Google, China and Reality

It looks like Google has finally run into the Chinese form of "screw you forward, screw you backward, or just plain old fashioned screw you."

Like many other well-known organizations, we face cyber attacks of varying degrees on a regular basis. In mid-December, we detected a highly sophisticated and targeted attack on our corporate infrastructure originating from China that resulted in the theft of intellectual property from Google. However, it soon became clear that what at first appeared to be solely a security incident–albeit a significant one–was something quite different.

First, this attack was not just on Google. As part of our investigation we have discovered that at least twenty other large companies from a wide range of businesses–including the Internet, finance, technology, media and chemical sectors–have been similarly targeted. We are currently in the process of notifying those companies, and we are also working with the relevant U.S. authorities.

Second, we have evidence to suggest that a primary goal of the attackers was accessing the Gmail accounts of Chinese human rights activists. Based on our investigation to date we believe their attack did not achieve that objective. Only two Gmail accounts appear to have been accessed, and that activity was limited to account information (such as the date the account was created) and subject line, rather than the content of emails themselves.

Third, as part of this investigation but independent of the attack on Google, we have discovered that the accounts of dozens of U.S.-, China- and Europe-based Gmail users who are advocates of human rights in China appear to have been routinely accessed by third parties. These accounts have not been accessed through any security breach at Google, but most likely via phishing scams or malware placed on the users’ computers.

First, the US Authorities don’t care.  This is almost-certainly state-sponsored (by China) or at least tolerated.

I have been tracking these attacks now for more than five years.  See, I write (among other things) security software, including spam-filtering code.  It is somewhat of a hobby now, but was a major focus when I ran MCSNet – we were the first ISP in the United States to offer customer-configurable spam filters.

A number of years ago I detected a very disturbing pattern.  A huge number of attacks were being fomented from both China and Russia.  They were sophisticated, not the typical "script kiddie" nonsense that everyone sees on a daily basis.  They were aimed both at machines I had direct control over and those of some of my customers, including some who were of a "sensitive" nature.

My current "best practices" recommendation to firms that I work with, along with what I have implemented on my own machines, places an absolute bar on all but external consumer-visible web services against all IP address blocks that are assigned to China, without exception. 

Doing so has cut the incidence of malicious "probes" and attempted penetrations on the machines I have administrative responsibility for by 95%.

To be blunt: Nobody in our government gives a damn about the fact that China is the source for most of this crap. 

This is in fact a form of cyber-warfare, and is not entirely aimed at business interests.  Some is pointed directly at public-safety and government servers.  Our government at all levels knows of this.

If China was lobbing missiles into our nation on a weekly basis we would soon declare war.  At minimum we would stop buying their crap, force all their nationals to leave our soil and bar any of our citizens – or corporations – from spending money there.

But we don’t, because we have extended "most-favored nation" status to them as a "trading partner."

Why our corporations tolerate this crap, beyond our government doing so, is entirely beyond comprehension.  You can walk down streets in China – a nation that is essentially a police state, where dissidents are locked up for years for mere speech or even "disappeared", and buy bootlegged copies of literally ANYTHING for pennies.  Chinese companies routinely rip off anything they can get their hands on and duplicate it without fear, patented, copyrighted or not. 

Why does a company like Intel tolerate this?  Why does Microsoft? 

Why do our stock exchanges allow firms to be listed here (BIDU anyone?) that are headquartered and operate within China?

Why does our government put up with this crap?

Then there is the "bend over the table" game that Yahoo got caught playing.  They agreed to turn over data to the Chinese authorities using procedures that would never be legal in the United States. Is Google innocent of this?  I don’t know.

What I do know for a fact is that China is a nation that has no respect for what we consider to be basic human rights.  They do not recognize a right to free speech, they do not respect a right to privacy of one’s person and they do not respect property rights in any way, shape or form.  They steal intellectual property (and sometimes physical property) at whim, and even allow the sale of stolen property in an open and wanton matter – so long as you’re Chinese.

We have prostituted ourselves and our nation to these craven thugs and a government that in many ways is no better than The Third Reich.  Google may be right to bleat, or they may be covering their own butts, having made a deal they thought would be honored and now finding that you cannot deal honorably with someone who considers anyone who is not part of the Chinese government to be inferior and devoid of any rights whatsoever.

If China does not wish to buy our Treasury debt (they have already stopped) so be it.  We can close our borders to their cheap crap – their lead-painted toys and now, we discover, cadmium-laced costume jewelry – again, a poison made in China being sold to our children.  Read that article – it contains wonderful statements by Chinese manufacturers like this gem:

Lead and cadmium are commonly found in metal jewelry sold in China simply because it’s cheaper. A ton of high-quality zinc costs about 28,000 yuan ($4,100) while zinc with lead, cadmium or both in it sells for about 16,000 yuan ($2,350), said Frank Zhang, an executive with a jewelry factory in Yiwu that specializes in high-end exports but who did not want his Chinese or company names used.

Industry executives said most of the low-end goods with high amounts of cadmium are sold in China and increasingly sent to Dubai and other markets in the Middle East with less stringent import controls than the U.S. or Europe.

….

Chen Zaiying, manager of the Yiwu SK Jewelry shop in the International Trade City, echoed Devereux’s comment, saying many Chinese manufacturers combine hazardous batches with others that comply with regulations in the destination market.

Got it?  They intentionally cheat and ship things they know do not comply with a purchase order’s requirements (do you really need to specify "must not be a known poison" for something intended to be given to a kid as a piece of toy jewelry?) and intentionally intermingle poison products simply because it’s cheaper for them!

If we poisoned Chinese children with products exported there they would (rightly so) consider us to have committed an open act of war against their population.  Why is it that we continue to permit this sort of outrageous conduct – the intentional endangerment of our youth – to take place all so we can claim to have an "open trade" policy with those who are intentionally shipping poisonous products for consumption by our kids?

I believe we can – and should – go so far as to selectively default the Treasury debt they hold, simply declaring it worthless, as a "fair exchange" for all the intellectual property they have stolen from our nation’s firms over the last two decades and the intentional, repeated and wanton poisoning of our nation’s youth.

Whatever really happened with Google China’s government is long past its "use by" date and our government’s continued bouts of kneeling before China’s premier, all in the name of $30 DVD players, destruction of our manufacturing capacity, support and financing for Chinese human rights violations and the poisoning of our children, must end here and now.