Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Feds: Chinese spies orchestrated hack that stole aviation secrets (arstechnica.com)
195 points by okket on Oct 31, 2018 | hide | past | favorite | 84 comments


I used to work at Nortel Networks along with 130,000 other people. Nortel went bankrupt and now everyone who used to work there is fighting for their pensions. Apparently a major contributor to their downfall was all of the IP being stolen and sensitive information about deals going down otherwise exfiltrated by Huawei[1]

People need to get serious about protecting the privacy of their communications and data. Nobody cares until it is too late. Seems like this kind of event might be the incentive people need to make the extra effort to use products that encrypt their data in rest and in motion.

1: https://www.afr.com/technology/web/security/how-chinese-hack....

I made this comment earlier on a story about China POPs in Canada and USA nefariously re-routing traffic through China Telecom networks but that story was marked as a dupe by the time I made my comment so no discussion ensued.


> Apparently a major contributor to their downfall was all of the IP being stolen

If a company is heavily dependent upon existing IP then having it all stolen will be a major contributor to their downfall. But so is that dependence. Hard to make suggestions without appearing to victim blame, but companies need to be able to survive even without secrets.


I didn't want to pin the downfall of Nortel completely on the IP being stolen and being outmanoeuvred in deals.

During the dot-com bust they also lost a bunch of money selling carriers equipment on credit and that is when the tough times and inability of the executives to right the ship began.


Why? If you follow that standard, you are basically saying that no R&D should ever be done, because you may just get it stolen and lose any kind of benefit you would derive from doing the R&D in the first place.


That's not what I'm saying. I'm saying don't build an overly large dependence on past R&D where resting on those laurels threatens the whole company if theft occurs.


Couldn’t the new R&D be stolen as well? It sounds like you don’t like Coca Cola classic.


A company who "goes out of business because their IP was stolen" was already going out of business before it was stolen.


I love reading about the Chinese efforts in developing a modern turbofan engine. For whatever reason, they just can't build a good medium- or high- bypass turbofan in-house. They're latest WS-20 is basically a clone of the CFM-56 and previously they spent decades developing the WS-6 and WS-10 that never met expectations.

This is a big deal because the Comac 919 is ready to go but without a powerplant, they're having to turn to Western sources for an engine. The same thing happened with the J-10 project a decade ago and again recently with the J-20. Without a reliable powerplant, you can't build good airplanes and you can't easily reverse engineer a precision turbofan.


China also couldn't make a ballpoint pen until last year [1].

I imagine making a modern jet engine is somewhat more challenging than making a ballpoint pen (both endeavours involve making high precision metal parts).

[1] https://www.washingtonpost.com/news/worldviews/wp/2017/01/18...


"Couldn't" is a bit unfair. The article seems to imply that it wasn't from a lack of trying, but a lack of interest, and a company only took on the challenge after the issue became considered an issue of national pride and came to light.

The numbers given suggested that it cost just over $17 million to import the pen tips to manufacture 38 billion pens. Which puts the cost per tip at $0.00045/piece.

It's not hard to see why manufacturers wouldn't bother creating a process and tooling for that if it already exists.

More importantly, the article put emphasis on the idea that once the government complained about it, something was done quite quickly. Which is completely different story to a military jet engine, which is being researched, funded and developed by government-linked organizations.


Indeed, a aviation company ( Miles Aircraft ) in my home town took a license from Bic in the late 1940s to start manufacture of their roller-ball Biro pen.

I have a hard time believing that China couldn't replicate that technology for 70 years.


The Soviets also couldn't crack the jet engine but the English helpfully provided a Rolls-Royce engine for the Mig-15 just in time for the Korean War.

"What fool will sell us his secrets?", asked Uncle Joe Stalin. "I will", said Sir Richard Stafford Cripps, CH, FRS.


I wouldn't brand this decision as foolish. In the rapidly shifting balance of scales, perhaps someone on the island didn't want a former colony to have everything.

Or perhaps not; either way, there could have been good reasons - see discussion here[1]

[1]https://www.quora.com/In-the-beginning-of-the-Cold-war-why-d...


Having the designs itself can only carry you so far. You also need the fine precision tools, materials engineering, software, etc in order to build sophisticated machinery.

