The US Department of Justice indictment against a number of alleged Chinese military hackers goes back a long way, to 2006, and raises the question: why did it take them so long to take action?  In February 2013, a US security company called Mandiant released a report which said the Chinese army had launched hundreds of cyber-attacks against western companies and defence groups. It said that the attacks emanated from a building that housed a group called Unit 61398 –the same number that appears in the DOJ indictment.  If the DOJ indictments are correct, then Mandiant's report appears to have been accurate in its description of what was happening. But that's worrying, too: it described a decade-long series of attacks on US infrastructure, gave precise details, and even the location of the building from which it reckoned the attacks were being made.  If Mandiant, a private company, can come up with that sort of detail, what exactly has the US government been doing, with what must be better access to information? The DOJ indictment says that the investigation was carried out by the FBI – though it is hard not to think that there must have been some evidence supplied by other agencies such as the National Security Agency (NSA).  It's not as though the US government and its spy agencies have been unaware of the ambitions of what are believed to be Chinese state-sponsored hackers. In 2006, the new indictment alleges, Huang Zhenyu began "to perform programming work for SOE-2, including the creation of a “secret” database designed to hold corporate 'intelligence' about the iron and steel industries, including information about American companies."  But 2006 was notable for other events in the hacking realm. The US Pentagon and UK secret services had noticed Chinese computers accessing data on the Pentagon and the House of Commons, in an attack codenamed "Titan Rain", of which a specialist said the people behind it were "very clever programmers".  Titan Rain was only the start. According to security experts, state-sponsored individuals in China were hacking into systems belonging to all the biggest factories and companies, seeking industrial data and intellectual property. The difficulty with confirming the stories was that the companies were rarely willing to be named, and even if they were, they declined to discuss what might have been copied and spirited away.  In August 2010, the security company McAfee said that it had found evidence of a five-year hacking campaign it called "Shady Rat" targeting more than 70 government institutions, corporations and thinktanks. In February, it claimed that hackers in China had stolen information from oil companies in the US, Greece, Taiwan and Kazakhstan about bidding, financing and operations relating to oil fields.  In November 2011, allegations surfaced from the security company Symantec that Chinese hackers had targeted about 50 chemical- and military-linked companies between July and September 2010. It said "multiple" Fortune 100 companies were targeted – but, typically, was not allowed to name them.  The war of words between China and the US intensified; China has repeatedly insisted that hacking attacks are transnational, and the suggestion that just because a computer accesses another from China, that doesn't mean that the original attack comes from China, or that it is state-sponsored.  But in early 2013, after Facebook, Twitter, the New York Times, the Washington Post and the Wall Street Journal all said that they had been the targets of "highly sophisticated" attacks – in some cases focussing on correspondents writing about China – the temperature rose. (Google, the obvious big name missing from that set, had already suffered its own China-based hacking attack in December 2009; those hackers accessed its email system and tried to gain access to master passwords across the system. Google has never made clear quite how far they got, and it does not appear in the DOJ indictment as a cited victim.)  The DoJ indictment names Westinghouse Electric, SolarWorld, US Steel, Allegheny Technologies, and the US Service Workers union as victims of the hacking.  But China is not the only participant in state-sponsored hacking. As the Snowden revelations have made abundantly clear, the US and UK are active participants in the subversion of internet systems; the Stuxnet virus, which affected Iran's nuclear reprocessing facility, and the Flame virus, which used "world-class" cryptography methods, were both reckoned to have been the work of the US and at least one other nation.  The outstanding question is how the US will make the indictment enforceable. There is no extradition treaty between the US and China that would allow one of China's citizens to be remitted to the US for trial. Instead, the DoJ action may have opened a new form of cold war in which the two governments accuse each other of actions, which are denied, while both continue carrying them out against each other, and many more.
Department of Justice indictment confirms existence of projects such as 'Titan Rain' and pattern of attacks against US firms. By Charles Arthur