and researcher trying to understand and write about the development of China, you bump inevitably into spies and soldiers – a by-and-large paranoid community with a vested interest in seeing threats around every corner, and a material interest in encouraging more defence spending.

For most of this time, I took their claims with several bucketfuls of salt. Like early-evening mosquitos, you were always aware of them, but did not allow them to distract you from the main purpose of the evening.

Instead, I would put most of my trust in academics, economists and on-the-ground business leaders – not because these are eminently trustworthy or lacking personal or institutional agendas, but because when I asked them for evidence supporting their claims, they normally provided it.

Spooks and the military are different. Ask them for proof, and they say the evidence is classified, and tell me to trust them. As a journalist, thanks, but no thanks.


Pompeo warns of China threat as US and India sign defence pact

Pompeo warns of China threat as US and India sign defence pact
Things in recent years have begun to change, most markedly in the US, where intelligence and defence voices have moved from the margins, to the very epicentre of policymaking.
This shift is not just a matter of the missionary fervour around the Trump White House – though for sure, this was a factor.
It is closely linked with the development of the digital economy and the explosion of dual-use technologies, where digitally-empowered consumer products – ranging from mobile phones and drones to electronic devices around the home – have the potential to act as powerful intelligence-gatherers.

It is also closely linked to a realisation across the US military intelligence community that companies in potentially unfriendly countries like China were rapidly developing technological skills that were too close for comfort to the technological capabilities that had for decades ensured US economic and military leadership across the world.

It did not matter, for example, whether the Chinese military were using “back doors” in Huawei Technologies equipment to spy on people. The simple fact that there was potential for China’s military or intelligence services covertly to use them, was enough to raise alarm.

To the paranoid souls in the intelligence world, the absence of evidence was not evidence of absence. It might just mean that the Chinese were being smart at covering things up.


Can Huawei's Harmony OS for smartphones compete with Google's Android and Apple's iOS?

Can Huawei's Harmony OS for smartphones compete with Google's Android and Apple's iOS?

At the heart of this shift is a recognition that to be a superpower today, a country has to be a cyber-superpower, and that while the balance of military or economic power is clear to see and easy to calculate, the balance of cyber-power is not.

The result has been a surge in studies comparing the cyber-power of leading economies, and their potential to catch up with and challenge the US. Foremost is perhaps the UN’s International Telecommunication Union’s Global Cybersecurity Index, and the Cyber Power Index created at Harvard Kennedy School’s Belfer Centre.

Why US is so powerless against suspected Russian ransomware hackers

Equally thought-provoking is the report published this week by the Washington-based International Institute for Strategic Studies (IISS), assessing cyber capabilities and national power.

The good news for the White House in the IISS report is that “US digital-industrial superiority, including through alliance relations, is likely to endure for at least the next ten years”. The US has “clear superiority over all other countries in terms of its [information and communications technology] empowerment”, it says.

“What sets the US apart on offensive cyber is its ability to employ a sophisticated, surgical capability at scale,” the report says.

The IISS also argues that despite its cyber-superiority, the US is more likely to have been the victim of offensive cyberattacks than a perpetrator: “Arguably other countries have been making greater use of their cyber capabilities in order to exert power.” I suspect only a US think tank would make such an incautious claim.

A person delivers a computer payload while working on a laptop on January 22, 2019 in Lille, during the 11th International Cybersecurity Forum. Photo: AFP

Comparing a total of 15 countries with measurable cyber-power, the IISS report puts the US alone in “tier one”. In the second tier are Australia, Canada, China, France, Israel, Russia and the UK. In a third tier, the IISS groups seven further countries with potential: India, Indonesia, Iran, Japan, Malaysia, North Korea and Vietnam.

The report concludes that only China has the potential any time soon to rival the US in tier one. While China’s cyber-defences remain weak and its cyber-resilience still at early stages of development, the report points to strong cyber-operations abroad, intensive clandestine concentration on acquiring intellectual property, and state-of-the-art espionage.

It says China has “established the world’s most extensive cyber-enabled domestic surveillance and censorship system”, comprising over 200 million cameras nationwide under its “Skynet” network, and its “Sharp Eyes” focus on rural areas.

The IISS says it is not clear how comprehensive or effective this is. It observes that China’s intelligence efforts “are often characterised in terms of their volume rather than sophistication”.


Coronavirus: Chinese police wear smart helmets to check body temperature in crowds

Coronavirus: Chinese police wear smart helmets to check body temperature in crowds

While it says China has offensive cyber-capability, it emphasises that “from the outset, China’s main strategic preoccupation in cyberspace has been domestic – to prevent spread of Western liberal thinking via the internet”.

It notes how China’s leaders “see the security of the regime as constantly under threat”, and how they worry about the country’s reliance on technology dominated by the US’ “eight guardian warriors” – Apple, Cisco, Google, IBM, Intel, Microsoft, Oracle and Qualcomm.

China’s tech self-reliance push puts awards system for scientists under study

This raises questions, unanswered in the report, on whether China really does have the offensive aspirations that keep Washington’s intelligence community awake at night, rather than a defensive obsession built on a century of turmoil at the hands of numerous hegemonic foreign powers.

Intriguingly, it emphasises that the awesome pace at which the digital revolution is changing lives reflects how all countries are still in the earliest stages of understanding the strategic implications of cyberspace, and how complacency over cyber-superiority is extremely dangerous.


How China censors the internet

How China censors the internet

It also identifies an important paradox: “Any dependence on internet connectivity brings with it an inherent vulnerability, but it also brings the data, global reach and networking that empower twenty-first-century economies, statecraft and warfare.”

It rejects the idea that a state can protect itself against cyber-capable adversaries by trying to isolate itself from the global internet.

The report makes clear that the digital revolution has brought cybersecurity issues, and the spooks that obsess about them, irreversibly to the heart of future strategic policymaking. I may not like that, but I think I have to get used to it.

David Dodwell researches and writes about global, regional and Hong Kong challenges from a Hong Kong point of view