WEBVTT - How China Is Building a Powerful Army of Hackers 0:00:02.720 --> 0:00:07.200 Bloomberg Audio Studios, podcasts, radio news. 0:00:09.039 --> 0:00:10.480 Okay, let's get started. 0:00:12.920 --> 0:00:15.920 Off and why are three? 0:00:16.120 --> 0:00:18.160 Two? 0:00:18.040 --> 0:00:22.000 Good Guy? As President Trump was preparing to take office 0:00:22.120 --> 0:00:25.880 earlier this year and the battle for cyber dominance between 0:00:25.960 --> 0:00:29.720 China and the US was looming large in Tokyo, one 0:00:29.720 --> 0:00:34.280 of the most prestigious global hacking competitions was underway. They're 0:00:34.280 --> 0:00:37.559 on the clock and actually attempting to exploit above him 0:00:38.159 --> 0:00:41.240 called pone to Own, The competition has attracted some of 0:00:41.280 --> 0:00:44.040 the world's best hackers, or, as the industry likes to 0:00:44.080 --> 0:00:48.599 call them, researchers. A hacking competition looks exactly like what 0:00:48.640 --> 0:00:51.159 you see in the movies, a group of people crowded 0:00:51.200 --> 0:00:54.440 around a computer, all staring intently at the screen as 0:00:54.440 --> 0:00:58.560 a main hacker types commands furiously on a keyboard. The 0:00:58.640 --> 0:01:01.560 aim of these hacking tournaments is to find weaknesses or 0:01:01.560 --> 0:01:05.160 holes in software in real world devices so that companies 0:01:05.160 --> 0:01:08.560 can fix them before they're exploited by criminals. For example, 0:01:08.640 --> 0:01:11.640 researchers would be looking for flaws and bugs, say in 0:01:11.720 --> 0:01:15.000 Google Chrome or the Apple Watch. Teams that find the 0:01:15.080 --> 0:01:19.000 vulnerabilities successfully win a cash prize and share with the 0:01:19.040 --> 0:01:22.240 tech companies of how they hacked into the systems at 0:01:22.240 --> 0:01:25.240 the poone to Own tournament in January. The competition was 0:01:25.240 --> 0:01:29.120 sponsored by Tesla and teams had to discover weaknesses in 0:01:29.160 --> 0:01:35.399 its wall charger, I. 0:01:35.319 --> 0:01:38.640 Think there's a success. 0:01:41.040 --> 0:01:44.319 The best hacking team is crown the Master of pone. 0:01:44.840 --> 0:01:48.040 It's a title that the competition organizers began bestowing on 0:01:48.120 --> 0:01:51.480 the best hackers in twenty sixteen. That first year, a 0:01:51.600 --> 0:01:56.320 China affiliated team won. In twenty seventeen, Chinese hackers were 0:01:56.440 --> 0:01:59.720 Master of pone again, but the year after that, twenty 0:01:59.720 --> 0:02:03.360 eight there were no Chinese hackers at poone to Own. 0:02:03.960 --> 0:02:07.120 In fact, since then, there have been barely any hackers 0:02:07.120 --> 0:02:11.280 from mainland China at any international hackathon anywhere in the world. 0:02:11.960 --> 0:02:17.680 In twenty eighteen, Chinese researchers no longer traveled to compete 0:02:17.680 --> 0:02:22.239 in international hacking competitions. Anyone who wanted to do so 0:02:22.400 --> 0:02:25.720 had to get special permission from the Chinese government. 0:02:26.320 --> 0:02:31.040 That's Bloomberg reporter Jimmy Terrabe, who covers national security in Washington, DC. 0:02:31.840 --> 0:02:33.840 Because they did not want. 0:02:34.000 --> 0:02:38.959 These folks to go overseas and compete, they created domestic 0:02:39.040 --> 0:02:43.799 hacking competitions to ensure that those vulnerabilities continue to. 0:02:43.919 --> 0:02:47.840 Be discovered but remained within China. 