China is advancing quickly but they can't make up 200 years of industrial headstart by the west in 20 years.


When we were discussing the Bloomberg story, I replied a couple of times to people hypothesizing maybe it was an American government conspiracy to turn people against China. My reply is that we didn't need to make up such stories, because we've got plenty of much better sourced ones already. For those who were wondering, here's an example. It still isn't proof, of course, but I think we can generally agree it's almost certainly better sourced than the Bloomberg story, which is all I'm going for here.


It wouldn't seem necessary to fabricate such elaborate stories because:

1. Most Americans aren't paying attention / don't respond to them.

2. We clearly have a situation where POTUS if he wanted could just make up a story and get people's attention.

On the other hand stories like this would fit in nicely with state run / controlled media as the feed could simply be placed where you know it would get attention (if only because it is exists largely by itself).


As an ethical Chinese myself, I'd like to reiterate that this type event is government-backed. And I am confident that HNers respect the boundary between Chinese people and the government.

I do want to point out that general Chinese people in mainland China view these type of activities negatively as well. It should not be thought as the general people endorse such activities, they were mostly made unaware of these, as always.


As a foreigner living in China, I can say that the populace is like many other countries. You have your normal people who don't really keep track of what's going on, you have your informed people who have informed opinions and realize that the world is a complicated place, and then you have your crazies who are filled with distrust of other nations and conspiracy theories in the name of nationalism and patriotism. There are some people who view these activities as negative, and there are some people who view these activities as positive, and there are some people who never even think about it. We must acknowledge there are many in China who do endorse these activities too, just as there are people in the US who feel bombing North Korea is the right thing to do. There is no need to make things look nicer than they are, just as there is no need to make things look worse than they are.

And ironically, let's face it, every country is doing something in the spy game, China is not alone in using underhanded methods to steal secrets and intelligence. And each country can easily spout their justifications too.


I'm not sure what your point is in your last two sentences. Should the US not defend its interests against foreign powers?


OP is saying that the US doesn't have the moral high ground and anyone spouting off about how badly China is acting is just being asinine since we do the exact same thing to everyone (and if we weren't then our intelligence agencies need to get off their asses and do it).


There is a fine line in spycraft. Stealing secrets from companies for commercial gain is just pathetic. Can't innovate, just hack it and steal it.


When was it that the NSA was caught stealing lists of clients from Embraer and giving them to Boeing? I can't remember if it was 2015 or 2016...


I hadn't heard of this before, but now I'm curious - do you have any more details on this?


It was in 2013. And the international press seems to be much more focused on Petrobras, where the NSA stole a lot of data than Embraer where it just stole some emails.

Here's a link:

https://www.theguardian.com/world/2013/sep/09/nsa-spying-bra...


> Stealing secrets from companies for commercial gain is just pathetic. Can't innovate, just hack it and steal it.

Learn your history. Everyone does it. Europeans and Americans did it. Now the Chinese are doing. The only reason we're bitching is because now we're the targets instead of the thieves.


Do you have any links about about industrial scale hacking for commercial profit by those regions?


https://www.newyorker.com/magazine/2014/06/09/spy-vs-spy-3

Everyone is standing on the shoulders of someone else.


Industrial espionage is older than the digital age and is not confined to hacking. It has been happening for centuries and many civilizations have undertaken efforts to take knowledge that was legally protected.

https://en.wikipedia.org/wiki/Smuggling_of_silkworm_eggs_int...

https://www.atlasobscura.com/articles/porcelain-corporate-es...

Harris, John (1998). Industrial Espionage and Technology Transfer: Britain and France in the Eighteenth Century. Aldershot: Ashgate Publishing Limited. p. 680. ISBN 0-7546-0367-9.

https://www.smithsonianmag.com/smart-news/how-industrial-esp...

https://theintercept.com/2014/09/05/us-governments-plans-use...

https://www.the-american-interest.com/2014/12/10/the-new-ind...

https://searchinginhistory.blogspot.com/2015/02/francis-cabo...

https://www.pri.org/stories/2014-02-18/us-complains-other-na...

https://www.hsdl.org/?view&did=3729

The fact that we don't hear much about our own examples of stealing other civilization's secrets is just a matter of the fact that we are now ahead. If the tables were turned just like they were in the past, we'd go right back to stealing other people's tech. To say that other people shouldn't do things that we have and would do makes little sense. That isn't to say that we shouldn't protect ourselves, it's just to say that people need to stop the damn moralizing as if we were any better.


