All language subtitles for cyberwar.s01e04.720p.hdtv.x264-w4f_Track02

BEN: Two powers compete to
dominate the global market.

We know foreign
countries and companies

swipe our corporate secrets!

China breaks the rules
in its quest to become

the world's economic superpower.

There's two types of companies
left in the United States:

companies that have been
hacked by China, and companies

that don't know they've
been hacked by China yet.

Chinese hackers breach
American corporations

under direct orders
from Beijing.

This is oftentimes
a military operation,

and you don't disobey
orders in the military.

Billions of dollars
worth of US trade secrets

are stolen every year.

The people behind the keyboard
think they're anonymous,

and these charges
show you are not.

What will it take
to stop the theft?

♪

In July 2015,

the Washington-based US Office
of Personnel Management

announced that the
private records it kept

on more than 22 million American
civil servants had been stolen.

The US government never formally
blamed China, but plenty of

unnamed officials made
the accusation in the press.

Bill Evanina is in charge of

combatting foreign intelligence
threats for the US government.

I think the intelligence
community feels pretty confident

- we feel - with who's involved,
but I'm not quite sure

the administration has
yet come out and identified

or attributed that data,
but we're pretty confident

we know who is responsible.

What did they take?

What they stole,
the perpetrators,

were the SF86s and SF85s,
which are the standard forms

in which employees fill out
to obtain security clearances.

On those forms had a lot of
proprietary information

about you, who you live with,
your social security number,

your date of birth,
what schools you went to,

your employment history.

So a lot of significant personal
identifiable information

that we consider very sensitive.

And how long will the
intelligence community

in the United States be feeling
the ramifications of this?

Ooh, I'm not sure we could
put it in terms of years,

but I would say maybe decades.

I don't think this is anything
that's going to be over

in a year or two.

I think the data
that's on these forms

can be used to target
US government employees

and contractors
for many, many years.

- Were you personally...
- Absolutely.

You were personally
impacted by it?

Absolutely.

So I am one of the
22 million victims

that have been identified
in the OPM intrusion.

So all my personal data,
from when I filled out

my original form and subsequent
background of investigations

that I've gone through,
has been compromised.

How does that make you feel?

Like a victim.

Even though OPM was bad,
it was classic espionage.

Most countries would
do it given the chance.

But hacking US corporations

to make money off of their
property is another story.

We've agreed that neither the
US or the Chinese government

will conduct or knowingly
support cyber-enabled theft

of intellectual property,
including trade secrets

or other confidential
business information,

for commercial advantage.

In addition, we'll work together
and with other nations.

President Obama has
reason to be concerned.

For years, Chinese hackers
have been a problem for

American business, but most
companies kept quiet about it.

And then Google broke
the silence on their blog

in January 2010.

The American technology
giant had been hacked,

and China was to blame.

But Google wasn't the
only company targeted.

It was just the
first one to go public.

A slew of other Fortune 500
corporations were also hacked

in an attack now known
as Operation Aurora.

What was interesting
about Operation Aurora

wasn't that it was
some kind of new attack.

It was that it was the first
time an American company

had had the courage to stand up
and point the finger at China

and say, "We know you did this."

Nicole Perlroth is a
cyber security reporter

for The New York Times,
and she's written extensively

on Chinese hackers.

And Google, as open as they
were about who had done it,

they've been relatively
close-lipped about

what exactly was stolen.

But the word on the street is
that the Chinese were actually

able to get a fair amount
of Google's source code.

That source code could help
Chinese hackers break into

Google's products, or to
replicate them in the future.

What do we know
about Chinese espionage?

We know that China
has basically made it

a core part of its economic
mission to stop being

the world's manufacturer
and start innovating.

Every five years,
you see a new industry

that China wants to excel at,
and suddenly you just see

a rush of cyber attacks
towards whatever industry

China has said that
it wants to dominate in.

It's paint formulas.

It's Coca-Cola's
negotiation strategies.

It's think tanks.

It's diplomats.

It's university professors.

It's law firms.

People have started to realize

that this actually has become
a serious issue, or...?

I think it made people realize

that some of the
most vibrant companies

in the United States were
major targets, but I think

it took another 5 years
for companies that thought,

"Why would we ever be the target

of a state-sponsored
Chinese cyber attack?"

to wake up and say, "Oh shit,
we've been a victim too!"