0:02:48.800 --> 0:02:52.560 The travel and competition restrictions placed on Chinese hackers were 0:02:52.600 --> 0:02:56.360 all about building what Jimmy calls a cyber army. 0:02:56.639 --> 0:03:02.639 China really began in earnest to invest in the cyber 0:03:03.440 --> 0:03:07.120 sort of population in its country. It invested in the tech, 0:03:07.320 --> 0:03:11.160 it invested in the talent, and it became a very 0:03:11.280 --> 0:03:17.640 conservative focus for the regime because in the wars to come, 0:03:18.080 --> 0:03:21.320 the cyber army in China is going to be a 0:03:21.480 --> 0:03:23.800 very significant part of its arsenal. 0:03:25.080 --> 0:03:29.200 It's a formidable arsenal that China could deploy as tensions 0:03:29.200 --> 0:03:33.400 between Washington and Beijing continue to ratchet up on everything 0:03:33.440 --> 0:03:36.280 from trade to rearffs to national security. 0:03:37.120 --> 0:03:41.360 It could be something that the Chinese government would leverage. 0:03:41.520 --> 0:03:42.200 Everyone knows that. 0:03:42.200 --> 0:03:47.040 They have its capability to play with the water supply 0:03:47.480 --> 0:03:55.040 in America? Would they do that now because of the tariffs? 0:03:56.520 --> 0:03:59.680 This is the Big Take Asia from Bloomberg News. I'm Wanha. 0:04:00.360 --> 0:04:02.680 Every week we take you inside some of the world's 0:04:02.680 --> 0:04:06.520 biggest and most powerful economies and the markets, tycoons and 0:04:06.680 --> 0:04:10.840 businesses that drive this ever shifting region. Today on the show, 0:04:11.160 --> 0:04:16.120 China's hacker army, How are Chinese hacking competitions powering its 0:04:16.160 --> 0:04:20.000 growing network of cyber soldiers, and what's at stake for 0:04:20.040 --> 0:04:22.160 the US and the rest of the world if their 0:04:22.240 --> 0:04:30.599 knowledge stays inside China. It took Chinese hackers a while 0:04:30.680 --> 0:04:34.320 to get involved in international hacking competitions like pone to Own, 0:04:34.960 --> 0:04:38.000 but once they did, Chinese teams from universities and tech 0:04:38.040 --> 0:04:41.839 companies quickly became a force to be reckoned, with the 0:04:41.960 --> 0:04:43.040 Chinese committed in. 0:04:43.000 --> 0:04:45.200 A way that other teams did not. 0:04:46.200 --> 0:04:50.280 When a Western team would come and enter pone to 0:04:50.360 --> 0:04:53.679 Own one of these hacking competitions, their teams were maybe 0:04:53.920 --> 0:04:57.479 three to five, five to seven at best. The Chinese 0:04:57.520 --> 0:05:02.280 was sending twenty to thirty people on each team, and 0:05:02.520 --> 0:05:06.679 they were having people spend an entire year, like months 0:05:06.680 --> 0:05:10.320 and months and months researching all the different. 0:05:10.000 --> 0:05:14.920 Contests, all the different challenges. It became a real contest. 0:05:14.680 --> 0:05:17.120 Of we're going to show everyone how good. 0:05:16.960 --> 0:05:19.640 We are, and that's exactly what they did. 0:05:20.320 --> 0:05:23.880 For a short time, teams from China dominated, but their 0:05:23.920 --> 0:05:28.000 achievements abroad soon drew the attention of critical eyes back home. 0:05:28.680 --> 0:05:32.320 In twenty seventeen, the founder of Chinese cybersecurity firm Chihu 0:05:32.400 --> 0:05:37.440 three sixty Joe hong Yi publicly criticized Chinese participation in 0:05:37.440 --> 0:05:38.880 international hackathons. 