Gov't Report Finds Most U.S. Economic Cyber-Theft Originates in China, Russia

(This report is submitted in compliance with the Intelligence Authorization Act (P.L. 103-359), which requires that the President biennially submit to Congress updated information on the threat to U.S. industry from foreign economic collection and industrial espionage.)

The following are highlights of the report:

China, Russia Are Most Active Collectors of U.S. Economic Info & Technology

Many states view economic espionage as an essential tool in achieving national security and economic prosperity. Their economic espionage programs include computer network intrusions and exploitation of insider access to corporate and proprietary networks to develop information that could give these states a competitive edge over the U.S. and other rivals. Cyberspace makes it more difficult for victims and governments to assign blame by masking geographic locations: however, the report finds China and Russia are the most aggressive collectors of U.S. economic information and technology.

China. Chinese actors are the world’s most active and persistent perpetrators of economic espionage. China’s intelligence services, as well as private companies and other entities, frequently seek to exploit Chinese citizens or persons with family ties to China who can use their insider access to corporate networks to steal trade secrets using removable media devices or e-mail. Of the seven cases that were adjudicated under the Economic Espionage Act (EEA) in FY 2010, six involved a link to China. U.S. corporations and cyber security specialists also have reported an onslaught of computer network intrusions originating from Internet Protocol (IP) addresses in China. Some of these reports have alleged a Chinese corporate or government sponsor of the activity, but the Intelligence Community (IC) has not been able to attribute many of these private sector data breaches to a state sponsor.

Russia. Motivated by its high dependence on natural resources, the need to diversify its economy, and other factors, Russia's highly capable intelligence services are using human intelligence (HUMINT), cyber, and other operations to collect economic information and technology to support Russia’s economic development and security.

(The report states that other advanced industrial countries, including Germany, France, the United Kingdom, South Korea, and Japan, also principally blame China and Russia for economic espionage that results in large but uncertain monetary costs.)

U.S. Allies also Take Advantage of Access to Sensitive U.S. Data & Programs

Allies, or other countries with closer ties to the U.S. have conducted computer network exploitation (CNE) and other forms of intelligence collection to obtain U.S. economic and technology data, often taking advantage of the access they enjoy as allies or partners to collect sensitive military data and information on other programs.

Greatest Interest Expected in ICT, Natural Resources, Dual-Use Goods, Etc.

ONCIX expects foreign attempts to collect U.S. technological and economic information will continue at a high level and will represent a growing and persistent threat to U.S. economic security, with the governments of China and Russia remaining aggressive and capable collectors of sensitive U.S. economic information and technologies. Although foreign collectors will remain interested in all aspects of U.S. economic activity and technology, ONCIX judges that the greatest interest may be in the following areas:

• Information and communications technology (ICT), which forms the backbone of nearly every other technology.
• Business information that pertains to supplies of scarce natural resources or that provides foreign actors an edge in negotiations with U.S. businesses or the U.S. Government.
• Military technologies, particularly marine systems, unmanned aerial vehicles (UAVs), and other aerospace/aeronautic technologies.
• Civilian and dual-use technologies in sectors likely to experience fast growth, such as clean energy and health care/pharmaceuticals.

Report Provides Examples of Recent Thefts, Data Protection Best Practices, Etc.

The report also provides examples of recent thefts of corporate trade secrets with a link to China and Russia, examples of non-cyber methods of economic espionage, and a list of best practices in data protection strategies and due diligence for corporations. See report for full details.

ONCIX press release is available here. Full report is available here.

2009 report prepared for the U.S.-China Economic and Security Review Commission on China's capability to conduct cyber warfare is available here.