Arrests in China waved as a sign of criminal hack crackdown
Xinhua and the Washington Post are both running stories about arrests in China, which were made in September, relating to the massive OPM hack against the US Government earlier this year. The Post stresses that it is almost impossible to know whether the suspects are 'guilty parties' or have just been taken in for 'crimes against the state'. Ars Technica adds its weight to the debate, pointing out that the hack was a criminal event that it has a unique profile, in that none of the stolen data has actually been offered for sale: anywhere. Despite some claims by US authorities that China has not significantly "re-engaged" in cyber-espionage, commercial analysts continue to report new instances of cyber-attacks from Chinese hackers. Cyber security talks are ongoing during the Chinese officials’ US visit this week.

Update 12/3/15 2:15 ET: China has apparently made arrests in the case. The Washington Post reports that a group of hackers arrested by the Chinese government in September were in fact the people behind the OPM breach. The hackers were targeted based on intelligence provided by the US, and China had previously reported that Americans believed these hackers, whose identity has not been revealed, were involved in state-sponsored industrial espionage. It's not clear if the group was connected in some way to the Chinese military or had other government connections, but the arrests were made as part of the deal struck between the US and China in September. This led to President Obama dropping the threat of economic sanctions against China. (Our original story on the situation appears below.)

An official Chinese report claims that US and Chinese representatives "yielded positive outcomes" at the first meeting of a bilateral cyber security coordination group. The group was set up under the provisions of an agreement signed off on by President Barack Obama and Chinese President Xi Jinping in September. At the meeting in Washington, China acknowledged that the long-running penetration and theft of data from the systems of the Office of Personnel Management did originate from within China—but not from a state-sponsored attacker. "Through investigation, the case turned out to be a criminal case rather than a state-sponsored cyber attack as the US side has previously suspected," the report from China's Xinhaunet on the meeting claimed.

As part of the September agreement, China has pledged not to conduct economic espionage against the US. Last month, China joined the Group of 20 nations (the 20 most wealthy nations in the world) during the Ankara summit in pledging not to conduct any economic cyber-espionage against each other. Prior to these agreements, the Chinese leadership (and most of the other nations in the world) had not made any distinctions between economic espionage and spying on other governments.

Advertisement

The OPM hack's attribution to China had been previously denied by Chinese authorities. But the new claims that the attack (which lasted over a year and affected nearly 20 million people) was a criminal operation and not espionage runs counter to the usual patterns of such data thefts. None of the data stolen has yet been detected in use as part of financial fraud or other efforts criminals usually undertake to turn that data into cash. Still, while various sources have pointed to the sophistication of the attack on the OPM and how long it was able to be sustained, the attack used techniques that were within the capabilities of cybercriminals—relying on well-known vulnerabilities and taking advantage of vast material weaknesses in the OPM's network security that had been publicly cited by an Inspector General report.

The meeting of Chinese and US officials, chaired by US Secretary of Homeland Security Jeh Johnson, Attorney General Loretta Lynch, and China's State Councilor and Minister of Public Security Guo Shengkun, was the first "High-Level Joint Dialogue on Cybercrime and Related Issues" mentioned in the September accord. Guo promised that China would move forward with creating a way to collaborate with US law enforcement agencies on combating cyber crime based on "the principles of law-abiding, reciprocity, honesty, and pragmatism." The next meeting of the group will be held in Beijing in June of 2016.

At the conclusion of the meeting, according to a White House statement, Guo met with National Security Advisor Susan E. Rice and Assistant to the President for Homeland Security and Counterterrorism Lisa Monaco, who spoke with him "to underscore the importance of full adherence to the US-China cyber commitments made during President Xi’s September 2015 state visit."

There was no White House statement on China's claims that the OPM data theft was a criminal—and not state-sponsored—intrusion.