0:05:39.360 --> 0:05:43.320 The billionaire founder came out and said, I don't think 0:05:43.400 --> 0:05:47.840 that our people should be going and competing in these 0:05:47.839 --> 0:05:53.359 international contests and everyone getting to see the vulnerabilities that 0:05:53.400 --> 0:05:57.880 they discover. We should not be sharing these treasures with 0:05:57.960 --> 0:06:00.800 the rest of the world. These should be staying in 0:06:00.880 --> 0:06:04.359 China for us to use and for only us to 0:06:04.480 --> 0:06:06.240 have that knowledge. 0:06:06.279 --> 0:06:10.640 From twenty eighteen on, Chinese teams were effectively forbidden from 0:06:10.720 --> 0:06:15.880 participating in any international hackathons. That same year, China launched 0:06:15.920 --> 0:06:20.280 its own hacking tournament called the Tanfood Cup. The prizes 0:06:20.320 --> 0:06:24.200 totaled a million dollars, almost double the prize money awarded 0:06:24.200 --> 0:06:28.000 in Pune to Own that year. During the Tanfood Cup, participants, 0:06:28.160 --> 0:06:32.640 mostly Chinese teams, packed into Apple operating systems, Google phones, 0:06:32.680 --> 0:06:36.400 and Microsoft networks. What was different about the Tanfood Cup 0:06:36.640 --> 0:06:40.839 was what participants did after those exploits were discovered. Usually 0:06:40.839 --> 0:06:44.200 in international hackathons, the bugs are disclosed to the companies 0:06:44.240 --> 0:06:46.760 that make the software or devices so that they can 0:06:46.800 --> 0:06:50.600 patch them before criminal hackers exploit them. But in China, 0:06:50.760 --> 0:06:54.920 contestants are required to report the vulnerabilities to the government first. 0:06:57.000 --> 0:07:03.440 The Weston Slash International contests are a place where a 0:07:03.480 --> 0:07:08.039 lot of people from many different countries, they're competing, they're 0:07:08.120 --> 0:07:12.200 sharing their learning and reporting their findings in a much 0:07:12.240 --> 0:07:16.400 more open way, and you contrast that with what's happening 0:07:16.480 --> 0:07:18.800 in China. A lot of the times, we don't know 0:07:19.280 --> 0:07:24.080 what vulnerabilities they're investigating, we don't know what the results are, 0:07:24.240 --> 0:07:27.120 we don't know if the vendor has been notified. 0:07:27.680 --> 0:07:30.720 And in twenty twenty one, the Chinese government went a 0:07:30.760 --> 0:07:35.880 step further. A vulnerability disclosure regulation that came into effect 0:07:36.040 --> 0:07:39.600 required anyone, whether you're researcher at a tech company or 0:07:39.640 --> 0:07:42.800 if you discover a flaw during a competition, to report 0:07:42.840 --> 0:07:47.040 the findings to the government within forty eight hours. Anyone 0:07:47.040 --> 0:07:51.840 who doesn't comply could be punished and fined. Outside of China, 0:07:51.960 --> 0:07:56.760 governments don't force hackers or companies to disclose vulnerabilities, but 0:07:56.840 --> 0:08:00.440 they also don't publicly share any software flaws that their 0:08:00.480 --> 0:08:06.200 intelligence agencies have discovered either. It's a practice called vulnerability hoarding, 0:08:06.720 --> 0:08:10.520 and experts say organizations like the US National Security Agency 0:08:10.800 --> 0:08:14.920 don't reveal their vulnerabilities because it uses them to spy 0:08:15.040 --> 0:08:19.760 on other countries and attack their systems. For the longest time, 0:08:19.960 --> 0:08:24.000 cybersecurity experts weren't really sure how the Chinese government was 0:08:24.120 --> 0:08:29.320 using intel about security flaws until an alleged data leak 0:08:29.440 --> 0:08:30.800 in February last year. 0:08:31.960 --> 0:08:36.079 Chinese police are investigating