Original subtitles

BEN: Two powers compete to dominate the global market.

We know foreign countries and companies

swipe our corporate secrets!

China breaks the rules in its quest to become

the world's economic superpower.

There's two types of companies left in the United States:

companies that have been hacked by China, and companies

that don't know they've been hacked by China yet.

Chinese hackers breach American corporations

under direct orders from Beijing.

This is oftentimes a military operation,

and you don't disobey orders in the military.

Billions of dollars worth of US trade secrets

are stolen every year.

The people behind the keyboard think they're anonymous,

and these charges show you are not.

What will it take to stop the theft?

♪

In July 2015,

the Washington-based US Office of Personnel Management

announced that the private records it kept

on more than 22 million American civil servants had been stolen.

The US government never formally blamed China, but plenty of

unnamed officials made the accusation in the press.

Bill Evanina is in charge of

combatting foreign intelligence threats for the US government.

I think the intelligence community feels pretty confident

- we feel - with who's involved, but I'm not quite sure

the administration has yet come out and identified

or attributed that data, but we're pretty confident

we know who is responsible.

What did they take?

What they stole, the perpetrators,

were the SF86s and SF85s, which are the standard forms

in which employees fill out to obtain security clearances.

On those forms had a lot of proprietary information

about you, who you live with, your social security number,

your date of birth, what schools you went to,

your employment history.

So a lot of significant personal identifiable information

that we consider very sensitive.

And how long will the intelligence community

in the United States be feeling the ramifications of this?

Ooh, I'm not sure we could put it in terms of years,

but I would say maybe decades.

I don't think this is anything that's going to be over

in a year or two.

I think the data that's on these forms

can be used to target US government employees

and contractors for many, many years.

- Were you personally... - Absolutely.

You were personally impacted by it?

Absolutely.

So I am one of the 22 million victims

that have been identified in the OPM intrusion.

So all my personal data, from when I filled out

my original form and subsequent background of investigations

that I've gone through, has been compromised.

How does that make you feel?

Like a victim.

Even though OPM was bad, it was classic espionage.

Most countries would do it given the chance.

But hacking US corporations

to make money off of their property is another story.

We've agreed that neither the US or the Chinese government

will conduct or knowingly support cyber-enabled theft

of intellectual property, including trade secrets

or other confidential business information,

for commercial advantage.

In addition, we'll work together and with other nations.

President Obama has reason to be concerned.

For years, Chinese hackers have been a problem for

American business, but most companies kept quiet about it.

And then Google broke the silence on their blog

in January 2010.

The American technology giant had been hacked,

and China was to blame.

But Google wasn't the only company targeted.

It was just the first one to go public.

A slew of other Fortune 500 corporations were also hacked

in an attack now known as Operation Aurora.

What was interesting about Operation Aurora

wasn't that it was some kind of new attack.

It was that it was the first time an American company

had had the courage to stand up and point the finger at China

and say, "We know you did this."

Nicole Perlroth is a cyber security reporter

for The New York Times, and she's written extensively

on Chinese hackers.

And Google, as open as they were about who had done it,

they've been relatively close-lipped about

what exactly was stolen.

But the word on the street is that the Chinese were actually

able to get a fair amount of Google's source code.

That source code could help Chinese hackers break into

Google's products, or to replicate them in the future.

What do we know about Chinese espionage?

We know that China has basically made it

a core part of its economic mission to stop being

the world's manufacturer and start innovating.

Every five years, you see a new industry

that China wants to excel at, and suddenly you just see

a rush of cyber attacks towards whatever industry

China has said that it wants to dominate in.

It's paint formulas.

It's Coca-Cola's negotiation strategies.

It's think tanks.

It's diplomats.

It's university professors.

It's law firms.

People have started to realize

that this actually has become a serious issue, or...?

I think it made people realize

that some of the most vibrant companies

in the United States were major targets, but I think

it took another 5 years for companies that thought,

"Why would we ever be the target

of a state-sponsored Chinese cyber attack?"

to wake up and say, "Oh shit, we've been a victim too!"

But how was everyone so sure

China was behind Operation Aurora?

