China and Cybersecurity: Espionage, Strategy, and Politics in the Digital Domain

401 Pages·2015·2.599 MB·English

by  Jon R. Lindsay, Tai Ming Cheung, Derek S. Reveron

China and Cybersecurity

China and
Cybersecurity
Espionage, Strategy, and Politics
in the Digital Domain
Edited by Jon R. Lindsay,
Tai Ming Cheung,
and
Derek S. Reveron
1
1
Oxford University Press is a department of the University of
Oxford. It furthers the University’s objective of excellence in research,
scholarship, and education by publishing worldwide.
Oxford New York
Auckland Cape Town Dar es Salaam Hong Kong Karachi
Kuala Lumpur Madrid Melbourne Mexico City Nairobi
New Delhi Shanghai Taipei Toronto
With offices in
Argentina Austria Brazil Chile Czech Republic France Greece
Guatemala Hungary Italy Japan Poland Portugal Singapore
South Korea Switzerland Thailand Turkey Ukraine Vietnam
Oxford is a registered trademark of Oxford University Press
in the UK and certain other countries.
Published in the United States of America by
Oxford University Press
198 Madison Avenue, New York, NY 10016
© Oxford University Press 2015
All rights reserved. No part of this publication may be reproduced, stored in
a retrieval system, or transmitted, in any form or by any means, without the prior
permission in writing of Oxford University Press, or as expressly permitted by law,
by license, or under terms agreed with the appropriate reproduction rights organization.
Inquiries concerning reproduction outside the scope of the above should be sent to the
Rights Department, Oxford University Press, at the address above.
You must not circulate this work in any other form
and you must impose this same condition on any acquirer.
Library of Congress Cataloging-in-Publication Data
China and cybersecurity : espionage, strategy, and politics in the digital domain /
edited by Jon R. Lindsay, Tai Ming Cheung, Derek S. Reveron.
pages cm
Includes bibliographical references and index.
ISBN 978–0–19–020126–5 (hardback) — ISBN 978–0–19–020127–2 (paperback)
1. Cyberterrorism—China. 2. National security—United States. 3. Security, International.
4. International cooperation. I. Lindsay, Jon R., editor. II. Cheung, Tai Ming, editor.
III. Reveron, Derek S., editor.
HV6773.15.C97C45 2015
355.3'43202854678—dc23
2014046287
9 8 7 6 5 4 3 2 1
Printed in the United States of America
on acid-free paper
CONTENTS
Acknowledgments vii
Contributors ix
Abbreviations xv
1. Introduction—China and Cybersecurity: Controversy
and Context 1
Jon R. Lindsay
PART I: Espionage and Cybercrime
2. The Chinese Intelligence Agencies: Evolution and
Empowerment in Cyberspace 29
Nigel Inkster
3. From Exploitation to Innovation: Acquisition, Absorption,
and Application 51
Jon R. Lindsay and Tai Ming Cheung
4. Investigating the Chinese Online Underground Economy 87
Zhuge Jianwei, Gu Lion, Duan Haixin, and Taylor Roberts
PART II: Military Strategy and Institutions
5. From Cyberwarfare to Cybersecurity in the
Asia-Pacific and Beyond 123
Ye Zheng
6. Chinese Writings on Cyberwarfare and Coercion 138
Kevin Pollpeter
7. The Chinese People’s Liberation Army Computer Network
Operations Infrastructure 163
Mark A. Stokes
8. Civil-Military Integration and Cybersecurity: A Study of Chinese
Information Warfare Militias 188
Robert Sheldon and Joe McReynolds
PART III: National Cybersecurity Policy
9. China’s Cybersecurity Situation and the Potential for
International Cooperation 225
Li Yuxiao and Xu Lu
10. Evolving Legal Frameworks for Protecting the Right to Internet
Privacy in China 242
Xu Jinghong
11. “Foreign Hostile Forces”: The Human Rights Dimension of China’s
Cyber Campaigns 260
Sarah McKune
PART IV: Practical and Theoretical Implications
12. China and Information Security Threats: Policy Responses
in the United States 297
Fred H. Cate
13. Conclusion: The Rise of China and the Future of
Cybersecurity 333
Jon R. Lindsay and Derek S. Reveron
Index 355
[ vi ] Contents
ACKNOWLEDGMENTS
This project began as a pair of conferences at the University of California
Institute on Global Conflict and Cooperation (IGCC) in La Jolla, California,
in the spring of 2012. Cybersecurity was by then already a hot topic in
Beijing and Washington, DC, but interest—and diplomatic tension—
escalated throughout the following year with allegations of industrial