While it's nowhere near the scale of what China has done and is doing, NSA has engaged in industrial espionage to benefit the US economy as well. Few nations can say their hands are clean when it comes to this stuff.


> As an ethical Chinese myself

What is unethical about nation states spying on other nation states' militaries? The aerospace industry - of every country - is intimately entangled with their defense departments.


I am afraid that there is a tenancy to equalize people and the government, especially for Chinese...


I don't think most do, I don't.

But, I don't think China is somewhere I would want to live and it has nothing to do with the people. Then again for the same reason ok wouldn't want to live in the US right now


Turnabout is fair game, to some extent. Look at the history of European porcelain, or tea. There's a fascinating documentary on CuriosityStream about Robert Fortune, who essentially committed industrial espionage for the East India Company and obtained samples and processes to kickstart tea production outside of China.

https://curiositystream.com/video/1746/tea-war-the-adventure...


It is a really interesting shift from throwing spies out of the country to criminally indicting them. I wonder if we will see similar indictments brought against US agents in the future.


Nothing has shifted. Spies without diplomatic immunity have always been criminally prosecuted. Often they're held in prison for a while, then quietly repatriated in return for one of our spies or some other political concession.



Those spies were apparently Chinese nationals, so Beijing would have considered them traitors. In the West that draws a long prison sentence. China and Russia are less gentle.


I have a serious question: why don't governments impose sanctions on other governments that hack them when there is sufficient proof?


Here's a few ways of thinking about it:

1. Escalation, the instinctive response of angry humans, is generally a bad idea in international relations (or any relations). I once read a veteran practitioner express it this way: 'The job of international relations is to prevent a B-level problem from becoming an A-level one'. The U.S. and China, for example, have a very large number of interactions on an enormous number of issues; if someone retaliated every time they were unhappy - and then of course the other side would re-retaliate - that would be all that was happening, lots of treasure would be wasted, war would be risked, and positive things wouldn't get done. That doesn't mean that you do nothing, but you need to respond in a way that doesn't escalate the situation - it's not always easy to thread that needle, but that's what the professionals are there for. Another reason retaliation is bad is that it puts the other side in control of your actions - they can provoke you into doing what suits them, when it suits them. You want to act at the time and place and using the means that best suits you, not dance to their tune.

2. The U.S. does take action against them, but not in public. This helps prevent escalation - the Chinese government isn't publicly challenged and forced to respond.

3. Espionage is, in one sense, like a state of war. The U.S. is already doing all they can to shut down Chinese espionage and to spy on China, and vice versa. China isn't breaking any rules in the context of espionage (AFAIK), and if the U.S. could do more, they'd already be doing it.


Because that would be hypocritical. Most likely all large governments try to hack other governments.


Exactly, and, as we all know, hypocritical crimes are treated very seriously by very toothful U.N.


Most likely because they all do it


You don’t think some part of the tariffs is because of this?


It is, I have no idea why you have been downvoted


Because every government hacks, spies on and steals from every other government. The US was built on stealing tech from britain.

https://www.pri.org/stories/2014-02-18/us-complains-other-na...

Going back even further, the byzantine empire stole silkworms to break china's monopoly on silk.

https://en.wikipedia.org/wiki/Smuggling_of_silkworm_eggs_int...

As a matter of fact, the biggest spies and thieves in the world are allies. Do you know who spies on the US the most? It's not china. It's not russia. It's actually canada, britain and israel. Do you know who we spy on the most? Our allies. We aren't going to sanction our allies.

Think about it. Why do countries have intelligence agencies? Should we sanction all countries with intelligence agencies?


> ....a hacking group calling itself the Syrian Electronic Army hacked an Australian domain registrar

> In early December 2013, prosecutors said, members of the conspiracy used the same tactic to hack the Australian registrar again, this time to hijack domain names of one of the targeted technology companies.

What's with that registrar, don't they learn from their own mistakes?


It's Melbourne IT. A terrible company that somehow still gets large contracts despite ripping clients off at every step. I'm sure their entire staff is underpaid 457s.


