F is for
fraud, 1 is for You
Tsunami of Global Crime
The idea of a conquering barbarian
horde has haunted European nightmares at least since the Mongol invasion of
Eastern Europe. More recently, the term has been used to satirize those who
exaggerate threats hypothetically emanating from Asia. Since the 1970s
Nixon-Mao rapprochement, many Americans and Europeans and sympathise with the
Chinese notion of a "peaceful rise."
However recently, politicians and security chiefs have begun to warn of a tsunami of cyber espionage and cyber theft of intellectual property by ghostly Chinese hackers. The theft was described by one security chief as "the greatest transfer of wealth in history."
US President Barack Obama recently spoke of the need to strengthen US defenses against this threat, citing a figure of US$1 trillion stolen annually by hackers. Supposedly the reason we are not being flooded by news of hacker break-ins and thefts of all kinds is that most of the information is either classified, or in the case of private companies, they don't want to admit that they have been the victim of these crimes.
"What's reported is just the tip of the iceberg," said one US government cyber sleuth recently. "I’ve been circling the iceberg in a submarine. This is the biggest vacuuming up of US proprietary data that we’ve ever seen. It’s a machine.”
Said another security expert, "The activity we’re seeing now is the tremor, but the earthquake is coming." UK intelligence chiefs have made similar claims.
Cyber Hype?
But others have also questioned whether China is the source of this crime wave, because IP addresses can be spoofed. Others claim the figures are exaggerated. They suggest that security forces are hyping the problem to get additional funding, or worse, to strengthen their powers of surveillance and supervision over our own Internet.
Remember the failures of intelligence in the run-up to the invasion of Iraq? Why should we trust them again? What should we make of their claims? Are our offices and companies really being so thoroughly stripped of their intellectual property? Are hackers really turning off our electric power grids, as was also recently claimed? Do the data networks installed in many countries by Chinese companies such as Huaiwei allow the Chinese government to eavesdrop on everything we say?
Without a degree in computer science and clearance for classified information, it is tempting to just shrug one's shoulders and say we really haven't got a clue.
One of the recent reports on Chinese cyber espionage, released by the now-defunct Information War Monitor group, is titled Shadow in the Cloud and describes an organized hacking network called Ghost Net, It's all about shadows, ghosts, mist and fog, and very hard to be sure of anything at all.
But if it's true that we are being robbed blind, this is too important a subject for us to not make a few intelligence guesses. In fact we don't need to be a black belt hacker or work in the CIA to figure out what's going on, the answer is just a few googles away.
More People, More Hackers
In fact it would be strange if we were not being overrun by hordes of Chinese hackers due to the enormous size of the Chinese Internet population which has been growing like the peach in the garden over the last few years. China's online population is already approaching 600 million, equivalent to that of the US and Western Europe combined. More people online means more hackers, it's as simple as that.
As the Beijing police once said to me after I reported the pickpocketing of my wallet, "There are thieves in your country too." We don't have to get into criminology surveys, which are almost as murky as cyber warfare investigations. Let's just assume that China is a country with an average number of hackers, say one for every 10,000 Netizens. In the last five years, China's online population has tripled and an extra 400 million people have gone online. An extra 400 million people online means an additional 40,000 hackers.
That's a lot of extra hackers. And a hacker is not like a traditional burglar, who can only rob one householder at a time, because hacking is automated these days by software suites which can scan websites or web servers for vulnerabilities in just a few seconds. They send hundreds of thousands of e-mails per day, each containing a link to a malware program, which when clicked installs a Trojan horse on the user's computer, which can then be used by the hacker to turn it into a slave node in his network.
After this, he (or she) can control everything on the computer, such as turning off antivirus software, downloading files and contact lists, which in turn can be used to send more virus laden e-mail. In fact, the most effective attack is an e-mail supposedly from a friend or colleague about a subject we're interested in, and our interests can be discerned quite easily once the hacker has access to our whole computer.
But I'm getting sidetracked into the technical side of things, which I want to avoid, because I don't think is necessary to understand all this geeky stuff in order to measure the size of the Chinese hacking wave
Virtual Pickpocketing
So having established that the tsunami of hacking from China is inevitable and to be expected, we are entitled to ask whether this will just be an average size tsunami, as we might expect if the online population of a country with average levels of cyber crime suddenly expanded by 300,000,000, or something bigger or smaller.