hundreds of files leaked online last week. 0:08:36.200 --> 0:08:39.400 They purport to show Beijing's government agencies carrying out large 0:08:39.400 --> 0:08:43.000 scale cyber attacks against foreign governments, companies, and more. 0:08:43.520 --> 0:08:46.679 The hundreds of hundreds of internal files from the Shanghai 0:08:46.679 --> 0:08:51.200 based cybersecurity company i Soon, which works with Chinese government clients, 0:08:51.240 --> 0:08:55.679 were posted on an online platform called GitHub. Chat Logs 0:08:55.720 --> 0:08:59.720 and presentations, which industry experts believe to be authentic, appear 0:08:59.840 --> 0:09:03.240 to reveal successful attacks in twenty twenty one and twenty 0:09:03.280 --> 0:09:06.480 twenty two. There was a range of targets from the 0:09:06.600 --> 0:09:10.160 UK Foreign Office to the Royal Thai Army and even 0:09:10.400 --> 0:09:15.240 NATO Secretary General Jens Stoltenberg. What was also revealing in 0:09:15.280 --> 0:09:18.800 these files was a link between the Chinese hacking competitions 0:09:19.120 --> 0:09:21.520 and these state sponsored cyber attacks. 0:09:22.160 --> 0:09:25.280 We saw chats about vulnerability sharing. 0:09:25.679 --> 0:09:29.120 The people who were on these chats talking about infiltrating 0:09:29.200 --> 0:09:32.200 a mail server, trying to get into a system with 0:09:32.320 --> 0:09:37.079 a vulnerability. We saw people saying, hey, when am I 0:09:37.120 --> 0:09:40.640 going to get that vulnerability from Tianfu kop and the 0:09:40.720 --> 0:09:43.320 response was, well, it's gone to the Ministry of Public 0:09:43.360 --> 0:09:45.800 Security or we've seen the. 0:09:45.760 --> 0:09:49.120 Ministry of Public Security has an exploit. It's not fully. 0:09:48.840 --> 0:09:50.720 Formed, but see how you go try it out. 0:09:51.280 --> 0:09:54.600 So it really kind of revealed a through line. 0:09:55.160 --> 0:09:58.640 In March, several employees of i Soon were charged by 0:09:58.720 --> 0:10:01.920 US authorities for carrying out cyber attacks at the behest 0:10:01.960 --> 0:10:07.160 of Chinese intelligence agencies. China denies the allegations. I Soon 0:10:07.400 --> 0:10:10.640 hasn't responded to the charges and didn't respond to requests 0:10:10.640 --> 0:10:18.440 for comment. With tensions rising between the two superpowers, what 0:10:18.679 --> 0:10:22.000 are the risks that China's growing hacker army poses to 0:10:22.080 --> 0:10:24.400 the US and the rest of the world, and can 0:10:24.440 --> 0:10:37.520 governments do anything about it? That's after the break. Identifying 0:10:37.600 --> 0:10:41.120 vulnerabilities in your phone or laptop isn't just important for 0:10:41.160 --> 0:10:45.400 improving user experience and keeping your data safe. Bloomberg's Jamie 0:10:45.440 --> 0:10:48.600 Terrabe says they are an important tool for governments to 0:10:48.760 --> 0:10:52.400 use on the world stage, especially as tensions grow between 0:10:52.440 --> 0:10:55.400 the US and China, and as China seeks to wield 0:10:55.520 --> 0:10:57.560 more power and influence abroad. 0:10:58.320 --> 0:11:02.320 It's a really important weapon for any government to have. 0:11:03.160 --> 0:11:07.080 You have the power to go into a device and 0:11:07.120 --> 0:11:10.520 no one else knows about it, maybe for months, so 0:11:10.559 --> 0:11:13.679 you can sit on it and use it at your will. 0:11:13.960 --> 0:11:15.400 Who do you want to target? Do you want to 0:11:15.440 --> 0:11:19.240 target your domestic population? Do you want to target dissidents? 