In July, the United States, the North Atlantic Treaty Organization (NATO), the European Union (EU), and other allies attributed a variety of malicious cyber activities, including the Microsoft Exchange hack, to China. This joint attribution builds on commitments made in June summits with NATO, the G7, the EU, and the United Kingdom, and is consistent with the Biden administration's multilateral approach to confronting cybersecurity threats and China more generally. Still, critics question whether the administration's efforts will succeed in altering the behavior of states that pose cybersecurity threats to the United States.
Over the past few years, the United States has repeatedly accused China of responsibility for cyber intrusions, beginning with a focus on intellectual property theft. In 2015, the U.S. Department of Justice indicted five members of China's People's Liberation Army (PLA) for stealing trade secrets from six U.S. companies including Westinghouse, Alcoa, and U.S. Steel.Footnote 1 Later that year, President Barack Obama and Chinese President Xi Jinping announced a deal to refrain from “conduct[ing] or knowingly support[ing] cyber-enabled theft of intellectual property . . . for commercial advantage” and to “promote international rules of the road for appropriate conduct in cyberspace.”Footnote 2 But the United States has repeatedly accused China of violating that deal,Footnote 3 as detailed in indictments of various Chinese government-linked hackers for compromises of the Equifax credit reporting agency,Footnote 4 health insurer Anthem,Footnote 5 and hundreds of individual, corporate, and government victims.Footnote 6
On July 19, 2021, the United States and allies accused China of responsibility for hacking hundreds of thousands of computer systems running Microsoft Exchange software.Footnote 7 While U.S. officials continued to address the Russian government's hack of SolarWinds, which came to light in December 2020,Footnote 8 Microsoft revealed on March 2, 2021 that it had suffered a breach of its Exchange servers and attributed the intrusion to “Hafnium,” a group Microsoft called “state-sponsored and operating out of China.Footnote 9 Using four previously undiscovered vulnerabilities (commonly known as “zero-days”) in the Microsoft Exchange Server email software, the hackers gained access to computer systems and created “web shells,” which allowed the hackers administrative access to victim computers even after Microsoft patched the vulnerabilities.Footnote 10 Hackers could then use the web shells to execute commands and download malware onto the computers.Footnote 11 Although Microsoft's cloud-based “Microsoft 365” email services were not compromised,Footnote 12 the hack affected users of on-premises Exchange servers, including small businesses, local governments,Footnote 13 and, notably, the European Banking Authority.Footnote 14 Estimates suggested that the hack affected 30,000 servers in the United States and hundreds of thousands globally.Footnote 15
To respond to the hack, the U.S. National Security Council established a Unified Coordination Group that for the first time included representatives not just from government agencies, but also from the private sector.Footnote 16 The White House has since announced that this “new model for cyber incident response” will serve as a paradigm for future responses.Footnote 17
The government's first public action in response to the compromise came in April, when the Justice Department announced that the Federal Bureau of Investigation successfully carried out a court-authorized operation to remove the malicious web shells remaining on compromised systems.Footnote 18 The operation terminated hackers’ access to the systems, but did not remove any malware that had already been downloaded.Footnote 19
Then on July 19, the United States joined with the EU, NATO, and other allied countries to attribute the Microsoft Exchange hack to actors affiliated with China's Ministry of State Security (MSS) and to call out China for “foster[ing] an intelligence enterprise that includes contract hackers who also conduct unsanctioned cyber operations worldwide.”Footnote 20 The White House “[a]ttribut[ed] with a high degree of confidence that malicious cyber actors affiliated with [the People's Republic of China's (PRC)] MSS conducted cyber espionage operations utilizing the zero-day vulnerabilities in Microsoft Exchange Server.”Footnote 21 Furthermore, the United States noted:
[H]ackers with a history of working for the PRC Ministry of State Security (MSS) have engaged in ransomware attacks, cyber enabled extortion, crypto-jacking, and rank theft from victims around the world, all for financial gain.
