UK forges close cyber ties with China despite endemic espionage

As the US continues to take a hard line with China over alleged criminal hacking of American companies, UK cyber investigators have quietly forged relationships with their counterparts in China, the Guardian has learned.

Over the past six months, at least two meetings between the UK National Crime Agency (NCA) and Chinese law enforcement have taken place, while “24/7 contact points” have been established to help fight cybercrime taking place between the two nations.

Yet at the same time, attacks emanating from China have been causing pain among public and private organisations in the UK, security experts have claimed, without any legal action taken.

Researchers from the US and the UK with knowledge of state-sponsored cyber espionage emanating from China told the Guardian the threat facing British business is as severe as it is for American companies.

A report released in June alleged a unit within the Chinese People’s Liberation Army had targeted satellite companies across the US and Europe. Sources familiar with the hackers’ activities said the group had targeted UK businesses too.

But rather than show signs of taking action against such activity, the NCA has encouraged collaboration between the UK and China on digital crime.

As part of this, Andy Archibald, deputy director of the agency’s National Cyber Crime Unit, led a delegation of UK experts to Xiamen in Southern China for a seminar with Chinese cyber law enforcement agencies in February.

This was the first time any foreign law enforcement agency had visited the Ministry of Public Security’s centre of cyber expertise, the NCA said. During the visit, the UK delegation sought to establish ties that would help the forces collaborate and share threat information.

In May, members of Chinese law enforcement visited the NCA, but the London-based agency wouldn’t say what the meeting entailed.

Though he wouldn’t comment on whether the UK would ever file charges against individuals as the US did, Archibald told the Guardian the NCA did have to find the right balance between working with both American and Chinese law enforcement.

“We know the risks, we know the sensitivities but there are cases we can work together on. And that’s what we’re doing at the moment,” Archibald said.

The US, which has worked closely with the UK on cybercrime investigations including the recent takedown of the Cryptolocker malware, has responded far more aggressively to China’s alleged cyber espionage campaigns. In May, it charged five members of the People’s Liberation Army in China with attacks on six American businesses.

That move led to the dismantling of a working group that was supposed to foster collaboration between Chinese and US officials fighting digital crimes.

CrowdStrike, the company that detailed the latest alleged PLA attacks, has called on the UK government and other nations to follow the US in taking a stand.

“It’s really a global responsibility … it’s important for us to tell them you can’t keep doing this,” said Adam Meyers, director of intelligence at CrowdStrike. “China has created a factory of intellectual property theft. It is so endemic across the threat space.”

Meyers said the aviation and aerospace industries were two of the most targeted industries in the UK when it came to Chinese attacks.

The Chinese Embassy in London had not responded to requests for comment at the time of publication. China has repeatedly denied claims it carries out cyber espionage by hacking foreign companies.

Despite claims around Chinese-sponsored cyber espionage on UK companies, few believe the government or its law enforcement agencies will take action. That’s largely because the UK is attempting to forge close trade ties with China, said Chris Ogden, lecturer in Asian security at the University of St Andrews.

“The major difference concerning any UK response to such allegations rests on the UK government’s main goal of increasing Sino-UK trade levels, which are relatively much smaller than US-China levels,” Ogden said.

“Working closely with Beijing is a diplomatic imperative for London, and heightening trade ties will remain as the key strategy, especially in light of a potential UK withdrawal from the EU in the near future. This strategy must not alienate Chinese leaders and companies, and therefore precludes the use of charges or blockades concerning allegations of hacking.

“This is the UK’s short-to-medium term aim, whilst the US’s short-to-medium term aim is to counter a rising China and ensure Washington’s global primacy.”

For the UK, this strategy is paying off. Bilateral trade is at record levels, rising 8% overall in 2013. This week, Premier Li Keqiang has been welcomed to Downing Street by the prime minister, David Cameron, for the annual UK-China summit. Late last year, Cameron called for more openness from China on cyber issues.

As UK businesses can’t rely on action for law enforcement, they are simply taking matters into their own hands and implementing measures to block attacks from China, said the security consultant and professor at Nottingham Trent University John Walker.

“A lot of the big organisations are a lot more savvy than law enforcement, they probably know a lot more than the NCA and they are doing their own thing, putting implementations in place to save themselves,” added Walker, who accused the Chinese of sponsoring attacks on the UK and the US back in 2008.

Yet in response to improved security among British business and the increased focus on China’s activities, the hackers have simply tweaked their modus operandi to be “noticeably more stealthy”, added Stuart McKenzie, senior investigative consultant at Context Information Security.

“During this period there has been a change in government in China and increasing political pressure from western governments to stop China conducting cyber espionage. It may even have been the political embarrassment for those in charge of the espionage programmes that their cyber campaigns were regularly hitting the front page of the press,” McKenzie said.

“What we do know though is that we are still seeing targeting of nearly every sector and that the attacker tools are evolving and attempting to evade detection.”

• Is the global cost of cybercrime really £266bn a year? No it isn’t