0:11:19.640 --> 0:11:23.599 The Chinese have recognized that it is a very useful tool, 0:11:23.960 --> 0:11:26.559 and they're spending a lot of money. They're investing a 0:11:26.640 --> 0:11:30.479 lot of time and talent, and they're growing their technology 0:11:30.960 --> 0:11:33.760 at a pace that the rest of the world is 0:11:33.920 --> 0:11:35.280 struggling too much. 0:11:36.200 --> 0:11:39.720 And it's not just about stealing data in corporate espionage. 0:11:40.120 --> 0:11:45.000 Hacking campaigns can target operational technology that controls critical infrastructure, 0:11:45.440 --> 0:11:49.640 think power grids and water supply systems. One hacking campaign 0:11:49.720 --> 0:11:53.160 the US is especially concerned about is called vult Typhoon. 0:11:53.960 --> 0:11:59.200 US intelligence agencies accused Chinese state hackers of compromising critical 0:11:59.240 --> 0:12:02.480 infrastructure on where the US has a military base. 0:12:03.840 --> 0:12:10.800 The volt Typhoon campaign is basically the discovery of Chinese 0:12:10.840 --> 0:12:18.680 state sponsored actors hiding in critical infrastructure just lurking and 0:12:18.920 --> 0:12:24.439 waiting for the right moment to flick a switch, to disrupt, 0:12:24.720 --> 0:12:30.400 to cause chaos or confusion, or to delay responses to 0:12:30.600 --> 0:12:35.160 possible military action that China might decide to embark on. 0:12:35.800 --> 0:12:37.280 So that's what. 0:12:37.120 --> 0:12:42.560 The cyber army looks like to the Chinese leadership. It 0:12:42.640 --> 0:12:45.640 is a tool to be used in the event of 0:12:46.280 --> 0:12:47.120 military action. 0:12:48.000 --> 0:12:50.079 It is also a tool to be used. 0:12:49.840 --> 0:12:53.920 In intelligence gathering, as they did when they hacked the 0:12:54.000 --> 0:12:57.600 emails of many of the State Department officials, as well 0:12:57.640 --> 0:13:00.640 as the most recent campaign where they hacked into the 0:13:00.720 --> 0:13:02.679 funds of the Trump campaign. 0:13:06.559 --> 0:13:11.520 China has repeatedly denied any accusations of malicious hacking, and 0:13:11.600 --> 0:13:14.520 have also long accused the US and other countries of 0:13:14.559 --> 0:13:15.679 cyber espionage. 0:13:16.360 --> 0:13:17.280 This is all about. 0:13:17.120 --> 0:13:18.079 Who's the better spy. 0:13:18.720 --> 0:13:20.560 There's always been this idea that we're going to spy 0:13:20.600 --> 0:13:23.080 on you, you're going to spy on us. But we 0:13:23.160 --> 0:13:25.920 don't know what the US is doing. We don't know 0:13:25.960 --> 0:13:28.040 what the French are doing, we don't know what the 0:13:28.080 --> 0:13:30.280 Australians are doing, we don't know what the British are doing. 0:13:30.559 --> 0:13:31.439 But that's the game. 0:13:32.160 --> 0:13:35.320 And as we hear more about these cyber attacks. Is 0:13:35.320 --> 0:13:37.760 there anything the US or other governments can do. 0:13:37.840 --> 0:13:42.200 At this point, with the latest administration, we're starting to 0:13:42.240 --> 0:13:47.640 hear a lot more strident voices about hacking back on 0:13:47.679 --> 0:13:48.080 the Hill. 0:13:48.440 --> 0:13:52.360 The head of the House Homeline Security Committee, doctor Mark Green, 0:13:52.960 --> 0:13:55.880 wants to hack back, wants to get private companies to 0:13:55.920 --> 0:13:59.680 carry out hacking offensive cyber campaigns. The thing is, we 0:13:59.720 --> 0:14:01.280 don't know if they're not already doing that. 0:14:01.800 --> 0:14:03.840 You know, we don't know what the NSA is doing. 