I used to be an underpaid 457 for nearly a decade until I got PR. Just because someone is an immigrant on a work visa doesn't mean they're incompetent. And organisational culture is a top down process, not a bottom up one. So blaming the workers seems misplaced when it is most likely a management issue (who probably aren't 457 holders). That would probably be more accurate.


As much as I think the tariffs are not the right solution, something needs to be done to punish Chinese aggression towards the West. They've been playing very dirty without any real consequences. Trade should not be conducted through industrial espionage or intelligence agencies as a standard approach.

The blurred line between Chinese intelligence and Chinese businesses is a dangerous one as it can turn IP theft into a real escalation.


Everybody is talking about the social aspect of Bolsonaro in brazil, but the major thing people are ignoring is the impact on China. Together US and Brazil produce 80%+ of the worlds soybeans and corn. Brazil has been friendly with China for years but Bolsonaro hates them more than Trump. If they work together they can effectively starve China into complying with trade laws


> Trade should not be conducted through industrial espionage or intelligence agencies as a standard approach.

That's literally how it's worked throughout history. Europeans did it. Americans did it. Now the Chinese are doing it.

Should and how the world actually works are two different things that do not always align.


Remember that the CIA did worse (like droning children in Yemen), be careful what you wish for.


I thought the topic was world trade.


The topic is exposing spying operations in a bigger narrative of victimhood.


Yes, and the American people are allowed to talk about that, protest it and discuss it without being imprisoned. The knee-jerk "whataboutism" in discussions like these does nothing to help.

While I understand the desire by many to hold the US more accountable, combined with the instinctive "love the underdog, hate the champ" philosophy that shapes the narrative of the global left wing, keep in mind that China's current state-capitalist structure is, economically, much more similar to Nazi Germany than to any Socialist or Communist state of the past.


1) the whole point would be to prosecute it, not "discuss it". It's allowed to be discussed to the extent that nothing comes out of it, hence the classification of the details.

2) Remember that the narrative of the current US president is that the US is the underdog attacked from everywhere, and so some categories of enemies should be designated and dealt with at large scale and brutally, some of those ennemies will be internal sub-categories of people, and that the economy of war should be reinforced.

I am not really defending China (just a bit, because I feel the racist undertone on those attacks), but I think having the last super-power behave like a good neighbor and a role model would have a more positive impact on the world than designating a few ennemies, waging war, destroying internal democracy to concentrate the power, and acting generally like a bully.


>I think having the last super-power behave like a good neighbor and a role model would have a more positive impact on the world

the US was the only country on earth that had nukes for 5 years and was unscathed from WWII. We could have enslaved the entire planet under threat of nuclear fire, but instead we gave away billions to help Japan and Europe rebuild. There's never been a more selfless act in human history as far as a country not seizing an opportunity to gain power is concerned. There's probably never been a larger power disparity between a single country and the rest of the world than post WWII USA, and they did exactly nothing to take advantage of that disparity.

Not to say US is innocent in recent years, but it's still minor considering there's nothing stopping us from plundering the world other than our own morals

>I am not really defending China (just a bit, because I feel the racist undertone on those attacks)

Russia gets slammed just as hard on all fronts and nobody cares to defend them, China can take a little abuse.


So if the citizens of a predominantly white country take issue with industrial espionage by a country which happens to be filled with Han Chinese, it automatically has racist undertones? That is absurd. Are we racist towards Russians for spying as well?

Additionally, please elaborate on how the US is currently "destroying internal democracy".

As far as bullying goes, if you are referring to the trade war, I think blowing up trade deals which were drawn up decades ago to help sustain western Europe against Soviet aggression is a good thing, and long overdue. Germany shouldn't get to be the only rich nation with jobs for its working class. Likewise, China shouldn't get to pretend to be a developing nation (WTO) while keeping their citizens poor by devaluing the yuan to maintain mercantilist policies.


And China is literally exterminating the uighurs.

Your point? Orthogonal to the issue at hand.


>Besides using spear phishing, watering holes, malware, and domain hijackings, prosecutors said, the defendants also recruited employees of some of the targeted companies to infect corporate networks and provide intelligence about investigations.

