The White House Blamed China For Hacking Microsoft. China Is Pointing Fingers Back

BEIJING — China has accused the United States of mounting cyberattacks against Chinese government, scientific, aviation and other technical institutions for the past 11 years.

The finger-pointing comes the day after the U.S. mounted similar accusations against China, an exchange of blame which threatens to make cybersecurity another rift in an already-fractious U.S.-China relationship.

"Stop pouring dirty water," said Zhao Lijian, a Chinese foreign ministry spokesperson at a Tuesday press briefing, referring to the U.S. and its allies. He added these allegations are "borne out of nothing" and "solely serve the political purpose of smearing and suppressing [China]."

Zhao countered that the U.S. launches the greatest number of cyberattacks around the world each year, citing a 2020 report of Chinese internet security firm 360 that supposedly fingered the Central Intelligence Agency as the culprit behind the hackings of key Chinese companies and government institutions for more than a decade.

Beijing's accusations were part of a coordinated pushback against U.S. allegations that China is behind a cyberattack earlier this year that compromised tens of thousands of Microsoft Exchange email accounts.

China says it had no role in the Microsoft hack

A day earlier, the U.S. Justice Department also charged four Chinese citizens from China's secretive ministry of state security who are alleged to have hacked into the computer networks of dozens of companies, universities and government entities.

China quickly denied it was behind the Microsoft hack.

"The US has repeatedly made groundless attacks and malicious smear against China on cybersecurity," tweeted Liu Pengyu, the spokesperson for the Chinese embassy in Washington. He called the accusations "just another old trick, with nothing new in it."

This March, Microsoft reported that at least 30,000 customers were affected by a hack that allowed outsiders to access the firm's email and calendar service through a software loophole previously unknown to the company. Volexity, the cybersecurity firm that first discovered the Exchange breach, and Microsoft concluded the attacks originated from China and appeared to be state-sponsored.

The public accusations from the U.S. were timed to coincide with broader condemnation of cyberattacks coming out of China, through separate statements issued by NATO, the European Union, Australia, New Zealand and Japan – indicating a renewed focus under the Biden administration to curb Chinese hacking.

U.S. cybersecurity efforts have previously been principally focused on Russia, which both coordinates state-sponsored attacks and declines to prosecute cyber criminals, such as ransomware hackers who target Americans.

Most recently, hackers believed to be directed by Russian state intelligence were behind the SolarWinds cyberattack, by bugging the eponymous software used by numerous U.S. government agencies and major American firms.

"Malicious cyber activities that could potentially undermine the foundation of democracy embodied by free, fair and secure cyberspace cannot be condoned," foreign press secretary Tomoyuki Yoshida said in a statement, adding that Japan "strongly supports" corresponding statements from the U.S. and United Kingdom maligning Chinese-backed hacks.

China is working to strengthen its own safeguards

The Chinese foreign ministry offered no proof beyond the security report to back up its claims of CIA-sponsored hacking. But the allegations reflect the heightened concern among Chinese leaders that foreign powers, especially the U.S., could access and weaponize digital information from Chinese citizens.

Consequently, Chinese lawmakers have introduced new measures to safeguard the storage of and access to digital information generated within its borders. For example, a new data security law which takes effect this September restricts data operations deemed a national security risk.

Beijing is especially interested in protecting the massive troves of personal data the country's powerful private technology firms cull each day from millions of online users inside China. The country already requires multinational companies like Apple to store its Chinese users' iCloud data within China.

Most recently, Tesla has come under pressure from Chinese regulators who were concerned that the American company's battery-powered cars could utilize the hundreds of cameras and sensors arrayed on the vehicle for espionage. This April, Tesla said it would build a new data center in China to store data from vehicles sold on the mainland.

This month, newly-empowered regulators launched a sweeping investigation into Chinese ride-hailing platform Didi Chuxing only days after the company went public in New York, citing concerns that the platform could expose real-time location information and passenger records to American securities regulators.

China has also emerged as a formidable competitor alongside Russia in hacking, with state-directed hackers scooping up fast amounts of commercial intellectual property from American firms over the decades.

In 2013, then-president Barack Obama urged Chinese leader Xi Jinping to set up some "common rules of the road" to prevent digital theft. The two countries reached an agreement in 2015 that they would mitigate cyberattacks and investigate cyber crimes originating within their borders.

Three years later, the fragile truce had already ruptured, according to U.S. intelligence officials, who said China had lessened the number of cyberattacks against targets on US soil but had not stopped them altogether.

Amy Cheng contributed research from Beijing [Copyright 2021 NPR]