In some cases, we are aware that PRC government-affiliated cyber operators have conducted ransomware operations against private companies that have included ransom demands of millions of dollars.Footnote 22
The White House declared that “[t]he PRC's pattern of irresponsible behavior in cyberspace is inconsistent with its stated objective of being seen as a responsible leader in the world.”Footnote 23
In a separate statement, the State Department explained:
Apart from the PRC's direct commitments not to engage in cyber-enabled theft of intellectual property for commercial gain, the international community has laid out clear expectations and guidelines for what constitutes responsible behavior in cyberspace. Responsible states do not indiscriminately compromise global network security nor knowingly harbor cyber criminals—let alone sponsor or collaborate with them. These contract hackers cost governments and businesses billions of dollars in stolen intellectual property, ransom payments, and cybersecurity mitigation efforts, all while the MSS had them on its payroll.Footnote 24
Marking its first public attribution of malicious cyber activities to China,Footnote 25 NATO announced:
We stand in solidarity with all those who have been affected by recent malicious cyber activities including the Microsoft Exchange Server compromise. Such malicious cyber activities undermine security, confidence and stability in cyberspace. We acknowledge national statements by Allies, such as Canada, the United Kingdom, and the United States, attributing responsibility for the Microsoft Exchange Server compromise to the People's Republic of China. In line with our recent Brussels Summit Communiqué, we call on all States, including China, to uphold their international commitments and obligations and to act responsibly in the international system, including in cyberspace.Footnote 26
Other U.S. allies followed suit in attributing the Microsoft Exchange hack and other malicious activities to China. The UK National Cyber Security Centre assessed with “almost certain[ty]” that the Exchange hack “was initiated and exploited by a Chinese state-backed threat actor,” and UK Foreign Secretary Dominic Raab asserted that it followed “a reckless but familiar pattern of behavior” and that “[t]he Chinese Government must end this systematic cyber sabotage and can expect to be held [to] account if it does not.”Footnote 27 The EU stated that it “strongly denounce[s] these malicious cyber activities, which are undertaken in contradiction with the norms of responsible state behaviour as endorsed by all UN member states,” and that it “urge[s] the Chinese authorities to adhere to these norms and not allow its territory to be used for malicious cyber activities, and [to] take all appropriate measures and reasonably available and feasible steps to detect, investigate and address the situation.”Footnote 28 Canada,Footnote 29 Japan,Footnote 30 Australia,Footnote 31 and New Zealand,Footnote 32 among others, released similar statements.Footnote 33
China denied the allegations and accused the United States of cyberattacks.Footnote 34 In comments to the press, Chinese Foreign Ministry Spokesperson Zhao Lijian stated that “[t]he US ganged up with its allies to make groundless accusations out of thin air against China on the cyber security issue. This act confuses right with wrong and smears and suppresses China out of political purpose. China will never accept this.”Footnote 35 Asked specifically about NATO's statement, Zhao alleged that “[b]y introducing military alliance into cyberspace, NATO is not making itself more secure” and instead “might spur cyber arms race, increase risks of cyber friction and conflict between countries, and undermine international peace and security.”Footnote 36
The coordinated attribution to China built on U.S. diplomatic efforts, including meetings and summits in June with NATO, the G7, the EU, and the United Kingdom. In announcing the attribution, the White House explained, “[f]rom the G7 and EU commitments around ransomware to NATO adopting a new cyber defense policy for the first time in seven years, the President is putting forward a common cyber approach with our allies and laying down clear expectations and markers on how responsible nations behave in cyberspace.”Footnote 37 NATO endorsed a Comprehensive Cyber Defence Policy in its June Brussels Summit Communiqué, noting that “[c]yber threats to the security of the Alliance are complex, destructive, coercive, and becoming ever more frequent,” and citing recent “ransomware incidents and other malicious cyber activity targeting our critical infrastructure and democratic institutions.”Footnote 38 The Communiqué called out Russia's “hybrid actions,” including “attempted interference in Allied elections and democratic processes; . . . widespread disinformation campaigns; malicious cyber activities; and turning a blind eye to cyber criminals operating from its territory,” and called on China to “act responsibly in the international system, including in the space, cyber, and maritime domains.”Footnote 39 The Communiqué reaffirmed that NATO “is determined to employ the full range of capabilities at all times to actively deter, defend against, and counter the full spectrum of cyber threats, including those conducted as part of hybrid campaigns, in accordance with international law.”Footnote 40