I think that wave is a gigantic tsunami rather than an average or pygmy sized one, because in the off-line world, China suffers from endemic stealth crime, i.e. pickpocketing and theft. To support this view, I can only fall back on my own experience of Chinese crime and cyber crime, for what it's worth, which I admit is not very much in terms of a scientific sample.
I have lived for a total of about five years in China, and have frequently been robbed in traditional ways; I have had my wallet pickpocketed, I have had my cellphone, laptop and three cameras removed, all while I was distracted for a split-second.
I have never been mugged at knifepoint or gunpoint or physically assaulted in China, as I have in Europe and South America. I surmise that this kind of theft is rather common in China; silent theft of the kind which you only notice after the thief has disappeared, if you notice at all. And many Internet commentators theorize that what we do in the real world, we tend to replicate in our online world.
And I know from personal experience that the Chinese police have already adopted hacking techniques. My computer was hacked two years ago, either by Chinese police or people working closely with them. They had arrested a Chinese dissident friend, confiscated his computer and then sent everyone on his mailing list an e-mail purporting to be from him, with a link to a blog about his latest detention.
Overcome with curiosity, I clicked the link and I discovered a few days later that I had installed a Trojan horse on my computer. I don't know how much of my personal data was downloaded.
Secondly, I think we need to face the fact that an awful lot of Chinese people don't like us, and would like to get even by hacking into our governments or companies. By us I mean the United States and its allies. Which is not to say that many of them do like us as well; it's just that there is a large number of angry young men who buy into the patriotic discourse of a victimized China which is being deliberately usurped by Western powers.
One of the main themes of CPC propaganda is that China is under siege from these hostile Western powers, who use dissidents as pawns and promote human rights in order to overthrow China's government. Didn't you know that the 1989 democracy movement was blocked by the CIA to overthrow the Chinese government? That's why when 911 happened, there were scenes of jubilation and rejoicing throughout China. Of course that was over a decade ago, but if you log on to the popular Chinese online forums such as Strong Nation or Blood and Iron, you will find much the same sentiments being expressed every day.
So we have this big country, with hundreds of millions of people online for the first time, many of them angry and resentful of both Western governments and Western companies, which they tend to see as working hand in glove. Added to this is the widening wealth gap, which tends everywhere to fuel crime. And hacking is cheap fun which is suitable for the legions of young people who are trying to get by on US$2-300 per month. Is it surprising then that we have an epidemic of cyber burglary?
But hang on, haven't we forgotten something, after all isn't China's supposed to be a totalitarian state where the Internet is used spy on everybody and journalists or dissidents are arrested and imprisoned for posting opinions online? If China is that controlled, surely there cannot be so much hacking allowed? This is one of the major misconceptions of Westerners who only know about China through the Western media.
Surprisingly Free Country
The Western media tends to focus on certain issues in its reporting of China, one of which is human rights abuses. Exposed to other constant stream of such reports, Westerners get the impression that China is a police state like Orwell's 1984. And in some ways they are right. In Orwell's dystopia. common criminals are treated better than political dissidents. But in other ways China departs from 1984, because people have a degree of freedom to do what they want which is hard to imagine in Western countries, where citizens are brought up to respect the rule of law. That kind of respect is still a novelty in China. For example, recently, the Chinese government banned smoking in public places, but nobody took any notice. Restaurants still distributed ashtrays.
There are almost endless examples of lawlessness. I remember in the 1990s seeing motorcycles and even cars driving on the sidewalks. When I enquired why they did this despite the obvious danger to pedestrians, they told me it was because they did not have a driving licence and thus could not take the risk of riding the highway.
One of the most common complaints of political commentators in China is that Chinese citizens no longer have any sense of morality. Traditional Confucian and Buddhist morality was largely swept aside by socialism in the first years after the Communists took power, but that has now effectively been abandoned, leaving only greed and materialism.
Thieving by Remote Control
There's a common colloquial expression in Chinese, "Rabbits don't eat the grass around the burrow.” Thanks to the Internet, new job creation opportunities have emerged that allow young thieves to work remotely. From the perspective of the Chinese authorities, China's international hacking is actually a domestic crime reduction program.
It's obviously not a priority for the Chinese police to crack down this, it is not even near the top of their priorities list. That would be cracking down on organ smugglers, people traffickers, drug traffickers and fake drug manufacturers, poisonous food and drink manufacturers, large-scale industrial polluters-the list goes on.
