“The highest form of warfare is to out-think the enemy.”
“In all kinds of warfare, the direct approach is used for attack, but the oblique is what achieves victory.”
“If you do not wish to engage with the enemy, even though your defences are no more than a line in the ground, you can prevent them attacking by luring them away with a feint or a decoy.”
––Sun Zi, The Art of War
In advance of President Xi’s State Visit to Washington this week, White House officials in August previewed what was to be the first use of the powers created by an April Executive Order (EO) aimed at curbing unacceptable cyberactivity. The EO authorizes tough financial sanctions against those who benefit from a country’s illicit cyberactivities, for damaging critical infrastructure and computer networks in the United States and benefiting from the cyber-enabled theft of proprietary information, as these are the components of the U.S. private sector’s economic competitiveness.
At that time, the U.S. government was reeling from reports of the first of two attacks reliably attributed to the Chinese government; against the Office of Personnel Management and attacks involving sensitive health information at Anthem, attributed to Chinese government-directed attackers, and against Sony Pictures Entertainment, which involved physical damage achieved through cyber means and carried out through North Korea’s Internet link that passes through China. The EO added strength to an ongoing campaign by the President and his advisors either to change Chinese government behavior or hold the Chinese government to account for it.
Those White House officials left some ambiguity about the timing of sanctions relative to President Xi’s visit and whether sanctions would single out China or include other bad actors. They timed the leak well. Mere weeks before President Obama welcomed Xi to the White House it alerted the Chinese government to the embarrassing possibility that the sanctions would dominate the news around the visit. By leaving open the timing of sanctions, the White House provided the Chinese government with an opening to negotiate on those elements, sparing the Chinese leader the embarrassment of a sanctions announcement on the eve of the visit.
The Obama Administration, however, may not have prepared for the Chinese response very well. They should have re-read The Art of War.
The conversation between the United States and China on cyber has become an endless discordant loop since the beginning of the Obama Administration. The United States has complained that Chinese state-directed hackers have stolen commercially relevant information from U.S. firms; China has denied that such theft––or any inappropriate cyberactivity––has taken place. The U.S. government countered that denial by building a stronger and more detailed case against Chinese government conduct. In some instances, the private sector has also provided public evidence. Last year, in fact, the U.S. government indicted on charges related to their cyberactivities five Chinese officials (whom the U.S. will presumably prosecute should they present themselves in U.S. territory). Naming and shaming, the U.S. government has sought to convince China to come to the negotiating table and discuss how Chinese behavior should change.
This tactic has failed at the most rudimentary level: the Chinese government flatly denies conducting any form of inappropriate cyberactivity––a laughable contention, as nearly all states with capacity engage in some form of espionage in cyberspace––and blames U.S. networks for hosting the majority of illegal cyberactivities. More convincing evidence will not overcome China’s airy denials.
In spite of the absence of meaningful dialogue, the U.S. government has tried to expand the campaign to like-minded nations. To rally the international community against China’s bad cyberbehavior, the U.S. government earlier this year sought support at the United Nations (UN) for certain norms in cyberspace. But that move actually confused the issue. The norms tabled at the UN address obligations to refrain from damaging critical infrastructure and to provide assistance to countries that have suffered an attack; the U.S. government did not include a norm against cyberactivities aimed at stealing the sources of another country’s economic competitiveness. The effort at the UN, then, will result only in Chinese denials to a larger community; it has also distracted from the principal U.S. goal of minimizing cybertheft of the foundations for economic competitiveness.
The Chinese government seems to have absorbed the implicit shift in the U.S. UN submission away from cybertheft. According to media reports this week, U.S. and Chinese negotiators have agreed to some form of code of conduct related to the critical infrastructure-related norms to be announced as a deliverable of Xi’s visit. The Chinese government seems to have realized that the U.S. government might accept a general commitment to norms unrelated to cybertheft, combined with additional commitments to talk, in exchange for taking sanctions off the table. If the agreement discussed in the press is actually limited to norms unrelated to cybertheft, it would not constitute the progress that President Obama last week suggested would suspend U.S. consideration of sanction. In that case, the Chinese will have succeeded beyond any expectation. The United States is left with more words, further delayed action, and Chinese agreement that they will not engage in conduct… that they never acknowledged in the first place.
Would sanctions against Chinese individuals and entities have been a game changer in the ongoing battle over economic competitiveness? The record for unilateral U.S. sanctions changing bad behavior does not provide much reason to think it would, in and of itself, end Chinese cyberhacking. But sanctions would change the calculus for bad cyberactivities in ways that bilateral or international discussions cannot, by closing off valuable U.S. and multinational business and financial access.
The agreement that the two Presidents will make on Friday has to pass a very high bar to be acceptable: in exchange for avoiding sanctions and turning a potential embarrassment for President Xi’s visit into an opportunity for Xi to look like a statesman, the agreement must cover cybertheft and provide concrete means to verify those promises from the Chinese. If so, it may take some time to assess whether the agreement is more than words. Otherwise, President Xi has gotten a State Visit and avoided embarrassment. It will be far less clear what President Obama and the United States have achieved.
Adam Bobrow is the Founder and CEO of Foresight Resilience Strategies and a senior fellow with the GW Center for Cyber and Homeland Security.