This lines up with having a Chinese spy in California Senator Diane Feinstein's office: Being both a California Senator and a 'Gang of Eight' intelligence member, the Chinese could be alerted early on about potential investigations or indictments.

https://www.sfchronicle.com/bayarea/matier-ross/article/Sen-...

We've seen several indictments of Chinese nationals since this story broke.

Edit: Actually the previous indictment I had in mind was the original arrest of the agent, this is just building on that case: http://www.atimes.com/article/chinese-agent-indicted-in-jet-...


> This lines up with having a Chinese spy in California Senator Diane Feinstein's office

That's not really an accurate description of what happened. Here's Feinstein's statement:

"Five years ago the FBI informed me it had concerns that an administrative member of my California staff was potentially being sought out by the Chinese government to provide information. He was not a mole or a spy, but someone who a foreign intelligence service thought it could recruit.

The FBI reviewed the matter, shared its concerns with me and the employee immediately left my office. He never had access to classified or sensitive information or legislative matters. The FBI never informed me of any compromise of national security information."

Nothing in your article or any other reputable sources I've read conflict with that statement.

From your article:

'“He didn’t even know what was happening — that he was being recruited,” says our source. “He just thought it was some friend.”

The FBI apparently concluded the driver hadn’t revealed anything of substance.

“They interviewed him, and Dianne forced him to retire, and that was the end of it,” says our source.'


Confused, why is this downvoted? Is it wrong?

Update: Funny, now the comment is upvoted and my question is downvoted :-)


Sort of, it's extremely misleading. It suggests that there is no evidence of espionage because charges were never pressed, but consider:

>According to four former intelligence officials, in the 2000s, a staffer in Senator Dianne Feinstein’s San Francisco field office was reporting back to the MSS. While this person, who was a liaison to the local Chinese community, was fired, charges were never filed against him. (One former official reasoned this was because the staffer was providing political intelligence and not classified information—making prosecution far more difficult.) The suspected informant was “run” by officials based at China’s San Francisco Consulate, said another former intelligence official. The spy’s handler “probably got an award back in China” for his work, noted this former official, dryly.

https://www.politico.com/magazine/story/2018/07/27/silicon-v...


Here's the rest of what that article says about the topic. I'm not sure why it brings up the topic 2x in the same article. It looks like this paragraph is a revision of the first.

"Former intelligence officials told me that Chinese intelligence once recruited a staff member at a California office of U.S. Senator Dianne Feinstein, and the source reported back to China about local politics. (A spokesperson for Feinstein said the office doesn’t comment on personnel matters or investigations, but noted that no Feinstein staffer in California has ever had a security clearance.)"

None of that contradicts what your first article said, that the staffer didn't know he was being recruited. He was talking about local politics to someone who worked for the Chinese government who was pumping him for information.

The rest is just speculation on the part of someone the reporter talked to about how he could have theoretically committed a crime despite not being prosecuted.


>He was talking about local politics to someone who worked for the Chinese government.

Everyone in the government contractor industry (or government itself) gets annual training on spotting these sorts of leaks. Just discussing any stuff (even if you don't work with classified things) you're doing at work with a foreign national is touchy enough that many people avoid doing it all together. Everyone who works for the federal government or a company that works for the federal government is well aware of this. This isn't an innocent mistake. It's highly unlikely that this guy didn't know what he was doing was questionable.


This guy wasn't working in the defense industry, and he wasn't in a sensitive enough position to warrant any kind of clearance.

I'm sure someone talked to him about it, but it's unlikely he got any sort of serious training.

He supposedly talked to someone who worked their way into his life over several years about non-sensitive, non-classified material related to local politics. I imagine he would have been more careful/aware if the "friend" was asking about classified information, or if his "friend" hadn't done it very slowly.


Fortunately we have the indictments now that demonstrates the methods, if not not the sources, of similar activities described in the Politico expose, and in light of this it makes Feinstein’s office’s charitable characterization of that staffer look awfully naive. That no California staffer ever held a security clearance is a response to the wrong question, even an intentional misdirection.


The President, and some partisan media organizations were pushing a narrative that the mainstream media was covering up a conspiracy. I'm assuming the people down-voting believe the conspiracy theory.

https://www.snopes.com/fact-check/feinstein-chinese-spy/


Why is a Snopes link being downvoted?


