Speaker 1: Bloomberg Audio Studios, podcasts, radio news.
Speaker 2: Okay, let's get started.
Speaker 3: Off and why are three?
Speaker 1: Two?
Speaker 3: Good Guy? As President Trump was preparing to take office
Speaker 3: earlier this year and the battle for cyber dominance between
Speaker 3: China and the US was looming large in Tokyo, one
Speaker 3: of the most prestigious global hacking competitions was underway. They're
Speaker 3: on the clock and actually attempting to exploit above him
Speaker 3: called pone to Own, The competition has attracted some of
Speaker 3: the world's best hackers, or, as the industry likes to
Speaker 3: call them, researchers. A hacking competition looks exactly like what
Speaker 3: you see in the movies, a group of people crowded
Speaker 3: around a computer, all staring intently at the screen as
Speaker 3: a main hacker types commands furiously on a keyboard. The
Speaker 3: aim of these hacking tournaments is to find weaknesses or
Speaker 3: holes in software in real world devices so that companies
Speaker 3: can fix them before they're exploited by criminals. For example,
Speaker 3: researchers would be looking for flaws and bugs, say in
Speaker 3: Google Chrome or the Apple Watch. Teams that find the
Speaker 3: vulnerabilities successfully win a cash prize and share with the
Speaker 3: tech companies of how they hacked into the systems at
Speaker 3: the poone to Own tournament in January. The competition was
Speaker 3: sponsored by Tesla and teams had to discover weaknesses in
Speaker 3: its wall charger, I.
Speaker 1: Think there's a success.
Speaker 3: The best hacking team is crown the Master of pone.
Speaker 3: It's a title that the competition organizers began bestowing on
Speaker 3: the best hackers in twenty sixteen. That first year, a
Speaker 3: China affiliated team won. In twenty seventeen, Chinese hackers were
Speaker 3: Master of pone again, but the year after that, twenty
Speaker 3: eight there were no Chinese hackers at poone to Own.
Speaker 3: In fact, since then, there have been barely any hackers
Speaker 3: from mainland China at any international hackathon anywhere in the world.
Speaker 4: In twenty eighteen, Chinese researchers no longer traveled to compete
Speaker 4: in international hacking competitions. Anyone who wanted to do so
Speaker 4: had to get special permission from the Chinese government.
Speaker 3: That's Bloomberg reporter Jimmy Terrabe, who covers national security in Washington, DC.
Speaker 3: Because they did not want.
Speaker 1: These folks to go overseas and compete, they created domestic
Speaker 1: hacking competitions to ensure that those vulnerabilities continue to.
Speaker 4: Be discovered but remained within China.
Speaker 3: The travel and competition restrictions placed on Chinese hackers were
Speaker 3: all about building what Jimmy calls a cyber army.
Speaker 1: China really began in earnest to invest in the cyber
Speaker 1: sort of population in its country. It invested in the tech,
Speaker 1: it invested in the talent, and it became a very
Speaker 1: conservative focus for the regime because in the wars to come,
Speaker 1: the cyber army in China is going to be a
Speaker 1: very significant part of its arsenal.
Speaker 3: It's a formidable arsenal that China could deploy as tensions
Speaker 3: between Washington and Beijing continue to ratchet up on everything
Speaker 3: from trade to rearffs to national security.
Speaker 1: It could be something that the Chinese government would leverage.
Speaker 5: Everyone knows that.
Speaker 1: They have its capability to play with the water supply
Speaker 1: in America? Would they do that now because of the tariffs?
Speaker 3: This is the Big Take Asia from Bloomberg News. I'm Wanha.
Speaker 3: Every week we take you inside some of the world's
Speaker 3: biggest and most powerful economies and the markets, tycoons and
Speaker 3: businesses that drive this ever shifting region. Today on the show,
Speaker 3: China's hacker army, How are Chinese hacking competitions powering its
Speaker 3: growing network of cyber soldiers, and what's at stake for
Speaker 3: the US and the rest of the world if their
Speaker 3: knowledge stays inside China. It took Chinese hackers a while
Speaker 3: to get involved in international hacking competitions like pone to Own,
Speaker 3: but once they did, Chinese teams from universities and tech
Speaker 3: companies quickly became a force to be reckoned, with the
Speaker 3: Chinese committed in.
