Online Espionage: Reprimanding Doesn't Help

Attribution is the most often-used term in the debate about online security, because when it comes to attacks in the virtual world, the most important question is who could be the perpetrator. This question is often hard to answer. The American security company Mandiant has now tried to give an answer: There are signs (IP addresses, patterns of hacking, etc.) that make it highly probable that these attacks come from Shanghai and that the People’s Liberation Army is responsible for them.

If the data forensic analysis is accurate, this report confirms rumors that are already all over town: The Chinese military are behind large-scale industrial espionage, and the army sets the tune in the government-run Chinese economy and gives it advantages through new methods of unfair information acquisition. The second insight is that the U.S. can barely defend itself against this espionage or against the even more powerful possibilities of cyber warfare.

Companies can protect themselves comparatively easily, but Americans are also stuck with a badly secured critical infrastructure (power supply grids and waterworks), which can hardly be safeguarded. Because of this the U.S. has recently tried to deter would-be offenders with ever shriller noises — such as preventive strikes. But the concept of deterrence doesn’t work in cyberspace and neither does reprimanding China with this latest news. The U.S. will have to come up with something else.