CHINA
- The UK Intelligence Community judge that their understanding of Chinese Computer Network Exploitation capability—for instance "how they use that to hack, to hack and leak, to manipulate, to manage their campaigns"—had *** since the National Cyber Security Centre (NCSC) was set up in 2016.[1] Western governments have, on the whole, been reticent about publicly attributing cyber attacks to China. However, in December 2018, the UK and US governments publicly attributed a series of major cyber attacks to the MSS,[2] ***[3]
- We question whether it is yet having a 'deterrent effect'. On 19 July 2021, the FCDO issued a press release that attributed another cyber attack to Chinese state-backed actors. The statement read:
The UK is joining likeminded partners to confirm that Chinese state-backed actors were responsible for gaining access to computer networks around the world via Microsoft Exchange servers. The Foreign Secretary condemned China, commenting: "The cyber attack on Microsoft Exchange Server by Chinese state-backed groups was a reckless but familiar pattern of behaviour. The Chinese Government must end this systematic cyber sabotage and can expect to be held account if it does not."[4]
- We asked GCHQ whether it viewed China's offensive cyber capabilities as a similarly significant threat and were told that China has offensive cyber capabilities ***.[5]
- The ChIS also have the capability to deploy what are known as close-proximity technical operations ***. This is offensive technical activity that requires physical access or proximity to a target, whether to gain access to premises (e.g. alarm defeats) or to acquire intelligence (e.g. eavesdropping, physical surveillance, cable-tapping or digital forensics).***[6] ***[7]
I. In terms of espionage, China's human intelligence collection is prolific, using a vast network of individuals embedded in local society to access individuals of interest—often identified through social media. It is also clear from the evidence we have seen that China routinely targets current and former UK civil servants ***. While there is good awareness of the danger posed, it is vital that vigilance is maintained.
J. In relation to the cyber approach, whilst understanding has clearly improved in recent years, China has a highly capable cyber—and increasingly sophisticated cyberespionage—operation: however, this is an area where the 'known unknowns' are concerning. Work on continuing coverage of its general capabilities must be maintained alongside further work on Chinese offensive cyber and close-proximity technical operations.
- ↑ Oral evidence—HMG, *** October 2020.
- ↑ 'UK and allies reveal global scale of Chinese cyber campaign', www.gov.uk/government/news/uk-and-allies-reveal-global-scale-of-chinese-cyber-campaign, 20 December 2018.
- ↑ Written evidence—HMG, 18 April 2019.
- ↑ 'UK and allies hold Chinese state responsible for a pervasive pattern of hacking', FCDO press release, 19 July 2021.
- ↑ Oral evidence—GCHQ, *** December 2020.
- ↑ Written evidence—HMG, 18 April 2019.
- ↑ Oral evidence—MI5, *** October 2020.
36