Speaker 5: A way that other teams did not.
Speaker 1: When a Western team would come and enter pone to
Speaker 1: Own one of these hacking competitions, their teams were maybe
Speaker 1: three to five, five to seven at best. The Chinese
Speaker 1: was sending twenty to thirty people on each team, and
Speaker 1: they were having people spend an entire year, like months
Speaker 1: and months and months researching all the different.
Speaker 4: Contests, all the different challenges. It became a real contest.
Speaker 5: Of we're going to show everyone how good.
Speaker 1: We are, and that's exactly what they did.
Speaker 3: For a short time, teams from China dominated, but their
Speaker 3: achievements abroad soon drew the attention of critical eyes back home.
Speaker 3: In twenty seventeen, the founder of Chinese cybersecurity firm Chihu
Speaker 3: three sixty Joe hong Yi publicly criticized Chinese participation in
Speaker 3: international hackathons.
Speaker 1: The billionaire founder came out and said, I don't think
Speaker 1: that our people should be going and competing in these
Speaker 1: international contests and everyone getting to see the vulnerabilities that
Speaker 1: they discover. We should not be sharing these treasures with
Speaker 1: the rest of the world. These should be staying in
Speaker 1: China for us to use and for only us to
Speaker 1: have that knowledge.
Speaker 3: From twenty eighteen on, Chinese teams were effectively forbidden from
Speaker 3: participating in any international hackathons. That same year, China launched
Speaker 3: its own hacking tournament called the Tanfood Cup. The prizes
Speaker 3: totaled a million dollars, almost double the prize money awarded
Speaker 3: in Pune to Own that year. During the Tanfood Cup, participants,
Speaker 3: mostly Chinese teams, packed into Apple operating systems, Google phones,
Speaker 3: and Microsoft networks. What was different about the Tanfood Cup
Speaker 3: was what participants did after those exploits were discovered. Usually
Speaker 3: in international hackathons, the bugs are disclosed to the companies
Speaker 3: that make the software or devices so that they can
Speaker 3: patch them before criminal hackers exploit them. But in China,
Speaker 3: contestants are required to report the vulnerabilities to the government first.
Speaker 1: The Weston Slash International contests are a place where a
Speaker 1: lot of people from many different countries, they're competing, they're
Speaker 1: sharing their learning and reporting their findings in a much
Speaker 1: more open way, and you contrast that with what's happening
Speaker 1: in China. A lot of the times, we don't know
Speaker 1: what vulnerabilities they're investigating, we don't know what the results are,
Speaker 1: we don't know if the vendor has been notified.
Speaker 3: And in twenty twenty one, the Chinese government went a
Speaker 3: step further. A vulnerability disclosure regulation that came into effect
Speaker 3: required anyone, whether you're researcher at a tech company or
Speaker 3: if you discover a flaw during a competition, to report
Speaker 3: the findings to the government within forty eight hours. Anyone
Speaker 3: who doesn't comply could be punished and fined. Outside of China,
Speaker 3: governments don't force hackers or companies to disclose vulnerabilities, but
Speaker 3: they also don't publicly share any software flaws that their
Speaker 3: intelligence agencies have discovered either. It's a practice called vulnerability hoarding,
Speaker 3: and experts say organizations like the US National Security Agency
Speaker 3: don't reveal their vulnerabilities because it uses them to spy
Speaker 3: on other countries and attack their systems. For the longest time,
Speaker 3: cybersecurity experts weren't really sure how the Chinese government was
Speaker 3: using intel about security flaws until an alleged data leak
Speaker 3: in February last year.
Speaker 2: Chinese police are investigating hundreds of files leaked online last week.
