President Barack Obama said Friday that the United States and China had agreed not to conduct cybertheft of trade secrets and intellectual property against one another for commercial gain.
The announcement is a victory of sorts for the administration. It has steadily put pressure on the Chinese government over the last several years to repudiate the use of cybertheft of trade secrets — something the U.S. business community and administration has accused Beijing of engaging in on an industrial scale.
Obama made the announcement at the White House after talks with Chinese President Xi Jinping that were preceded by a swirl of posturing. At the end of last month, the administration leaked that it was preparing sanctions it could bring against Chinese individuals and entities who have profited from so-called cybereconomic espionage, a move experts read as designed to force the Chinese to candidly address the issue during Xi’s visit.
The meeting also happened in the shadow of the massive hack at the U.S. Office of Personnel Management, announced in June, of records of 21.5 million federal employee records — which U.S. officials have blamed on the Chinese.
But such traditional espionage by cyber means was not covered by the agreement Obama announced.
“We have agreed that neither the U.S. or the Chinese government will conduct or knowingly support cyber-enabled theft of intellectual property, including trade secrets or other confidential business information for commercial advantage. In addition, we’ll work together and with other nations to promote international rules of the road for appropriate conduct in cyberspace,” Obama said at a joint press conference, adding that the United States did not participate in such activity.
The Obama administration has long made a distinction between economic cyberespionage — the theft of trade secrets for commercial gain — and traditional intelligence gathering on other countries that has always taken place, cyber or other.
It has especially emphasized the distinction in the wake of the revelations from National Security Agency leaker Edward Snowden about the nature of America’s own massive intelligence-gathering operation, something China has point to at the same time it has denied allegations of hacking U.S. businesses.
Officials have said the United States will try to stop traditional espionage, but that it’s commercial secrets theft that crosses a line that is punishable.
Some experts were also surprised that the White House did not reach an agreement with China not to mount first attacks against the other side’s critical infrastructure using cyber methods.
Experts said while the deal was a step forward, it wasn’t the end of the conversation.
“I think the U.S. got a quarter of a loaf today,” said Scott Kennedy, a China expert at the Center for Strategic and International Studies.
Kennedy said it was a positive step that China and the U.S. will have a formal, high-level working group on the topic, but said he fears that the hacking may only go quiet for some time before it ramps up again.
“We may be giving China a pass on all past behavior, so I don’t know if this actually teaches the Chinese that they need to better comply or there will be sanctions,” Kennedy said.
He noted that China sees the situation as imbalanced — that the United States is constraining them where they have an advantage but not constraining its own actions where the United States has an advantage, in government spying.
But Kennedy’s colleague James Lewis, an expert in cybersecurity, said he spoke with senior White House officials about the deal, and they are fully aware of the need to enforce the agreement.
“(Today’s announcement is) really significant progress. It’s a big change in what the Chinese have been willing to do before,” Lewis said, adding that the line he heard from the Obama administration was that sanctions are still on the table.
Lawmakers who have worked especially on cyber issues also hailed the announcement but expressed skepticism about China’s credibility.
“As positive as this agreement is, I remain skeptical about the Chinese commitment to carry it out,” said Rhode Island Democrat Rep. Jim Langevin, who co-chairs the Congressional Cybersecurity Caucus. “I believe that the threat of sanctions brought President Xi to the negotiating table, and President Obama must make clear to his counterparts that sanctions will be levied on rogue actors in cyberspace.”
His words were echoed by House Intelligence Committee ranking member Adam Schiff, who called Xi’s commitment “long overdue.”
“No nation has done more to advance its economic interests through the theft of the work product of others than China, at tremendous cost to American businesses and jobs,” said Schiff, a California Democrat. “I remain skeptical that China will deliver on this promise … But if curbing cybertheft is a journey of a thousand miles, perhaps China has taken a first step.”
Langevin’s co-chairman, House Homeland Security Chairman Mike McCaul, said the United States needs to “make it clear there are consequences” for hacks on U.S. government and businesses.
“The Chinese government should be held accountable for its actions and President Obama should be prepared to respond appropriately,” McCaul said.
Obama himself also left open the door to imposing the sanctions that his administration has threatened, which were specially created by an executive order in April.
“What I’ve said to President Xi and what I say to the American people is, the question now is, are words followed by actions? And we will be watching carefully to make an assessment as to whether progress has been made in this area,” Obama said at Friday’s press conference.
He noted the United States has “various tools” to go after cyberthieves, including the new sanctions power, which he said he made clear to Xi.
“We did not, at our level, have specific discussions of specific cases, but I did indicate to President Xi that we will apply those and whatever other tools we have in our tool kit to go after cybercriminals,” Obama said.
Xi, for his part, reiterated that Beijing does not support commercial cybertheft, though said he understands the U.S. concerns and will “take seriously” any information the United States brings to its attention about such hacking.
Neither leader mentioned the indictment of five Chinese military officials in May 2014 by the Justice Department for allegedly hacking U.S. businesses and stealing intellectual property. At the time and since, the Chinese government has denied the allegations.
Obama said that Xi told him that he cannot guarantee the behavior of all the people in China when it comes to cyber actions. And he noted that their work on cyber was not yet done, even though the two leaders reached the common understanding announced Friday on the way forward.
Lewis said it’s important that the United States come up with measures to ensure hacking diminishes and is open with the American people about how it’s going.
“Verification, transparency, consequences: That’s the next step,” Lewis said.