I went to Washington to talk to Dmitri Alperovitch,

one of the first people to analyze the attack.

He worked with many of the companies who were affected.

So how was it done?

It was actually pretty ingenious.

So they actually identified people inside the organization

that they were able to approach,

and social engineer them to click on a link.

So you're talking about phishing emails with malware payloads.

That's right.

In some cases, it was actually an instant message,

not even an email, that once you click on that link,

your machine is compromised and the attackers take over.

And how did you figure out it was China?

Once we started tracking all the machines that were involved

in the compromise, and there were these multiple of machines

that were set up for command and control,

and where the connections into those machines were coming from,

we started to see signs that were pointing

to Chinese activity.

And later on, as we expanded the investigation,

we started to uncover other activity

that we were able to tie together to this group

that we now call Aurora Panda, a Chinese nation state group

that is really conducting, to this day, espionage activity

into numerous organizations, government agencies,

as well as private-sector organizations across the globe.

Operation Aurora offers a glimpse into how Chinese hackers

work within the country's government.

(Soldiers chanting)

And more specifically, its military branch:

the People's Liberation Army, otherwise known as the PLA.

With these type of actors, they get in and they wanna stay

as long as possible, because they have a collection priority.

And even if they get discovered and kicked out,

oftentimes they're back in or trying to get back in

the next day because they still have a mission to do, right?

This is oftentimes a military operation.

You have a PLA general that's coming to you as a soldier

in the PLA saying, "I need you to get this information for me

from this company."

And you don't stop because it's hard,

you don't stop because you've been discovered.

You keep on going because you were given a mission by your

boss to do so, and you don't disobey orders in the military.

And you need to achieve that objective.

Absolutely.

The hackers deployed malware

using an unfixed flaw in Internet Explorer.

This is a real spear phish

we detected in one of our customers.

So let's go to our victim machine down here.

I have an email that's arrived from a good friend of mine,

and there's a Word document attachment

that I want to take a look at.

So who wouldn't click on this?

I certainly would.

So we just had the connection from the victim show up here.

So this is our machine, our victim machine,

that we are able to take over.

I can go to this wonderful file manager,

which looks like just any file manager you would normally have.

So I literally can just highlight this and click

"Receive", and it sends it over to my machine.

That's as easy as it gets.

Operation Aurora showed that China was hacking some of

America's biggest companies, and many of the attacks

were attributed to hackers linked with

the People's Liberation Army.

If the Google hack and others like it

are state-sponsored, that means the Chinese government

is brashly stealing American intellectual property

with one hand while making new trade deals with the other.

The New York Times and Nicole Perlroth

paired with a cyber security firm, Mandiant, to track down

the physical location of some of the hackers.

And they found them in Shanghai

at a PLA unit known only as 61398.

We were able to trace thousands of attacks on US companies

and companies in Europe and universities

and research companies and think tanks

back to this one building in Shanghai.

And it was the first time a security firm had

publicly pointed to... not just to China,

but to a very specific unit of the PLA.

There weren't a lot of windows, but it was clear they had some

great satellite technology, and it was very well guarded.

But other than that, it was completely nondescript.

It was not as high-tech as Fort Mead,

but it was very clear this was actually a military compound.

To understand 61398, first you have to understand

the relationship between business, government,

and the military in China.

Melissa Chan worked in Beijing

as a correspondent for Al Jazeera for 5 years.

Her reporting on politically sensitive issues

got her kicked out of the country.

Did they give you a rough time when you were there?

They gave me and every foreign reporter a rough time.

We all thought the reporting environment in 2012

was pretty bad.

That was around the time when I left,

and it's just gotten worse according to foreign reporters

still based there.

What do you make of Obama making cybersecurity top of the list

when it comes to dealing with China?

I think it indicates how bad that situation is

with cyber espionage.

Every government has cyber espionage, right?

Including the United States.

You won't have an American intelligence officer meet with

a Fortune 500 company CEO and just hand over data,

and say, "Here, this is what we got from the Chinese."

But we do know that the Chinese do not see that differentiation.