Speaker 2: They purport to show Beijing's government agencies carrying out large
Speaker 2: scale cyber attacks against foreign governments, companies, and more.
Speaker 3: The hundreds of hundreds of internal files from the Shanghai
Speaker 3: based cybersecurity company i Soon, which works with Chinese government clients,
Speaker 3: were posted on an online platform called GitHub. Chat Logs
Speaker 3: and presentations, which industry experts believe to be authentic, appear
Speaker 3: to reveal successful attacks in twenty twenty one and twenty
Speaker 3: twenty two. There was a range of targets from the
Speaker 3: UK Foreign Office to the Royal Thai Army and even
Speaker 3: NATO Secretary General Jens Stoltenberg. What was also revealing in
Speaker 3: these files was a link between the Chinese hacking competitions
Speaker 3: and these state sponsored cyber attacks.
Speaker 5: We saw chats about vulnerability sharing.
Speaker 1: The people who were on these chats talking about infiltrating
Speaker 1: a mail server, trying to get into a system with
Speaker 1: a vulnerability. We saw people saying, hey, when am I
Speaker 1: going to get that vulnerability from Tianfu kop and the
Speaker 1: response was, well, it's gone to the Ministry of Public
Speaker 1: Security or we've seen the.
Speaker 5: Ministry of Public Security has an exploit. It's not fully.
Speaker 1: Formed, but see how you go try it out.
Speaker 5: So it really kind of revealed a through line.
Speaker 3: In March, several employees of i Soon were charged by
Speaker 3: US authorities for carrying out cyber attacks at the behest
Speaker 3: of Chinese intelligence agencies. China denies the allegations. I Soon
Speaker 3: hasn't responded to the charges and didn't respond to requests
Speaker 3: for comment. With tensions rising between the two superpowers, what
Speaker 3: are the risks that China's growing hacker army poses to
Speaker 3: the US and the rest of the world, and can
Speaker 3: governments do anything about it? That's after the break. Identifying
Speaker 3: vulnerabilities in your phone or laptop isn't just important for
Speaker 3: improving user experience and keeping your data safe. Bloomberg's Jamie
Speaker 3: Terrabe says they are an important tool for governments to
Speaker 3: use on the world stage, especially as tensions grow between
Speaker 3: the US and China, and as China seeks to wield
Speaker 3: more power and influence abroad.
Speaker 1: It's a really important weapon for any government to have.
Speaker 1: You have the power to go into a device and
Speaker 1: no one else knows about it, maybe for months, so
Speaker 1: you can sit on it and use it at your will.
Speaker 1: Who do you want to target? Do you want to
Speaker 1: target your domestic population? Do you want to target dissidents?
Speaker 1: The Chinese have recognized that it is a very useful tool,
Speaker 1: and they're spending a lot of money. They're investing a
Speaker 1: lot of time and talent, and they're growing their technology
Speaker 1: at a pace that the rest of the world is
Speaker 1: struggling too much.
Speaker 3: And it's not just about stealing data in corporate espionage.
Speaker 3: Hacking campaigns can target operational technology that controls critical infrastructure,
Speaker 3: think power grids and water supply systems. One hacking campaign
Speaker 3: the US is especially concerned about is called vult Typhoon.
Speaker 3: US intelligence agencies accused Chinese state hackers of compromising critical
Speaker 3: infrastructure on where the US has a military base.
Speaker 1: The volt Typhoon campaign is basically the discovery of Chinese
Speaker 1: state sponsored actors hiding in critical infrastructure just lurking and
Speaker 1: waiting for the right moment to flick a switch, to disrupt,
Speaker 1: to cause chaos or confusion, or to delay responses to
Speaker 1: possible military action that China might decide to embark on.
Speaker 1: So that's what.
Speaker 5: The cyber army looks like to the Chinese leadership. It
Speaker 5: is a tool to be used in the event of
Speaker 5: military action.
Speaker 4: It is also a tool to be used.