But how was everyone so sure

China was behind
Operation Aurora?

I went to Washington to
talk to Dmitri Alperovitch,

one of the first people
to analyze the attack.

He worked with many of the
companies who were affected.

So how was it done?

It was actually
pretty ingenious.

So they actually identified
people inside the organization

that they were able to approach,

and social engineer them
to click on a link.

So you're talking about phishing
emails with malware payloads.

That's right.

In some cases, it was
actually an instant message,

not even an email, that
once you click on that link,

your machine is compromised
and the attackers take over.

And how did you
figure out it was China?

Once we started tracking all
the machines that were involved

in the compromise, and there
were these multiple of machines

that were set up for
command and control,

and where the connections into
those machines were coming from,

we started to see signs
that were pointing

to Chinese activity.

And later on, as we
expanded the investigation,

we started to
uncover other activity

that we were able to tie
together to this group

that we now call Aurora Panda,
a Chinese nation state group

that is really conducting,
to this day, espionage activity

into numerous organizations,
government agencies,

as well as private-sector
organizations across the globe.

Operation Aurora offers a
glimpse into how Chinese hackers

work within the
country's government.

(Soldiers chanting)

And more specifically,
its military branch:

the People's Liberation Army,
otherwise known as the PLA.

With these type of actors,
they get in and they wanna stay

as long as possible, because
they have a collection priority.

And even if they get
discovered and kicked out,

oftentimes they're back in
or trying to get back in

the next day because they still
have a mission to do, right?

This is oftentimes
a military operation.

You have a PLA general that's
coming to you as a soldier

in the PLA saying, "I need you
to get this information for me

from this company."

And you don't stop
because it's hard,

you don't stop because
you've been discovered.

You keep on going because you
were given a mission by your

boss to do so, and you don't
disobey orders in the military.

And you need to
achieve that objective.

Absolutely.

The hackers deployed malware

using an unfixed flaw
in Internet Explorer.

This is a real spear phish

we detected in
one of our customers.

So let's go to our
victim machine down here.

I have an email that's arrived
from a good friend of mine,

and there's a Word
document attachment

that I want to take a look at.

So who wouldn't click on this?

I certainly would.

So we just had the connection
from the victim show up here.

So this is our machine,
our victim machine,

that we are able to take over.

I can go to this
wonderful file manager,

which looks like just any file
manager you would normally have.

So I literally can just
highlight this and click

"Receive", and it sends
it over to my machine.

That's as easy as it gets.

Operation Aurora showed that
China was hacking some of

America's biggest companies,
and many of the attacks

were attributed to
hackers linked with

the People's Liberation Army.

If the Google hack
and others like it

are state-sponsored, that
means the Chinese government

is brashly stealing American
intellectual property

with one hand while making new
trade deals with the other.

The New York Times
and Nicole Perlroth

paired with a cyber security
firm, Mandiant, to track down

the physical location
of some of the hackers.

And they found them in Shanghai

at a PLA unit
known only as 61398.

We were able to trace thousands
of attacks on US companies

and companies in Europe
and universities

and research companies
and think tanks

back to this one
building in Shanghai.

And it was the first time
a security firm had

publicly pointed to...
not just to China,

but to a very specific
unit of the PLA.

There weren't a lot of windows,
but it was clear they had some

great satellite technology,
and it was very well guarded.

But other than that, it
was completely nondescript.

It was not as
high-tech as Fort Mead,

but it was very clear this was
actually a military compound.

To understand 61398, first
you have to understand

the relationship between
business, government,

and the military in China.

Melissa Chan worked in Beijing

as a correspondent for
Al Jazeera for 5 years.

Her reporting on
politically sensitive issues

got her kicked out
of the country.

Did they give you a rough
time when you were there?

They gave me and every
foreign reporter a rough time.

We all thought the reporting
environment in 2012

was pretty bad.

That was around the
time when I left,

and it's just gotten worse
according to foreign reporters

still based there.

What do you make of Obama making
cybersecurity top of the list

when it comes to
dealing with China?

I think it indicates
how bad that situation is

with cyber espionage.

Every government has
cyber espionage, right?

Including the United States.

You won't have an American
intelligence officer meet with

a Fortune 500 company CEO
and just hand over data,

and say, "Here, this is
what we got from the Chinese."

But we do know that the Chinese
do not see that differentiation.