I mean, the thing you have to understand about Chinese

companies, even publically traded companies that are owned

by private Chinese... you know, that were started by private

Chinese citizens, is that there's a corner office

somewhere where there's a Communist Party representative.

So the Communist Party's

never far away from any Chinese company.

There's always a connection to the government.

I spent months trying to speak with Chinese hackers.

When I finally came close, I was shut down at the last minute.

But I did get a glimpse through cybersecurity expert Ian Amit.

Amit met with Chinese hackers at a tech conference in China.

IAN: We went to what was called Excalibur Con.

A bunch of us - "us" is Western security professionals,

speakers, hackers, whatever it is - were invited to speak.

Were you ever offered to work for the Chinese government?

Yeah, yeah.

They just came out and asked you?

Pretty much, yeah.

What was your response?

No. (Laughing)

A very nice "no", but...

Yeah, they had us, you know... they even took us to a tour

in a business office building that was empty.

And you know, walked us around, showed us, you know,

"This can be your office.

Do you want the corner office?

How many people do you need working for you?"

And they're not talking about like five or six,

like, "Do you need 50, 60, 100?"

BEN: So this is the office you'd be given.

IAN: Yeah, and again, they built this in a year.

One year, everything.

Roads, residential...

Again, resources is not a problem.

You just have a lot of people build shit.

How do you gauge Chinese hackers compared to,

you know, let's say the NSA?

I would say the same rate, the same level.

Really?

If you assume any less of that, you're a fool.

Then why are they trying to poach American and Israeli...

More, more.

Having a diversity is key in cybersecurity.

A lot of times when you bring in people that are not necessarily

from your field of expertise, can...

can be a huge leverage in terms of your capabilities.

I would do the same.

I would try to recruit, I would try to tap into

whatever resources there are that I'm not aware of

that can enhance and enrich my capabilities.

If they're grooming their local cyber expertise in-house,

if I were on their end, I would try to do the same.

I would try to bring in a lot of outside perspective,

a lot of different thinking, different approach,

because that's the key,

especially in a game like cybersecurity.

You have to be adaptive, you have to be creative.

- For innovation. - Exactly, yeah.

Where the loss of American intellectual property

was once kept secret, by 2014

the Obama Administration was no longer silent.

For the first time, the Department of Justice charged

Chinese military hackers for breaking into US corporations.

Today, we are announcing an indictment against five officers

of the Chinese People's Liberation Army for serious

cybersecurity breaches against six American victim companies.

These represent the first ever charges

against known state actors for infiltrating

United States commercial targets.

The DOJ put five Chinese hackers on the FBI's Most Wanted list,

all of them officers in the PLA's 61398.

John Carlin tracks nation states infiltrating US corporations.

You'll see the activity from the location of this unit

of the PLA, 61398.

It starts around 9:00am, and you see the spike in activity.

You go to around lunch.

They get a little lunch break, and the activity goes down.

Then it resumes again until the end of the day.

And there seems to be roughly a 9-to-5...

- Government job. - A government job.

So we just can't...

it's not fair to American companies.

And what evidence did you have against them?

We showed specific actions on specific times on specific

dates, and photographs of the individuals as they went into

company systems from these dedicated hacker thieves

who are going in day in and day out to steal information.

But they are wearing PLA member uniforms.

If this is a nation state attack,

why single out individuals?

We're not charging a country for generically doing something bad.

We're proving up specific facts against particular people

by name, by date, here is what they did.

So in this case, we were able to figure out the name and the face

behind the keyboard.

And the reason why our companies are getting hammered day in

and day out by this type of theft is because

the people behind the keyboard think they're anonymous,

and these charges show you are not.

And the fact is just because you're wearing a uniform

shouldn't give you a free pass

when you commit that same type of theft.

China was stealing some of America's most precious intel,

the kind of trade secrets that keep economies growing.

For some companies, the results were devastating.

BEN: China has been targeting all sorts of American companies

for trade secrets.

Daniel McGahn is president of American Superconductor,

or AMSC.

The company specializes in power technologies

such as wind turbines and superconducting wire.

In an effort to protect against hacking,

they kept their valuable source code on an offline server.

