The US and Britain have uncovered a global Chinese hacking plot that targeted White House and State Department staff, as well as British MPs and the Electoral Commission.
Washington and London announced sanctions against two individuals and one company linked to APT31, a Chinese state-affiliated group, in response to cyber attacks that “endangered national security.”
The attack on the commission, Britain’s election watchdog, was identified in October 2022, but the hackers had first gained access to the commission’s systems in more than a year since August 2021.
It revealed the personal details of 40 million voters, as the commission held the name and address of everyone in Britain registered to vote between 2014 and 2022, as well as the names of those registered as overseas voters.
It also emerged that a group of MPs and colleagues with aggressive views on China had been spied on by Beijing. They were among 43 parliamentary email accounts targeted by malicious tracking links.
Oliver Dowden, the deputy prime minister, told the House of Commons that any hostile cyber activity targeting British parliamentarians was “completely unacceptable” and said the two attacks showed a “clear and persistent pattern of behavior that signals hostile intent from China”.
But his announcement sparked a backlash among some lawmakers who felt the sanctions did not go far enough. Sir Iain Duncan Smith, one of the MPs spied on, said his statement was “like an elephant giving birth to a mouse” and called for China to be officially labeled a threat to Britain.
Robert Jenrick, a former government minister, called the government’s response “weak” and said: “The government is clearly not holding China to account for their attack on our democracy. Taking three years to punish two individuals and a small business is ridiculous. This weak response will only embolden China to continue its aggression against Britain.”
Suella Braverman, a former interior minister, said it was “abundantly clear” that China is a hostile state that poses an “unprecedented threat” to national security. She said there was a “compelling case” for adding it to the foreign influence registration program.
Washington said a “broad range of senior U.S. government officials and their advisors, who are integral to U.S. national security,” were targeted, including White House and State Department staff.
The list also included members of Congress, including both Democratic and Republican senators, the United States Naval Academy and the China Maritime Studies Institute of the United States Naval War College.
The Justice Department has indicted seven Chinese nationals linked to APT 31, which it said had “targeted U.S. and foreign critics, companies, and political officials for approximately 14 years in furtherance of the People’s Republic of China’s economic espionage and foreign intelligence objectives.” .
Announcing the charges, the ministry said the case exposed China’s “massive illegal hacking operation,” which targeted sensitive data belonging to U.S. journalists, academics and companies, as well as government officials.
Washington announced that it had imposed sanctions on the Wuhan Xiaoruizhi Science and Technology Company Limited (Wuhan XRZ), which it said was a “front company” for China’s Ministry of State Security and had served as a front for multiple malicious cyber operations.
Zhao Guangzong and Ni Gaobin, two Chinese nationals affiliated with Wuhan XRZ, were also designated for their roles in “malicious cyber operations” responsible for “directly endangering U.S. national security.”
‘Advanced hacking techniques’
The Justice Department said APT31 was part of a “cyber espionage program operated by the State Security Department of the Ministry of State Security Hubei, based in Wuhan city,” and that the seven defendants targeted “networks, email accounts, cloud storage accounts and phone calls, with several years of surveillance of compromised email accounts.”
The group operated by sending more than 10,000 malicious emails to targets, purporting to be from prominent news outlets or journalists. They contain hidden tracking links that, once opened, would reveal the target’s location, IP address and devices to the hackers.
After the targets opened the emails, the group used “advanced hacking techniques” to access personal data, the department said.
Foreign Ministry officials said the majority of lawmakers and colleagues spied on by Beijing “played a prominent role in exposing China’s malign activities.”
The National Cyber Security Center (NCSC), part of GCHQ, said Parliament’s security department “identified and successfully repelled” the cyber attacks before any accounts could be compromised.
On Monday it emerged that Lord Cameron, the Foreign Minister, has called on Wang Yi, the Chinese Foreign Minister, for an easing on the attacks.
The NCSC will publish new guidance for organizations involved in coordinating elections, such as local governments, which will advise officials on how to improve the protection of their election management systems against cyber hacks.
Earlier on Monday, Sir Iain said Chinese critics would not be “silenced” as he compared the West’s approach to Beijing to the appeasement of the 1930s.
Britain has been “too passive” to China’s overseas influence and has “turned a blind eye” to its malign activities, the former Conservative leader has said.
He was speaking at a hastily organized press conference in Westminster alongside Tim Loughton, a former minister, and Stewart McDonald, an MP from the Scottish National Party.
Sir Iain, who has been sanctioned by Beijing, said: “Along with other MPs, activists and dissidents, we have been subjected to harassment, impersonation and hacking attempts from China for some time. Neither we nor other parliamentary colleagues will be silenced by Beijing.
“For years, the behavior of the Chinese government has gone unchecked. We have been too passive as Beijing’s overseas influence operations have expanded rapidly, turning a blind eye to what the Intelligence and Security Committee called the penetration of ‘every sector of the British economy’.
“We have to be much stronger and tougher. The lesson learned from the 1930s: appeasement never works: if you are strong, and you tell them what’s wrong and you say you won’t tolerate it, then eventually they will probably back away.
“But if you don’t, they will continue to take advantage of you and that is our biggest problem.”
Chinese embassy: accusations ‘unfounded’
Sir Iain said he found it “incredible” that there was still a debate within the government over whether or not China would fall into the enhanced tier of the foreign influence registration system.
“Yet Britain has yet to impose any sanctions on officials responsible for the destruction of freedoms in Hong Kong, despite Britain being one of two duty bearers under the Sino-British Joint Declaration along with China,” it said he.
“The United States, on the other hand, has imposed more than forty sanctions. We must now enter a new era of relations with China, dealing with today’s Chinese Communist Party as it really is, and not as we hoped it would become.
“Today’s announcement should mark a turning point where Britain takes a stand for values, human rights and the international rules-based system on which we all depend.”
The Chinese embassy in London described Britain’s allegations of hacking as “baseless” and “completely baseless” and said a “serious démarche” had been made against British diplomats in response.
“The UK’s baseless hype-up of so-called ‘Chinese cyber attacks’ and the announcement of sanctions are outright political manipulation and malicious smears,” the report said.
“The UK has falsely accused China of attempting to interfere with British democracy. This is nothing but a publicity stunt. This is also a typical example of a thief shouting ‘catch thief’.”