The Chinese state seems to have already given up on most of these battles, which are much more important to its survival. It has lost control of the skies, the rivers, and food production, all of which are hopelessly contaminated with toxins. Why would they crack down on a group of harmless hackers, when they don't have what it takes to combat these much greater evils?
And after all, the hackers are harmless, at least as long as they don't target the Chinese government, and I don't think we would hear from them for very long if they did that. In fact more than harmless, amateur hackers provide a good recruiting ground for the professional cyber warfare battalions of the PLA. Besides, the transfer of intellectual property by traditional means has a long history in China, whether it be private enterprise which knocks off copies of branded Western goods for sale to tourists in downtown Shanghai shopping malls, or the government, which recently copied high-speed train technology from Germany.
And finally, having retreated to the refuge of patriotism after abandoning socialist rhetoric in the 1990s, the party state relies on these nationalists as its main supporters, and doesn't want to annoy them any more than you or I want to poke a stick at a wasp's nest at the end of the garden.
Amateurs or Professionals?
Western journalists often ask a related question; is the Chinese hacking organized by the government, autonomous groups and individuals, or an alliance of both? Of course there's really no way of answering this question fully. We know that China's military has both electronic warfare and cyber espionage capabilities, just as other armies do. And we can be pretty sure that not every hacker in China is working for the PLA, after all some of them are too young to join up or prefer to work from home in their slippers. But what we can be sure of is that the Chinese government is not doing much to stop this wave of cyber crime.
And we know that they have the ability. They roundup political dissidents pretty quickly every time the politburo sneezes. It's pretty easy for them to keep track on people nowadays when everybody has a cellphone.
Beware the Golden Cyber Horde
So in summary, the Chinese police are not going to crack down vigorously on international hackers, although they might slap a few on the wrist from time to time for the sake of appearances. And the hacking wave from China is just beginning, the netizen population there is still growing fast, with a new wave of smart cellphones likely to double the number of Internet connected devices in the next five years. Network connections will inevitably get faster and as computers spread deeper into our lives in the West, we are exposing an ever larger software and hardware surface area to the potential attacker.
And hackers are learning fast; there are a lot of smart people in China; remember that China tops the world in high school maths and China's Huaiwei is now the world's biggest network company. Make no mistake about it, the invasion of the Golden cyber Horde is just beginning.
(Stephen Thompson is a Hong Kong-based Sinologist and writer under the name 唐肆啼 for Open Magazine, (open.com.hk), a dissident monthly magazine published in Hong Kong)
However recently, politicians and security chiefs have begun to warn of a tsunami of cyber espionage and cyber theft of intellectual property by ghostly Chinese hackers. The theft was described by one security chief as "the greatest transfer of wealth in history."
US President Barack Obama recently spoke of the need to strengthen US defenses against this threat, citing a figure of US$1 trillion stolen annually by hackers. Supposedly the reason we are not being flooded by news of hacker break-ins and thefts of all kinds is that most of the information is either classified, or in the case of private companies, they don't want to admit that they have been the victim of these crimes.
"What's reported is just the tip of the iceberg," said one US government cyber sleuth recently. "I’ve been circling the iceberg in a submarine. This is the biggest vacuuming up of US proprietary data that we’ve ever seen. It’s a machine.”
Said another security expert, "The activity we’re seeing now is the tremor, but the earthquake is coming." UK intelligence chiefs have made similar claims.
Cyber Hype?
But others have also questioned whether China is the source of this crime wave, because IP addresses can be spoofed. Others claim the figures are exaggerated. They suggest that security forces are hyping the problem to get additional funding, or worse, to strengthen their powers of surveillance and supervision over our own Internet.
Remember the failures of intelligence in the run-up to the invasion of Iraq? Why should we trust them again? What should we make of their claims? Are our offices and companies really being so thoroughly stripped of their intellectual property? Are hackers really turning off our electric power grids, as was also recently claimed? Do the data networks installed in many countries by Chinese companies such as Huaiwei allow the Chinese government to eavesdrop on everything we say?
Without a degree in computer science and clearance for classified information, it is tempting to just shrug one's shoulders and say we really haven't got a clue.
One of the recent reports on Chinese cyber espionage, released by the now-defunct Information War Monitor group, is titled Shadow in the Cloud and describes an organized hacking network called Ghost Net, It's all about shadows, ghosts, mist and fog, and very hard to be sure of anything at all.
But if it's true that we are being robbed blind, this is too important a subject for us to not make a few intelligence guesses. In fact we don't need to be a black belt hacker or work in the CIA to figure out what's going on, the answer is just a few googles away.