A friend of mine is volunteering for someone's campaign.

He said as soon as it was semi public that he was involved his personal email lit up with fake emails. His email wasn't even listed anywhere in association with the campaign and he didn't use it for the campaign. Presumably they just guessed it (could have done that easily) or they found a list or something.

So just getting involved, now you're personally involved all the way.


I hear in the news stories about companies being highjacked by hackers, where the hackers encrypt said companies' data and demand a ransom. If that is possible, then wouldn't it be possible for US backed hackers to do the same to the Chinese backed organizations that stole American IP?

It seems ineffective to just publicly indict Chinese hackers that are in China. The indictments are public, so the likelihood that said hackers come to the US are nill. Seems more effective to erase the trade secrets, or any other data, from these organizations.


That would raise a variety of other serious issues. Besides the ethical problem that just because someone else does something bad, doesn't make it ok for you to do that bad thing.

I could list several important reasons why "hacking back" would be a bad idea, but I'll just stick to the pragmatic "people who live in glass houses shouldn't throw stones". We have a much larger surface area and much more to lose if we get into that kind of tit-for-tat. Instead, the US is building a case that China is an aggressor, and is responding in other ways that will apply more pressure. For example, tariffs on Chinese exports.


[flagged]


I dont see any racism in headline?


There isn't any. It's a very obvious attempt to divert from the subject of the discussion (China stealing tech from the US) by using an aggressive cover (racism) that is heavier than the focus subject.


OP is skipping ahead to the inevitable scaremongering which will be racism. It's already happened multiple times with incompetent federal agents making up phony charges, ruining people's lives, and then dropping the charges a year later when it becomes obvious that they have no case because they were just being racist.


I suppose it's perpetuating the idea that a government is representative of all its people: the spies are from the people of China, as opposed to the government of the PRC.


> A 21-page indictment filed in US District Court in the Southern District of California said the Jiangsu Province Ministry of State Security, an arm of the People’s Republic of China’s Ministry of State Security, directed the five-year campaign.

How would you call the spies if not "Chinese"? They are the People’s Republic of China’s Ministry of State Security's spies.


> How would you call the spies if not "Chinese"? They are the People’s Republic of China’s Ministry of State Security's spies.

CCP spies? Chinese Communist spies? Personally, I've been trying to correct my use of China/Chinese to "Communist Party" when talking about PRC government topics. I think that's more accurate since the PRC government dominates the Chinese people more than it represents them.


I'm aware of the difference between the Chinese government and the people of China in the same way I can distinguish between the people of Russia and their government. Same for Germany, the US or any other country. This race card play is diversionary.


Then you must also be aware that a very large amount of people are not aware of or don't care about the difference. The race blind card exists as well.


The headline is not "racist" it just doesn't explicitly differentiate between the people of the country and the government of that country. Calling it racism changes the topic of the conversation without starting a substantive conversation about racism or the relationship between citizens and their government.


> The headline is not "racist"

The consequence remains the same with the people I mention that don't care about or are aware of the difference between:

> it just doesn't explicitly differentiate between the people of the country and the government of that country.

> Calling it racism changes the topic of the conversation without starting a substantive conversation about racism or the relationship between citizens and their government.

Ignoring the fact that we have a very, very large amount of shitty people that will start using this to do racist things is just as problematic.


If the "spies" really did "steal" (i.e. copy) an engine design then it seems like a good thing for the world in general. They have helped spread useful knowledge.

Sure, it's bad for the would-be rent-seekers whose plans have been threatened. Why should anyone else care about them?

Thanks China, and keep up the good work!


By "rent-seekers" you mean organizations that have spent billions of dollars to research and prove the tech? As the current top comment represents, if company A spends billions of dollars creating a technology, then company B steals it, company B can sell it for less because they don't have to pay the R&D overhead. Company A falters or dies. The company that actually knew how to advance the field and create new tech suffered. Is that good for the world?

The way it is supposed to work is, company A researches a tech, company b also researches a tech, the best one wins (or more likely they split the market), the competition induces more advances, and eventually the old tech becomes cheap (or free) and widely available as it is supplanted by even newer, better tech.

And yea I know our patent system is broken, etc. But I don't understand how you can have a general principle that the people who created something don't have the right to benefit off of it.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: