What the National Counterintelligence and Security Center Really Said About Chinese Economic Espionage

Herb Lin
Tuesday, July 31, 2018, 8:02 AM

Defense News recently published a story describing a July report from the National Counterintelligence and Security Center (NCSC) on “Foreign Economic Espionage in Cyberspace.” The article presents the NCSC report as warning that the threat posed by Chinese industrial cyber theft to America’s long-term economic power continues to expand, despite the Obama-Xi agreemen

Published by The Lawfare Institute
in Cooperation With
Brookings

Defense News recently published a story describing a July report from the National Counterintelligence and Security Center (NCSC) on “Foreign Economic Espionage in Cyberspace.” The article presents the NCSC report as warning that the threat posed by Chinese industrial cyber theft to America’s long-term economic power continues to expand, despite the Obama-Xi agreement in 2015 to “curb Chinese economic espionage over the Internet.” But this framing is at least somewhat misleading.

It’s worth looking at what the NCSC report actually says, which is that “the Intelligence Community and private sector security experts continue to identify ongoing Chinese cyber activity, although at lower volumes than existed before the bilateral September 2015 U.S.-China cyber commitments”—something that Defense News calls a “lull.”

Perhaps more to the point is the different definitions used in the NCSC report and the Obama-Xi agreement. The report defined “economic or industrial espionage” as

(a) stealing a trade secret or proprietary information or appropriating, taking, carrying away, or concealing, or by fraud, artifice, or deception obtaining, a trade secret or proprietary information without the authorization of the owner of the trade secret or proprietary information; (b) copying, duplicating, downloading, uploading, destroying, transmitting, delivering, sending, communicating, or conveying a trade secret or proprietary information without the authorization of the owner of the trade secret or proprietary information; or (c) knowingly receiving, buying, or possessing a trade secret or proprietary information that has been stolen or appropriated, obtained, or converted without the authorization of the owner of the trade secret or proprietary information.

The Obama-Xi agreement, in contrast, said: “The United States and China agree that neither country’s government will conduct or knowingly support cyber-enabled theft of intellectual property, including trade secrets or other confidential business information, with the intent of providing competitive advantages to companies or commercial sectors” (emphasis added).

The Obama-Xi agreement uses what is basically the NCSC’s definition of economic espionage but qualifies it with the italicized language. The addition of that language means that the statement does not prohibit the cyber-enabled theft of intellectual property for purposes other than “providing competitive advantages.” And why would the United States be okay with that? Because the United States does not want to preclude the possibility of engaging in its own cyber-enabled activities to obtain intellectual property for those other purposes—and neither does China.

In other words, the espionage described in the NCSC report goes beyond the realm of what the Obama-Xi agreement rules out—and so not all the ongoing espionage identified by the NCSC would necessarily be prohibited under that agreement.

None of these comments should be taken to mean that Chinese theft of intellectual property is not a threat to U.S. national security or economic interests, or even that China has honored the agreement entirely. And reports about those topics are entirely appropriate and helpful. But complaining about Chinese activities that the United States also undertakes, especially when those activities have not been the subject of any agreement, appears to be gratuitous China-bashing that is likely to increase tensions unnecessarily.


Dr. Herb Lin is senior research scholar for cyber policy and security at the Center for International Security and Cooperation and Hank J. Holland Fellow in Cyber Policy and Security at the Hoover Institution, both at Stanford University. His research interests relate broadly to policy-related dimensions of cybersecurity and cyberspace, and he is particularly interested in and knowledgeable about the use of offensive operations in cyberspace, especially as instruments of national policy. In addition to his positions at Stanford University, he is Chief Scientist, Emeritus for the Computer Science and Telecommunications Board, National Research Council (NRC) of the National Academies, where he served from 1990 through 2014 as study director of major projects on public policy and information technology, and Adjunct Senior Research Scholar and Senior Fellow in Cybersecurity (not in residence) at the Saltzman Institute for War and Peace Studies in the School for International and Public Affairs at Columbia University. Prior to his NRC service, he was a professional staff member and staff scientist for the House Armed Services Committee (1986-1990), where his portfolio included defense policy and arms control issues. He received his doctorate in physics from MIT.

Subscribe to Lawfare