On February 10, the U.S. Department of Justice indicted four Chinese military officers for allegedly stealing the personal data of 145 million Americans from Equifax in 2017.
Speaking the same day, William Evanina, director of the National Counterintelligence and Security Center, warned about nation-state cyber risks to key infrastructure, such as energy, banking and telecoms. “With the private sector and democratic institutions increasingly under attack, this is no longer a problem the U.S. government can address alone,” Evanina said, as Washington, D.C.’s WTOP radio station reports. “It requires a whole-of-society response, involving the private sector, an informed American public, as well as our allies.”
The Chinese military officers’ alleged beach into Equifax, Evanina cautioned, was about improving China’s AI capabilities. “They will use bank records, hotel and travel records, genetic data, credit records and card numbers to train their artificial intelligence algorithms,” he said.
China has denied involvement. As the Associated Press reports, a foreign ministry spokesperson said China was pledged to “firmly oppose and combat cyberattacks of any kind” and that its organizations “never engage in cybertheft of trade secrets.” The spokesperson also reversed the allegations against the United States, saying, “China is also a victim of this.”
When Attorney General William Barr unveiled the Equifax indictments, he also publicly alleged that, as long thought in cybersecurity circles, China was responsible for the 2018 data breach affecting 500 million Marriott hotel guests, reports NBC.
Barr cited the 2015 cyber attack on the Office of Personnel Management, which exposed the personal data of roughly 21.5 million Americans. “For years we have witnessed China’s voracious appetite for the personal data of Americans,” Barr said at a press conference.
As Wired explains, Chinese hackers exploited a vulnerability in software that had been patched, but Equifax had failed to update in order to pull off the 2017 breach, according to the indictment.
“What’s the difference between the Chinese government stealing all that information and a data broker amassing it legally without user consent and selling it on the open market?” asks Charlie Warzel, a columnist for The New York Times.
Retired CIA official Douglas H. Wise, as quoted by WTOP, indicated that the threat of malicious attacks by nation-state actors concerns him far more than the legal information-gathering of companies like Equifax. “The Chinese want to own us,” Wise said. “The Russians want to destroy us.”