Speaker 1: In intelligence gathering, as they did when they hacked the
Speaker 1: emails of many of the State Department officials, as well
Speaker 1: as the most recent campaign where they hacked into the
Speaker 1: funds of the Trump campaign.
Speaker 3: China has repeatedly denied any accusations of malicious hacking, and
Speaker 3: have also long accused the US and other countries of
Speaker 3: cyber espionage.
Speaker 1: This is all about.
Speaker 5: Who's the better spy.
Speaker 1: There's always been this idea that we're going to spy
Speaker 1: on you, you're going to spy on us. But we
Speaker 1: don't know what the US is doing. We don't know
Speaker 1: what the French are doing, we don't know what the
Speaker 1: Australians are doing, we don't know what the British are doing.
Speaker 5: But that's the game.
Speaker 3: And as we hear more about these cyber attacks. Is
Speaker 3: there anything the US or other governments can do.
Speaker 5: At this point, with the latest administration, we're starting to
Speaker 5: hear a lot more strident voices about hacking back on
Speaker 5: the Hill.
Speaker 1: The head of the House Homeline Security Committee, doctor Mark Green,
Speaker 1: wants to hack back, wants to get private companies to
Speaker 1: carry out hacking offensive cyber campaigns. The thing is, we
Speaker 1: don't know if they're not already doing that.
Speaker 4: You know, we don't know what the NSA is doing.
Speaker 1: For the longest time, it was called no such agency
Speaker 1: because they never wanted to admit that they even existed,
Speaker 1: let alone tell everyone what they were doing.
Speaker 3: And Jamie says, part of the reason why these calls
Speaker 3: for offensive cyber campaigns are rising is because of the
Speaker 3: difficulties in holding people accountable for these cyber attacks.
Speaker 1: This is the same thing that happens with Russian criminal hackers.
Speaker 1: They all get indicted and they remain where they are.
Speaker 1: They stay in Russia or China, or they travel to
Speaker 1: countries where they won't get extradited and they face no consequences.
Speaker 4: One of the things with the ICEN leaks was these
Speaker 4: people aren't really paid a.
Speaker 1: Lot, and they're sort of at the bottom of the ladder,
Speaker 1: so they're doing someone else's bidding. So even if they
Speaker 1: were targeted, it doesn't change the apparatus. It doesn't change
Speaker 1: the fact that this is a policy in the government
Speaker 1: or within this agency to carry out this kind of behavior.
Speaker 3: So what I'm hearing then is you're saying China is
Speaker 3: basically going to continue to keep doing what it's doing
Speaker 3: and there's no one that can stop them.
Speaker 1: There are sanctions. We see export controls coming in, we
Speaker 1: see sanctions against individuals, we see.
Speaker 4: Sanctions against goods.
Speaker 1: Right we start to see Chinese products or companies getting
Speaker 1: banned from the US. We see people in the US
Speaker 1: being banned from trading or investing in Chinese companies. But
Speaker 1: short of being able to bring some of these people in,
Speaker 1: it doesn't really happen because attribution is always so hard.
Speaker 1: You know, you can say I have all of the
Speaker 1: elements that match this Chinese actor, but you're never going
Speaker 1: to know definitively. We live in a world now where
Speaker 1: AI is rapidly advancing. A lot of these cyber attacks
Speaker 1: can be automated in the future. The more we rely
Speaker 1: on tech, the more exposure we have, the more opportunities
Speaker 1: for all kinds of hackers to infiltrade, encrypt sabotage, hold you, transom,
Speaker 1: disrupt to all the things. So there are going to
Speaker 1: be more opportunities, not less.
Speaker 3: This is The Big Take Asia from Bloomberg News. I'm wanha.
Speaker 3: To get more from The Big Take and unlimited access
Speaker 3: to all of Bloomberg dot Com, subscribe today at Bloomberg
Speaker 3: dot com slash podcast Offer. If you like this episode,
Speaker 3: make sure to subscribe and review The Big Take Asia
Speaker 3: wherever you listen to podcasts. It really helps people find
Speaker 3: the show. Thanks for listening, See you next time.