I mean, the thing you have
to understand about Chinese

companies, even publically
traded companies that are owned

by private Chinese... you know,
that were started by private

Chinese citizens, is that
there's a corner office

somewhere where there's a
Communist Party representative.

So the Communist Party's

never far away from
any Chinese company.

There's always a
connection to the government.

I spent months trying to
speak with Chinese hackers.

When I finally came close, I was
shut down at the last minute.

But I did get a glimpse through
cybersecurity expert Ian Amit.

Amit met with Chinese hackers
at a tech conference in China.

IAN: We went to what
was called Excalibur Con.

A bunch of us - "us" is
Western security professionals,

speakers, hackers, whatever
it is - were invited to speak.

Were you ever offered to work
for the Chinese government?

Yeah, yeah.

They just came out
and asked you?

Pretty much, yeah.

What was your response?

No.
(Laughing)

A very nice "no", but...

Yeah, they had us, you know...
they even took us to a tour

in a business office
building that was empty.

And you know, walked us
around, showed us, you know,

"This can be your office.

Do you want the corner office?

How many people do you
need working for you?"

And they're not talking
about like five or six,

like, "Do you need 50, 60, 100?"

BEN: So this is the
office you'd be given.

IAN: Yeah, and again,
they built this in a year.

One year, everything.

Roads, residential...

Again, resources
is not a problem.

You just have a lot
of people build shit.

How do you gauge
Chinese hackers compared to,

you know, let's say the NSA?

I would say the same
rate, the same level.

Really?

If you assume any less
of that, you're a fool.

Then why are they trying to
poach American and Israeli...

More, more.

Having a diversity is
key in cybersecurity.

A lot of times when you bring in
people that are not necessarily

from your field of
expertise, can...

can be a huge leverage in
terms of your capabilities.

I would do the same.

I would try to recruit,
I would try to tap into

whatever resources there
are that I'm not aware of

that can enhance and
enrich my capabilities.

If they're grooming their
local cyber expertise in-house,

if I were on their end,
I would try to do the same.

I would try to bring in a lot
of outside perspective,

a lot of different thinking,
different approach,

because that's the key,

especially in a game
like cybersecurity.

You have to be adaptive,
you have to be creative.

- For innovation.
- Exactly, yeah.

Where the loss of American
intellectual property

was once kept secret, by 2014

the Obama Administration
was no longer silent.

For the first time, the
Department of Justice charged

Chinese military hackers for
breaking into US corporations.

Today, we are announcing an
indictment against five officers

of the Chinese People's
Liberation Army for serious

cybersecurity breaches against
six American victim companies.

These represent
the first ever charges

against known state
actors for infiltrating

United States
commercial targets.

The DOJ put five Chinese hackers
on the FBI's Most Wanted list,

all of them officers
in the PLA's 61398.

John Carlin tracks nation states
infiltrating US corporations.

You'll see the activity from
the location of this unit

of the PLA, 61398.

It starts around 9:00am, and
you see the spike in activity.

You go to around lunch.

They get a little lunch break,
and the activity goes down.

Then it resumes again
until the end of the day.

And there seems to be
roughly a 9-to-5...

- Government job.
- A government job.

So we just can't...

it's not fair to
American companies.

And what evidence did
you have against them?

We showed specific actions
on specific times on specific

dates, and photographs of the
individuals as they went into

company systems from these
dedicated hacker thieves

who are going in day in and
day out to steal information.

But they are wearing
PLA member uniforms.

If this is a
nation state attack,

why single out individuals?

We're not charging a country for
generically doing something bad.

We're proving up specific facts
against particular people

by name, by date,
here is what they did.

So in this case, we were able to
figure out the name and the face

behind the keyboard.

And the reason why our companies
are getting hammered day in

and day out by this type
of theft is because

the people behind the keyboard
think they're anonymous,

and these charges
show you are not.

And the fact is just because
you're wearing a uniform

shouldn't give you a free pass

when you commit that
same type of theft.

China was stealing some of
America's most precious intel,

the kind of trade secrets
that keep economies growing.

For some companies, the
results were devastating.

BEN: China has been targeting
all sorts of American companies

for trade secrets.

Daniel McGahn is president
of American Superconductor,

or AMSC.

The company specializes
in power technologies

such as wind turbines
and superconducting wire.

