A U.S. government warning released Wednesday, urging companies to protect against cyber threats from their managed service providers, is another in a long series of ramped-up concerns over espionage from nation-states involving third-party products and services.
The U.S. Computer Emergency Response Team (US-CERT), which provides disaster response and warnings about serious cybersecurity issues, published an alert that nation-states have been using shared cloud services and managed service providers — like those that provide outsourced handling of corporate functions — to launch advanced attacks and espionage campaigns against critical U.S. companies.
The attacks have resulted in a variety of adverse consequences, including lost sensitive information, disruption of operations and leaks of proprietary, according to the US-CERT. Victims of the attacks aren’t named but have included information technology firms, health care companies, communications providers and manufacturers, the warning stated.
China is not mentioned in the US-CERT warning, but government agencies have grown increasingly wary of how vulnerable U.S. infrastructure may be to Chinese espionage, said Tom Kellermann, chief cybersecurity officer for security company Carbon Black and a former top cybersecurity official for the World Bank.
“China’s activities in this area have only become ramped up in recent years, particularly as trade tensions between China and the U.S. have increased,” he said.
The Department of Justice has also ramped up enforcement and rhetoric about espionage activities waged against corporations and enterprise infrastructure from China in recent months
On Sept. 25, a Chinese national named Ji Chaoqun was arrested in Chicago following a complaint accusing him of acting on behalf of Beijing to recruit spies from government contractors in the Midwest. Ji has denied the charges. The complaint is one of several in recent years calling out what the U.S. says are Chinese government-sponsored campaigns to steal huge amounts of U.S. intellectual property for use both by the government and competitively at Chinese-owned businesses.
China has repeatedly denied a role in espionage against the U.S. In August, Hua Chunying, a spokesperson with China’s foreign ministry, countered hacking claims by Trump, saying: “We are firmly opposed to all forms of cyberattacks and espionage.”
Equipment manufacturers have recently been targeted by U.S. President Donald Trump’s administration, putting pressure on many large technology companies with roots in China.
In July, the administration moved to block China Mobile from entering the U.S. market over “national security” fears. In August, mobile manufacturers Huawei and ZTE were banned for use in U.S. government agencies, in a bill signed by Trump. Earlier this year, digital surveillance camera-maker Hikvision was also the subject of scrutiny after allegations the equipment, used on several military bases and overseas embassies, was sending images back to China.
Huawei and ZTE have denied claims their technology has been used for espionage. Hikvision has said issues related to transfer of data back to China were bugs that have since been fixed.
“Chinese commercial technology is a vehicle for the Chinese government to spy on United States federal agencies, posing a severe national security threat,” said Rep. Mike Conaway (R-Texas) in January. “Allowing Huawei, ZTE, and other related entities access to U.S. government communications would be inviting Chinese surveillance into all aspects of our lives.”
