The White House is preparing a slate of sanctions it could bring against Chinese enterprises in response to cyberattacks against American businesses, a government official familiar with the process told CNN.
The move is a show of force on the issue just a few weeks ahead of a state visit by Chinese President Xi Jinping, and comes amid growing tensions between Washington and Beijing over China’s increasingly assertive national security posture.
Preparing the sanctions is the latest in a series of steps the administration has taken to try to show that it takes cyberattacks on U.S. business seriously — but following through with sanctions would take the issue to a new level.
The U.S. official, however, said the administration had not made a final decision on a timeline to impose the sanctions.
The Washington Post on Monday first reported that the United States was weighing such action.
The sanctions, if imposed, would go after Chinese entities that steal American business secrets, a practice U.S. companies have long complained of. But they would also come on the heels of a massive hack of the U.S. Office of Personnel Management that compromised more than 21 million sensitive government employee records and background checks. The United States has accused China of being behind the hack.
The sanctions authority that would be invoked — via an executive order signed by President Barack Obama in April, which gives the administration the ability to sanction entities worldwide for engaging in cyberattacks against U.S. targets — doesn’t address traditional government espionage hacks like OPM, but that breach looms over the decision.
Experts said it’s no coincidence that word of the preparations is coming out just a few weeks before Xi’s state visit at the end of the month. The threat of sanctions, they indicated, is designed to give the United States some leverage going into those talks.
“The main point here is to send a message to the Chinese,” said James Lewis, a cybersecurity expert at the Center for Strategic and International Studies.
“It lets them know that there’s a cost to doing this, which is something they didn’t have to think before,” he explained. “It helps reframe the debate.”
He continued, “It’s not like Xi’s going to come in and say, ‘I’m sorry, you’re right. It’ll never happen again.’ But it does tell the Chinese: ‘You’re not going to be able to try to pretend (cyberespionage) didn’t happen.'”
Lewis said the administration began seriously talking about what it wanted to do on China early this summer, with some parts of the government, like the military, looking for more aggressive action. But sanctions have the appeal of being both flexible and tangible, Lewis said.
In the meantime, the volatile Chinese economy has proved to be an unexpected factor, with the threat of a Chinese economic crisis making Xi’s visit even more important for China and adding pressure on the United States to tread carefully.
The April executive order allows the Treasury Department, in consultation with the Justice and State Departments, to go after the assets of any individuals or organizations that engage in or economically benefit from stealing trade secrets from American companies by hacking.
Though the United States has sanctioned individuals in China in the past for offenses including supporting terrorism, and has added sanctions to its existing penalties on North Korea for the country’s cyberattack on Sony Pictures Entertainment, the United States. has never before sanctioned individuals for an act of cyberespionage. That has frustrated American companies, which complain the Chinese government has engaged in unbridled attacks on U.S. targets to steal any intellectual property it can get its hands on.
China has repeatedly denied involvement in cyberattacks on the United States, even as the United States has placed greater pressure on China to fess up.
“It is the consistent position of China to firmly combat all forms of cyberattacks,” Foreign Ministry spokesman Hong Lei said in June when asked about the OPM hack. “We hope that the U.S. side would discard suspicions, refrain from making groundless accusations and show more trust and conduct more cooperation in this area.”
The White House has tried to send the message to China before that it won’t tolerate such attacks. Obama raised the issue with Xi in a meeting in California in 2013, and his Cabinet has continued to convey that message in talks with China. The Justice Department also indicted five Chinese military officials in 2014 on accusations they hacked U.S. businesses to steal trade secrets, upping the ante on publicly calling out Beijing for engaging in cyberespionage.
But even the administration has not expressed high hopes of bringing those individuals to the United States to stand trial, and many hard-liners have questioned why the White House wasn’t using the highly detailed indictments to go after the businesses in China that alleged benefited from the stolen intellectual property.
Now, sanctions would be the first time the United States imposes a tangible cost on China for the economic cyberattacks the administration has spoken against for years. And officials hope the message hits home even before the state visit of Xi, whether or not the sanctions are imposed before then.
Norma Krayem, a former Clinton administration Commerce and State Department official, predicted the sanctions would come after the state visit, but the leak of their preparation gives the United States leverage going into those talks.
“I think the administration is making it clear prior to that visit that this is an issue of great import, and that the U.S. will stand behind its assertions that China and other nations need to stand down on its actions in cyberspace,” Krayem said. “The biggest issue for the U.S. is making it clear on the international stage that they will do what they have to protect U.S. businesses. On the global arena, you cannot tell your opposition to stand down and, when they don’t, take no action.”
Lewis agreed: “In some ways that’s the shrewdest way to do it, because it gives you a little leverage in the summit in terms of what they can ask for from Xi, where you can get some mileage.”
But another government official cautioned against placing bets on how much of a role the state visit would play in the timing of any sanctions.
“There’s always a reason not to do it,” the official said. “I don’t think any particular one event is going to drive it.”
The White House would not officially comment on the sanctions preparation.
One senior administration official did note, however, that the new executive order allowed “the use of economic sanctions against malicious cyberactors,” and that “the administration is pursuing a comprehensive strategy to confront such actors.”
The official emphasized, “We are assessing all of our options to respond to these threats in a manner and timeframe of our choosing.”