The U.S. Senate Armed Services Committee said a yearlong investigation found hackers associated with the Chinese government successfully penetrated the computer systems of the U.S. Transportation Command (TRANSCOM) at least 20 times.
The allegations made public Wednesday come just four months after five Chinese military hackers were indicted for the theft of corporate secrets.
The 52-page Senate report covers a one-year period from June 1, 2012, to May 30, 2013, and found about 50 intrusions into civilian contractors of TRANSCOM, which is responsible for moving U.S. troops and military equipment around the world.
At least 20 of those intrusions were deemed successful and considered an "advanced persistent threat (APT)," or sophisticated enough to be associated with foreign governments.
'Aggressive actions'
Committee chairman Senator Carl Levin of Michigan said these intrusions "are more evidence of China’s aggressive actions in cyberspace."
Levin said the findings "are a warning that we must do more to protect strategically significant systems from attack."
The report found that an intrusion into a TRANSCOM contractor between 2008 and 2010 compromised e-mail, documents, user passwords and computer codes.
A 2010 intrusion resulted in stolen documents, flight details, credentials and passwords for encrypted e-mail.
And a 2012 intrusion centered on a commercial ship contracted by TRANSCOM.
All were said to have been carried out by the Chinese military.
Carl Baker of the Hawaii-based Pacific Forum think tank said China has an interest in the logistical prowess of the U.S. military.
"What they’re interested in is to see how the United States does global logistics because that’s an interesting topic for someone who sees themselves as becoming the next great superpower,” Baker said. “They see that they have an interest in being able to coordinate global logistics like the United States military does. And so, I think that’s indicative of what I think we’re seeing from the Chinese that they see themselves as sort of the heir apparent to the global power that the United States is today."
Military/civil fusion
RAND Corporation China analyst Scott Harold said the Chinese have been investing heavily in what they call military/civil fusion, or civil/military integration - “trying to find ways to improve the PLA’s (People’s Liberation Army) capabilities by leveraging other abilities that are resident in the Chinese civilian economy."
Harold said this case may have to do with China’s effort to improve its own capabilities and sees civilian contractors as having fewer defenses against cyber attacks.
Denny Roy, a senior fellow at the Hawaii-based East-West Institute, said cyber espionage remains a large and deteriorating problem in bilateral relations.
Roy said government-sponsored cyber theft of industrial information on a massive scale is unique to China. He called it a low-level act of war.
In May, the Justice Department unsealed indictments against five People’s Liberation Army personnel charging them with hacking into the networks of Westinghouse Electric, U.S. Steel Corporation and other companies.
U.S. law enforcement and intelligence agencies tracked the activities of the hackers to a military installation near the Shanghai airport.
That prompted China to suspend its involvement in a cybersecurity working group with the United States.
Beijing called the indictments a "serious violation of the basic norms of international relations." China has accused the United States of hypocrisy following revelations of U.S. cyber activity by the website WikiLeaks and former intelligence contractor Edward Snowden.
Aggressive hacking behavior
William Martel, a Tufts University International Security Studies associate professor, said many governments are engaging in more aggressive behavior in hacking into government and private sector facilities.
"This is an increasingly common phenomenon, and it’s one that I think really puts at risk a lot of the things that we do in the national security sense and in overall economic and technological security," Martel said.
He said he is concerned the U.S. military remains vulnerable to such attacks.
"What you worry about is an organization or a group that has the capability that surprises you, particularly at a time when you have, as we do, have military operations and activities going on on a global scale,” Martel said. “This is potentially dangerous, worse if you’re involved in a war and all of a sudden you start having difficulties with logistics or other capabilities. That would be very painful."
Martel said what is needed is an international code of conduct on cyber for states, firms and individuals.
As for the impact on U.S.-China relations, author, lawyer and China analyst Gordon Chang said it won’t amount to much.
"I mean there have been so many intrusions by Chinese hackers over the past two decades that this one is just another drop in the bucket,” Chang said.
“Unfortunately, at this point, the United States is still not willing to have a serious conversation with the Chinese, and by that I mean the United States is not willing to impose real costs on China for these unprecedented series of hacking attempts and successful intrusions into US networks,” he said.
Cost of cyber espionage
Chang said such cyber espionage may be costing the United States hundreds of billions of dollars and it may be time to retaliate, perhaps imposing tariffs on some Chinese exports.
Roy, of the East-West Institute, said the only policy solutions are either the United States reacting in kind or it reduces the Internet connectivity of defense systems, thus sacrificing convenience for security.
Meanwhile, former U.S. Army officer Benjamin Pierce Bishop, 59, who served as a civilian contractor at U.S. Pacific Command, was sentenced Wednesday to more than seven years in prison for passing national defense secrets to his Chinese girlfriend and illegally keeping numerous classified documents at his home.
He was indicted last year and pleaded guilty to the charges in March.