In an effort to
protect against hacking,

they kept their valuable source
code on an offline server.

But in 2011, one of
McGahn's employees

took a $2 million bribe to
hand over AMSC software code

to a state-owned
company in China.

Welcome to the future!

The story really kind
of falls out of a...

you know, a 1960s, 1970s
vintage spy movie.

The individual was approached,
the individual was turned,

there was offered
money, home, women.

The way he was motivated was
in the techniques of spy craft.

He had a penchant for
writing everything down.

If you know Skype, he tended
to use Skype to be able to

communicate and transfer files.

So we were able to
basically obtain everything,

from motive to when
the transfers happened,

who received them, and
kind of the end part.

You know, ha ha ha,
they won't need

American Superconductor anymore.

And what was the fallout?

The fallout was we had a
stock that was at about $25,

and it went to $12.5 in a day.

So we went from about
$1.5, $1.6 billion

to $800 million in
evaluation in a day.

So the stock
completely collapsed.

We know we're on a targeted
list of a lot of companies

in North America, that the
Chinese are looking to

obtain any valuable
technology that they can.

So we've had to try
to develop a capability

to protect such attacks.

So you're saying the
People's Liberation Army

has targeted your company
in hacking operations

to steal corporate secrets?

They've been happening since
this event, and they've been

happening subsequently
on a very regular basis.

What we've seen is when we've
gone back and we've used

third parties to try
to validate, you know,

where did these
attacks come from,

and the entities that... at
least that they're telling us

are directly linked
to the PLA and China,

the People's Liberation Army,
there is a move within China

to do this as part of kind of
normal operation of business.

And do you think this is
sort of a precursor to China

trying to overtake
America economically?

I don't see it as a
precursor; it's happening.

The desire is for
China to be #1.

They have the largest
population in the world.

Why shouldn't their
economy be the largest?

Even after all this, would
you still do business in China?

We still do.

We still see China
as an opportunity,

but those products
have to be paid for.

Customers pay.

To add insult to injury, a wind
turbine that was built by China

and sold back to the US

was running on the
stolen source code.

AMSC eventually replaced
the turbine's controller

and software with
their own tech.

Hoo!

So this is actually one of the
controllers that was stolen?

Yes, yes.

So the software stolen,

and the actual programming
of the turbine.

This turbine's close, but
it's definitely different.

Oh my god!

Ho!

We are definitely
72 meters in the sky.

BEN: But it's not as if
the US isn't spying

on Chinese corporations.

In 2014, Edward Snowden
leaked a trove of

National Security Agency
documents that revealed Huawei,

a Chinese telecom giant,
was a US target.

And according to the
German magazine Der Spiegel,

the NSA managed to access the
source code of Huawei products

in order to tap communications
of targets who use them.

But the US government
says there's a difference

between traditional espionage

and stealing trade
secrets for profit.

So the administration
is still holding out

the threat of sanctions.

Do you think sanctions
and diplomatic ploys,

do you think
that'll really work?

It will work because look at
what they're stealing here.

In one case that we charged,
they were stealing the formula

for the colour white.

That is not a
national security secret.

They are stealing that so that
they can compete and make paint,

white paint that
people think is popular.

That's all driven by profit.

This is a cost-benefit game.

As long as they think
it's cost-free to steal

this information, they're
going to continue to do it.

And we need to keep
raising the costs

until the behaviour changes.

With the help of
stolen American-made IP,

China has set it's sights
on overtaking the US

as the #1 economic
superpower in the world.

If we could put a dollar
value on all this hacking

against corporate America,
what would it be?

It's impossible at this point.

People have tried.

The former commander
of Cyber Command

has put it in the trillions.

There's just... How do you put a
price on intellectual property?

And is this just the beginning?

Or what's the future
hold for corporate America?

I think it's a question
of is it too late?

Has the IP already
left the building?

And if it has, are we going to
suddenly see carbon copies

of Benjamin Moore and Coca-Cola
and Lockheed Martin

pop up in China over
the next 10 years?

And the next chapter is:
when are we going to see China

really using our own
intellectual property

to their economic advantage?

And I don't even think we've
seen the beginning of that yet.

It's tough to know what's next

when China keeps such tight
control on their hackers,

and almost no information
leaks out of the country.

But it's also hard to believe

that the sophisticated cyber
force of a rising superpower

will suddenly just change
its MO because America said so.

♪