The G7's Carbis Bay Summit Communiqué in June likewise addressed malicious cyber actions. The G7 leaders pledged to “work together to urgently address the escalating shared threat from criminal ransomware networks” and “call[ed] on all states to urgently identify and disrupt ransomware criminal networks operating from within their borders, and hold those networks accountable for their actions.”Footnote 41 The Communiqué specifically urged Russia to “identify, disrupt, and hold to account those within its borders who conduct ransomware attacks, abuse virtual currency to launder ransoms, and other cybercrimes.”Footnote 42 More broadly, the G7 leaders also pledged “to work together to further a common understanding of how existing international law applies to cyberspace,” including working through “the UN and other international fora.”Footnote 43
In June meetings, the UK and EU each agreed to join the United States in combatting mutual cyber threats. As part of the “New Atlantic Charter,” the United States and the UK pledged “to promote the framework of responsible state behaviour in cyberspace” and to maintain collective security “against the full spectrum of modern threats, including cyber threats.”Footnote 44 Later in June, the United States and EU announced a new ransomware working group.Footnote 45
These cyber-specific agreements constitute one part of the Biden administration's broader program of shoring up alliances to counter China on both security and economic issues. During the June summits, NATO declared that “China's stated ambitions and assertive behaviour present systemic challenges to the rules-based international order and to areas relevant to Alliance security.”Footnote 46 The G7 also laid down a broad policy of countering China, asserting, “[w]ith regard to China, and competition in the global economy, we will continue to consult on collective approaches to challenging non-market policies and practices which undermine the fair and transparent operation of the global economy.”Footnote 47 The Biden administration also worked with the EU to suspend the seventeen-year Airbus-Boeing trade dispute, which began in 2004 when the United States complained to the World Trade Organization that the EU was illegally subsidizing Airbus to Boeing's disadvantage.Footnote 48 The dispute led both sides to impose an escalating series of retaliatory tariffs,Footnote 49 but the United States and EU agreed in June to lift those tariffs for the next five years, joining forces “to challenge and counter China's nonmarket practices in this sector.”Footnote 50 President Biden elaborated that the U.S.-EU collaboration in the aircraft industry is “a model we can build on for other challenges posed by China's economic model.”Footnote 51
It remains to be seen whether coordinated actions among U.S. allies can effectively address cyber threats. In just the last few months, several significant ransomware attacks have occurred. In May, ransomware directed against Colonial Pipeline prompted the East Coast's biggest gasoline supplier to shut down its pipeline, causing gasoline shortages.Footnote 52 Then in June, JBS, the world's largest meat company, paid an eleven million dollar ransom to avoid further disruptions to supply lines.Footnote 53 A third ransomware attack against a software provider, Kaseya, infected an estimated 1,500 small businesses, which faced ransom demands that reportedly ranged from $45,000 to $5 million.Footnote 54
In light of these ransomware incidents, all of which were carried out by Russia-based hacking groups, Biden has repeatedly raised concerns about ransomware with Russian President Vladimir Putin. At a June summit in Geneva, Biden proposed designating sixteen critical infrastructure sectors, including the energy sector and water systems, as “off limits to attack.”Footnote 55 During a July phone call with Putin, Biden expressed that the United States expects Russia to stop ransomware attacks emanating from Russia, promising to treat continued attacks as national security threats rather than criminal acts.Footnote 56 Shortly after the phone call, one of the Russia-based ransomware groups went offline, for reasons that remain unclear, but reappeared in September.Footnote 57
Critics argue that the White House must do more to prevent and combat cyberattacks. Sen. Angus King (I-ME), who co-chairs the Cyberspace Solarium Commission, said in June that the U.S. tactics of sanctions and indictments “haven't been nearly punitive enough.”Footnote 58 He asserted, “[w]e've been a cheap date in cyber where we've been attacked repeatedly in a variety of ways [with] no real serious response.”Footnote 59 Others specifically urged the United States to sanction China for the Microsoft Exchange hack.Footnote 60 In a background call with reporters, a senior Biden administration official warned that “[t]he U.S. and our allies and partners are not ruling out further actions to hold the PRC accountable.”Footnote 61