0:14:03.960 --> 0:14:06.280 For the longest time, it was called no such agency 0:14:06.360 --> 0:14:09.000 because they never wanted to admit that they even existed, 0:14:09.120 --> 0:14:11.319 let alone tell everyone what they were doing. 0:14:11.880 --> 0:14:14.760 And Jamie says, part of the reason why these calls 0:14:14.800 --> 0:14:18.000 for offensive cyber campaigns are rising is because of the 0:14:18.000 --> 0:14:21.560 difficulties in holding people accountable for these cyber attacks. 0:14:22.320 --> 0:14:25.520 This is the same thing that happens with Russian criminal hackers. 0:14:26.000 --> 0:14:29.160 They all get indicted and they remain where they are. 0:14:29.720 --> 0:14:32.080 They stay in Russia or China, or they travel to 0:14:32.160 --> 0:14:36.520 countries where they won't get extradited and they face no consequences. 0:14:37.040 --> 0:14:39.520 One of the things with the ICEN leaks was these 0:14:39.560 --> 0:14:40.920 people aren't really paid a. 0:14:40.840 --> 0:14:44.120 Lot, and they're sort of at the bottom of the ladder, 0:14:44.240 --> 0:14:48.520 so they're doing someone else's bidding. So even if they 0:14:48.600 --> 0:14:53.320 were targeted, it doesn't change the apparatus. It doesn't change 0:14:53.680 --> 0:14:56.360 the fact that this is a policy in the government 0:14:56.640 --> 0:15:00.400 or within this agency to carry out this kind of behavior. 0:15:01.240 --> 0:15:03.760 So what I'm hearing then is you're saying China is 0:15:03.840 --> 0:15:06.560 basically going to continue to keep doing what it's doing 0:15:06.680 --> 0:15:09.920 and there's no one that can stop them. 0:15:10.120 --> 0:15:13.680 There are sanctions. We see export controls coming in, we 0:15:13.760 --> 0:15:17.800 see sanctions against individuals, we see. 0:15:17.560 --> 0:15:19.520 Sanctions against goods. 0:15:19.680 --> 0:15:24.280 Right we start to see Chinese products or companies getting 0:15:24.320 --> 0:15:28.160 banned from the US. We see people in the US 0:15:28.360 --> 0:15:32.320 being banned from trading or investing in Chinese companies. But 0:15:32.720 --> 0:15:35.920 short of being able to bring some of these people in, 0:15:36.640 --> 0:15:41.080 it doesn't really happen because attribution is always so hard. 0:15:41.320 --> 0:15:43.640 You know, you can say I have all of the 0:15:43.680 --> 0:15:47.800 elements that match this Chinese actor, but you're never going 0:15:47.840 --> 0:15:50.880 to know definitively. We live in a world now where 0:15:50.920 --> 0:15:55.600 AI is rapidly advancing. A lot of these cyber attacks 0:15:55.600 --> 0:15:59.160 can be automated in the future. The more we rely 0:15:59.280 --> 0:16:03.880 on tech, the more exposure we have, the more opportunities 0:16:03.920 --> 0:16:10.520 for all kinds of hackers to infiltrade, encrypt sabotage, hold you, transom, 0:16:10.640 --> 0:16:14.440 disrupt to all the things. So there are going to 0:16:14.480 --> 0:16:18.800 be more opportunities, not less. 0:16:22.760 --> 0:16:26.000 This is The Big Take Asia from Bloomberg News. I'm wanha. 0:16:26.520 --> 0:16:29.320 To get more from The Big Take and unlimited access 0:16:29.360 --> 0:16:32.600 to all of Bloomberg dot Com, subscribe today at Bloomberg 0:16:32.600 --> 0:16:36.200 dot com slash podcast Offer. If you like this episode, 0:16:36.320 --> 0:16:38.880 make sure to subscribe and review The Big Take Asia 0:16:39.000 --> 0:16:42.360 wherever you listen to podcasts. It really helps people find 0:16:42.360 --> 0:16:44.920 the show. Thanks for listening, See you next time.