More People, More Hackers
In fact it would be strange if we were not being overrun by hordes of Chinese hackers due to the enormous size of the Chinese Internet population which has been growing like the peach in the garden over the last few years. China's online population is already approaching 600 million, equivalent to that of the US and Western Europe combined. More people online means more hackers, it's as simple as that.
As the Beijing police once said to me after I reported the pickpocketing of my wallet, "There are thieves in your country too." We don't have to get into criminology surveys, which are almost as murky as cyber warfare investigations. Let's just assume that China is a country with an average number of hackers, say one for every 10,000 Netizens. In the last five years, China's online population has tripled and an extra 400 million people have gone online. An extra 400 million people online means an additional 40,000 hackers.
That's a lot of extra hackers. And a hacker is not like a traditional burglar, who can only rob one householder at a time, because hacking is automated these days by software suites which can scan websites or web servers for vulnerabilities in just a few seconds. They send hundreds of thousands of e-mails per day, each containing a link to a malware program, which when clicked installs a Trojan horse on the user's computer, which can then be used by the hacker to turn it into a slave node in his network.
After this, he (or she) can control everything on the computer, such as turning off antivirus software, downloading files and contact lists, which in turn can be used to send more virus laden e-mail. In fact, the most effective attack is an e-mail supposedly from a friend or colleague about a subject we're interested in, and our interests can be discerned quite easily once the hacker has access to our whole computer.
But I'm getting sidetracked into the technical side of things, which I want to avoid, because I don't think is necessary to understand all this geeky stuff in order to measure the size of the Chinese hacking wave
Virtual Pickpocketing
So having established that the tsunami of hacking from China is inevitable and to be expected, we are entitled to ask whether this will just be an average size tsunami, as we might expect if the online population of a country with average levels of cyber crime suddenly expanded by 300,000,000, or something bigger or smaller.
I think that wave is a gigantic tsunami rather than an average or pygmy sized one, because in the off-line world, China suffers from endemic stealth crime, i.e. pickpocketing and theft. To support this view, I can only fall back on my own experience of Chinese crime and cyber crime, for what it's worth, which I admit is not very much in terms of a scientific sample.
I have lived for a total of about five years in China, and have frequently been robbed in traditional ways; I have had my wallet pickpocketed, I have had my cellphone, laptop and three cameras removed, all while I was distracted for a split-second.
I have never been mugged at knifepoint or gunpoint or physically assaulted in China, as I have in Europe and South America. I surmise that this kind of theft is rather common in China; silent theft of the kind which you only notice after the thief has disappeared, if you notice at all. And many Internet commentators theorize that what we do in the real world, we tend to replicate in our online world.
And I know from personal experience that the Chinese police have already adopted hacking techniques. My computer was hacked two years ago, either by Chinese police or people working closely with them. They had arrested a Chinese dissident friend, confiscated his computer and then sent everyone on his mailing list an e-mail purporting to be from him, with a link to a blog about his latest detention.
Overcome with curiosity, I clicked the link and I discovered a few days later that I had installed a Trojan horse on my computer. I don't know how much of my personal data was downloaded.
Secondly, I think we need to face the fact that an awful lot of Chinese people don't like us, and would like to get even by hacking into our governments or companies. By us I mean the United States and its allies. Which is not to say that many of them do like us as well; it's just that there is a large number of angry young men who buy into the patriotic discourse of a victimized China which is being deliberately usurped by Western powers.
One of the main themes of CPC propaganda is that China is under siege from these hostile Western powers, who use dissidents as pawns and promote human rights in order to overthrow China's government. Didn't you know that the 1989 democracy movement was blocked by the CIA to overthrow the Chinese government? That's why when 911 happened, there were scenes of jubilation and rejoicing throughout China. Of course that was over a decade ago, but if you log on to the popular Chinese online forums such as Strong Nation or Blood and Iron, you will find much the same sentiments being expressed every day.
So we have this big country, with hundreds of millions of people online for the first time, many of them angry and resentful of both Western governments and Western companies, which they tend to see as working hand in glove. Added to this is the widening wealth gap, which tends everywhere to fuel crime. And hacking is cheap fun which is suitable for the legions of young people who are trying to get by on US$2-300 per month. Is it surprising then that we have an epidemic of cyber burglary?