But in 2011, one of McGahn's employees

took a $2 million bribe to hand over AMSC software code

to a state-owned company in China.

Welcome to the future!

The story really kind of falls out of a...

you know, a 1960s, 1970s vintage spy movie.

The individual was approached, the individual was turned,

there was offered money, home, women.

The way he was motivated was in the techniques of spy craft.

He had a penchant for writing everything down.

If you know Skype, he tended to use Skype to be able to

communicate and transfer files.

So we were able to basically obtain everything,

from motive to when the transfers happened,

who received them, and kind of the end part.

You know, ha ha ha, they won't need

American Superconductor anymore.

And what was the fallout?

The fallout was we had a stock that was at about $25,

and it went to $12.5 in a day.

So we went from about $1.5, $1.6 billion

to $800 million in evaluation in a day.

So the stock completely collapsed.

We know we're on a targeted list of a lot of companies

in North America, that the Chinese are looking to

obtain any valuable technology that they can.

So we've had to try to develop a capability

to protect such attacks.

So you're saying the People's Liberation Army

has targeted your company in hacking operations

to steal corporate secrets?

They've been happening since this event, and they've been

happening subsequently on a very regular basis.

What we've seen is when we've gone back and we've used

third parties to try to validate, you know,

where did these attacks come from,

and the entities that... at least that they're telling us

are directly linked to the PLA and China,

the People's Liberation Army, there is a move within China

to do this as part of kind of normal operation of business.

And do you think this is sort of a precursor to China

trying to overtake America economically?

I don't see it as a precursor; it's happening.

The desire is for China to be #1.

They have the largest population in the world.

Why shouldn't their economy be the largest?

Even after all this, would you still do business in China?

We still do.

We still see China as an opportunity,

but those products have to be paid for.

Customers pay.

To add insult to injury, a wind turbine that was built by China

and sold back to the US

was running on the stolen source code.

AMSC eventually replaced the turbine's controller

and software with their own tech.

Hoo!

So this is actually one of the controllers that was stolen?

Yes, yes.

So the software stolen,

and the actual programming of the turbine.

This turbine's close, but it's definitely different.

Oh my god!

Ho!

We are definitely 72 meters in the sky.

BEN: But it's not as if the US isn't spying

on Chinese corporations.

In 2014, Edward Snowden leaked a trove of

National Security Agency documents that revealed Huawei,

a Chinese telecom giant, was a US target.

And according to the German magazine Der Spiegel,

the NSA managed to access the source code of Huawei products

in order to tap communications of targets who use them.

But the US government says there's a difference

between traditional espionage

and stealing trade secrets for profit.

So the administration is still holding out

the threat of sanctions.

Do you think sanctions and diplomatic ploys,

do you think that'll really work?

It will work because look at what they're stealing here.

In one case that we charged, they were stealing the formula

for the colour white.

That is not a national security secret.

They are stealing that so that they can compete and make paint,

white paint that people think is popular.

That's all driven by profit.

This is a cost-benefit game.

As long as they think it's cost-free to steal

this information, they're going to continue to do it.

And we need to keep raising the costs

until the behaviour changes.

With the help of stolen American-made IP,

China has set it's sights on overtaking the US

as the #1 economic superpower in the world.

If we could put a dollar value on all this hacking

against corporate America, what would it be?

It's impossible at this point.

People have tried.

The former commander of Cyber Command

has put it in the trillions.

There's just... How do you put a price on intellectual property?

And is this just the beginning?

Or what's the future hold for corporate America?

I think it's a question of is it too late?

Has the IP already left the building?

And if it has, are we going to suddenly see carbon copies

of Benjamin Moore and Coca-Cola and Lockheed Martin

pop up in China over the next 10 years?

And the next chapter is: when are we going to see China

really using our own intellectual property

to their economic advantage?

And I don't even think we've seen the beginning of that yet.

It's tough to know what's next

when China keeps such tight control on their hackers,

and almost no information leaks out of the country.

But it's also hard to believe

that the sophisticated cyber force of a rising superpower

will suddenly just change its MO because America said so.

♪