espionage by the Chinese military and classified National Security Agency
documents leaked by Edward Snowden. As this book was going through
the final editing process, the US Department of Justice indicted five
alleged members of the Chinese People’s Liberation Army for involvement
in industrial espionage. China responded with angry incriminations and
retaliation against US firms in China. Further drama is surely inevitable.
The relentless pace of current events has both challenged our contributors
through the course of many revisions and strengthened our belief in the
need for an objective analysis of the political and institutional foundations
of cybersecurity in China.
This project has benefited from the generous support of IGCC; work
supported by, or in part by, the U.S. Army Research Laboratory and
the U.S. Army Research Office through the Minerva Initiative under
grant #W911NF-09-1-0081; and Office of Naval Research Grant
N00014-14-1-0071. Research for the chapter by Xu Jinghong was supported
in part by the National Social Science Fund of China (11BXW042), the
China Postdoctoral Science Foundation (20110490507), the Fundamental
Research Funds for the Central Universities (2011RC1113), and the Social
Science Fund of BUPT (2011BS03).
As in any project like this, many people have been vital in bringing this
book to fruition. The conferences that initiated this project benefited
from smooth management by Heidi Serochi and Marie Thiveos. Lynne
Bush provided expert copyediting and book project management at IGCC.
Brett Silvis standardized the figures and tables. Steven Glinert, Elizabeth
Martin, Joseph Miller, Lauren Reed, and Taylor Roberts provided research
assistance in locating sources and providing translations. Fan Yang provided
expert translation help on the Chinese chapters. Scott Parris and Cathryn
Vaulman at Oxford University Press were most helpful in shepherding the
project through to completion and demonstrating patience as new revela-
tions in the press necessitated additional revision. Eswari Maruthu and
Richard Isomaki were a pleasure to work with throughout the final copy-
editing process. We would also like to thank the anonymous peer reviewers
for their detailed and valuable feedback on all of the chapters.
[ viii ] Acknowledgments
CONTRIBUTORS
Fred H. Cate is a Distinguished Professor and C. Ben Dutton Professor
of Law at the Indiana University Maurer School of Law. He is the former
director of the university’s Center for Applied Cybersecurity Research—a
National Center of Academic Excellence in both Information Assurance
Research and Information Assurance Education—and director of the
Center for Law, Ethics, and Applied Research in Health Information. Cate
is a senior policy advisor to the Centre for Information Policy Leadership at
Hunton & Williams LLP. Previously, he served as chair of the International
Telecommunication Union’s High-Level Experts on Electronic Signatures
and Certification Authorities, counsel to the Department of Defense
Technology and Privacy Advisory Committee, reporter for the third
report of the Markle Task Force on National Security in the Information
Age, and as a member of the National Academy of Sciences Committee
on Technical and Privacy Dimensions of Information for Terrorism
Prevention, Microsoft’s Trustworthy Computing Academic Advisory
Board, and the Federal Trade Commission’s Advisory Committee on
Online Access and Security. A regular speaker before industry groups and
witness before congressional committees, Professor Cate is the author of
more than 150 articles and books and one of the founding editors of the
Oxford University Press journal International Data Privacy Law.
Tai Ming Cheung is director of the University of California Institute on
Global Conflict and Cooperation. He is in charge of the Institute’s Minerva
project “The Evolving Relationship Between Technology and National
Security in China: Innovation, Defense Transformation, and China’s Place
in the Global Technology Order.” He is a longtime analyst of Chinese and
East Asian defense and national security affairs. Cheung was based in Asia
from the mid-1980s to 2002, covering political, economic, and strategic
developments in greater China. He was also a journalist and political and
business risk consultant in northeast Asia. Cheung received his Ph.D. from