United States government exaggerations of Chinese cyber capabilities and Chinese policy backlash to those statements is causing a “rhetorical spiral of mistrust” in both countries that is more dangerous than any “digital Pearl Harbor,” according to a Harvard Belfar Center Policy Brief published this month and based on an earlier article in International Security.
Inflated threat perception in the U.S. and Chinese responses are increasing mistrust between both countries. Concurrently, despite Chinese cyber actions, the U.S. has a growing cyber advantage. The true dangers to the U.S. and China in the cyber domain are mistrust and changes to internet governance, said the author, Jon Lindsay, a researcher and professor from the University of California, San Diego.
“Fears about the paralysis of the United States’ digital infrastructure or the hemorrhage of its competitive advantage are exaggerated,” the brief said. American concerns about China’s cyber actions and capabilities do not appreciate organizational challenges China cyber operators face. These include information overload and bureaucratic compartmentalization.
China’s organizational issues hinder the weaponization of cyberspace and the absorption of stolen intellectual property, Lindsay said.
There is strong evidence China engages in cyber espionage against Western interests, but it also struggles to convert even legitimately-obtained foreign data into a competitive advantage. “China’s uneven industrial development, fragmented cyber defenses, erratic cyber tradecraft and the market dominance of U.S. technology firms provide considerable advantages to the United States,” the brief said.
The brief says China’s policy backlash to American exaggerations, taken against U.S. firms and liberal internet governance, should be a greater concern for American competitiveness than espionage alone. However, offensive cyber actions could escalate and be damaging during a crisis.
“The United States is unlikely to experience either a so-called digital Pearl Harbor through cyber warfare or death by a thousand cuts through industrial espionage,” the brief said. “There is, however, some danger of crisis miscalculation when states field cyberweapons.”
The secrecy of and uncertainty about the full effects of cyberweapons would likely send unclear signals to an adversary while also confusing allies, Lindsay said.
This could lead to unsuccessful preemptive cyberattacks that encourage retaliation with traditional weapons or preemptive cyber escalation under the thinking that one side should use cyberweapons before it is unable to do so (use it before you lose it).
“Bilateral dialogue is essential for reducing the risks of misperception between the United States and China in the event of a crisis,” the brief said.
Despite cyber crisis dangers, Lindsay stressed growing U.S. advantages in cyber capabilities vis a vis China.
“Much of the international cyber insecurity that China generates reflects internal security concerns,” Lindsay said. China targets political dissidents and minority populations using the national censorship architecture (the Great Firewall of China). This redirects inbound traffic to attack sites, like what happened with GitHub in March. However, prioritizing political information control over technical cyber defense damages China’s cybersecurity.
“Lax law enforcement and poor cyber defenses leave the country vulnerable to both cyber criminals and foreign spies,” the brief said. “The fragmented and notoriously competitive nature of the Communist Party state further complicates coordination across military, police, and regulatory entities.”
There is also little evidence of high skill in China’s military cyber operations, he said. While Chinese strategists talk about the asymmetrical and decisive nature of the cyber domain, Chinese military capacity does not live up to its objectives. A disrupting attack on physical infrastructure entails detailed testing, planning, and intelligence. “Even experienced U.S. cyber operators struggle with these challenges,” the brief said. “By contrast, the Chinese military is rigidly hierarchical and has no wartime experience with complex information systems.”
China is also emulating the American network-centric style of operations, which will increase its dependence on vulnerable networks and exposure to foreign cyberattack.
Conversely, “the internet reinforces U.S. dominance, but it does so through a light regulatory touch that relies on the self-interest of stakeholders—academic scientists, commercial engineers, government representatives, and civil society organizations.”
The internet currently expands through profit-driven networks and markets which “tends to reinforce the economic competitiveness of the United States and its leading information technology firms,” the brief explained.
The U.S. also conducts cyber espionage against China, which can indirectly help U.S. firms, like using the information during government trade negotiations. Lindsay said.
China is trying to counter the U.S. dominance in cyber while maintaining international connectivity that supports economic growth by pushing reform of internet governance. China, Russia, and other members of the Shanghai Cooperation Organization, advocated the use of a formal international regulator, like the United Nations’ International Telecommunications Union, to replace the present multi-stakeholder system with liberal norms of internet openness with a system called internet sovereignty, the brief said.
While Western observers fear this kind of reform would legitimize authoritarian control of the internet, “China, however, benefits too much from the current system to pose a credible alternative.” Internet governance debates are likely to lead to only mild changes at the margins, but Lindsay notes China is pushing for these changes while moving to exclude U.S. firms from its domestic markets.
“Exaggerated fears of cyberwarfare or an erosion of the United States’ competitive advantage must not be allowed to undermine the institutions and architectures that make the digital commons so productive,” Lindsay said.