But hang on, haven't we forgotten something, after all isn't China's supposed to be a totalitarian state where the Internet is used spy on everybody and journalists or dissidents are arrested and imprisoned for posting opinions online? If China is that controlled, surely there cannot be so much hacking allowed? This is one of the major misconceptions of Westerners who only know about China through the Western media.
Surprisingly Free Country
The Western media tends to focus on certain issues in its reporting of China, one of which is human rights abuses. Exposed to other constant stream of such reports, Westerners get the impression that China is a police state like Orwell's 1984. And in some ways they are right. In Orwell's dystopia. common criminals are treated better than political dissidents. But in other ways China departs from 1984, because people have a degree of freedom to do what they want which is hard to imagine in Western countries, where citizens are brought up to respect the rule of law. That kind of respect is still a novelty in China. For example, recently, the Chinese government banned smoking in public places, but nobody took any notice. Restaurants still distributed ashtrays.
There are almost endless examples of lawlessness. I remember in the 1990s seeing motorcycles and even cars driving on the sidewalks. When I enquired why they did this despite the obvious danger to pedestrians, they told me it was because they did not have a driving licence and thus could not take the risk of riding the highway.
One of the most common complaints of political commentators in China is that Chinese citizens no longer have any sense of morality. Traditional Confucian and Buddhist morality was largely swept aside by socialism in the first years after the Communists took power, but that has now effectively been abandoned, leaving only greed and materialism.
Thieving by Remote Control
There's a common colloquial expression in Chinese, "Rabbits don't eat the grass around the burrow.” Thanks to the Internet, new job creation opportunities have emerged that allow young thieves to work remotely. From the perspective of the Chinese authorities, China's international hacking is actually a domestic crime reduction program.
It's obviously not a priority for the Chinese police to crack down this, it is not even near the top of their priorities list. That would be cracking down on organ smugglers, people traffickers, drug traffickers and fake drug manufacturers, poisonous food and drink manufacturers, large-scale industrial polluters-the list goes on.
The Chinese state seems to have already given up on most of these battles, which are much more important to its survival. It has lost control of the skies, the rivers, and food production, all of which are hopelessly contaminated with toxins. Why would they crack down on a group of harmless hackers, when they don't have what it takes to combat these much greater evils?
And after all, the hackers are harmless, at least as long as they don't target the Chinese government, and I don't think we would hear from them for very long if they did that. In fact more than harmless, amateur hackers provide a good recruiting ground for the professional cyber warfare battalions of the PLA. Besides, the transfer of intellectual property by traditional means has a long history in China, whether it be private enterprise which knocks off copies of branded Western goods for sale to tourists in downtown Shanghai shopping malls, or the government, which recently copied high-speed train technology from Germany.
And finally, having retreated to the refuge of patriotism after abandoning socialist rhetoric in the 1990s, the party state relies on these nationalists as its main supporters, and doesn't want to annoy them any more than you or I want to poke a stick at a wasp's nest at the end of the garden.
Amateurs or Professionals?
Western journalists often ask a related question; is the Chinese hacking organized by the government, autonomous groups and individuals, or an alliance of both? Of course there's really no way of answering this question fully. We know that China's military has both electronic warfare and cyber espionage capabilities, just as other armies do. And we can be pretty sure that not every hacker in China is working for the PLA, after all some of them are too young to join up or prefer to work from home in their slippers. But what we can be sure of is that the Chinese government is not doing much to stop this wave of cyber crime.
And we know that they have the ability. They roundup political dissidents pretty quickly every time the politburo sneezes. It's pretty easy for them to keep track on people nowadays when everybody has a cellphone.
Beware the Golden Cyber Horde
So in summary, the Chinese police are not going to crack down vigorously on international hackers, although they might slap a few on the wrist from time to time for the sake of appearances. And the hacking wave from China is just beginning, the netizen population there is still growing fast, with a new wave of smart cellphones likely to double the number of Internet connected devices in the next five years. Network connections will inevitably get faster and as computers spread deeper into our lives in the West, we are exposing an ever larger software and hardware surface area to the potential attacker.
And hackers are learning fast; there are a lot of smart people in China; remember that China tops the world in high school maths and China's Huaiwei is now the world's biggest network company. Make no mistake about it, the invasion of the Golden cyber Horde is just beginning.
(Stephen Thompson is a Hong Kong-based Sinologist and writer under the name 唐肆啼 for Open Magazine, (open.com.hk), a dissident monthly magazine published in Hong Kong)
No comments:
Post a Comment