I agree with much of James’s analysis. I might part company with him, though, on the question of whether a “strategy of maintaining legitimacy by not letting people know” can work. It’s tempting to think that a group of stolid Communist Party bureaucrats in late middle age with identically-dyed hair have the same grasp of the internet that your mother has of the remote control for the TV. But the proof of the pudding is in the eating: the Party has shown itself to be remarkably sophisticated in its ability to control what Chinese people know and think even in these wired times.

Take the Great Firewall, for example – China’s blocking of foreign web sites that might provide information the government doesn’t want its citizens to know about. Sure, it can be evaded if you know what you’re doing, but how many Chinese citizens actually do take the trouble to evade it? For a long time, many people relied on VPNs (virtual private networks) to access blocked sites, but China’s web police have now figured out how to block those in many cases.

And suppose you as a Chinese citizen do find information that would jeopardize the Party’s legitimacy – what do you do with it? On-line information does not spread itself; it needs humans to pick it up and spread it. That human information-spreader, if in China, can be identified and caught by the authorities pretty easily. His email and text messages are monitored for tell-tale keywords; he cannot publish an article or give a speech about what he knows; he can’t organize a meeting to discuss it.

Indeed, in one case the suppression of information succeeded so spectacularly that it backfired. On June 4^th, 2007, an advertisement appeared in the Chengdu Evening News that said, “Salute to the mothers of the strong victims of 64.” It’s very unlikely that the clerk who accepted the advertisement would never have deliberately put himself or herself in jeopardy by letting this advertisement be published. What’s much more likely is that the government’s attempt to efface the memory of June 4^th was so successful that the clerk had no idea of the significance of those two digits.

The question Jim Fallows raises that most intrigues me is the paradox between how much China has changed, and how little China has changed.

This paradox has become abundantly evident in the the hacking attacks just revealed by The New York Times. Although these are hardly the first cases of large scale intrusions that have also been discovered and attributed to the Chinese by other American organizations, we see in these attacks an up-dated expression of the old Leninist (and perhaps also Confucian) urge to control with new technology and strategy. As part of the evolutionary process, propaganda has morphed into PR and a very manipulative push to win soft power. That such efforts are more reminiscent of a large luxury goods company seeking to brand itself with a mass advertising campaign that is bought and paid for is one of the great ironies of the Chinese Communist Party's progress into modernity. Utterly missing is any recognition of the real source of soft power, namely, that the best forms of such beguiling traits come from a more natural evolutionary process, whereby a country spontaneously develops winsome cultural and political traits that make people naturally want to live there by means of what Jim calls “love-bombing, a charm offensive, whatever you want to call it.” China so desperately wants to be “loved,” and so lacks confidence that its current system is capable of winning such affections, that it hopes it can contrive soft power power by controlling what people say and think, and then paying for a massive ad and media campaign to go along with it. They just don't want to leave anything to chance.

This means that Chinese officials have been unwilling to relinquish any of their earlier pretension at controlling the field through the surveillance and monitoring of everything and everyone they can. And so it is quite logical that they are now availing themselves of all the world’s latest technology not only to create “The Great Firewall,” but now more recently to indulge in mass hacking into the communcations sytems of organizations—especially media outlets and government—that are not willing to play along with the Party’s sense of urgency about its image-maintenance campaign. In a certain sense, even while China has opened up in arresting new ways, by fortifying its control mechanisms and ability to intrude into people's lives in new and troubling ways, it has also been closing down. And, as it has regained “wealth and power” and its global pretensions have grown, it is now also tempted to apply these same new and very effective methods of electronic control to outside people and institutions. Here, we are truly seeing one of the more mutant forms of globalization.

This conversation seems to have engaged cyberattacks on both the domestic and international fronts. Let me pick up on the latter thread and offer just a few thoughts. I think that the cyberattacks are less about controlling China's image as Orville suggests (although I agree with him that China is committed to doing so) than they are about theft: theft of other people's ideas, conversations, inventions, intellectual property, etc. Cyberhacking is in many respects a more personally-directed enterprise than it might seem when you hear that this NGO or media organization or company was hacked. Cyberhackers are people who are stealing, cheating, and reading other people's personal mail. It is a personal enteprise that very directly attacks people.

Thus when asked the question, "at what cost cyberattacks?" my reaction is rather different from that of my friends and colleagues above. For China, I tend to think in terms of reputational costs and credibility costs. China's eminent foreign affairs official Cui Tiankai--who is rumored to be that country's next ambassador to the United States--has spoken of a trust deficit between the United States and China. On the Chinese side, this often boils down to claims that even as the United States talks the game of engagement, it is trying to contain China. For the United States, however, there is likely no greater source of distrust than cyberhacking. U.S. companies, U.S. media outlets, NGOS, and the U.S. government have all been targeted by Chinese cyberhackers, and in a number of instances, the hackers have been traced back to "university computers used by the Chinese military," as in the New York Times case. It seems unlikely that the same people who have been hacked by Chinese entitites are going to be strong advocates for "trusting" China. So, another cost to China, in addition to its reputation and credibility, is the loss of potential allies. 

So what to do from here? The bold play by the New York Times to detail its case and out the Chinese suggests that we may have reached an inflection point. More companies, as well as the U.S. government may become more assertive about revealing the fact that they have been hacked and reporting precisely who has done the hacking. The U.S. Department of Justice has also indicated that it may soon begin to go after hackers and state-owned enterprises that benefit from stolen property.  My colleague Adam Segal spends a lot of time working on how the United States and China might better cooperate on cybersecurity--and of course there are fruitful areas in terms of rooting out domestic economic cyber crimes, which both countries face.  Other issues, such as what constitutes appropriate boundaries for internet freedom will remain contentious issues to be hammered out in international forums--with plenty of countries aligned along all parts of the freedom spectrum. In the near term, however, it might be a positive step  toward building the trust that both the United States and China so desperately seek if a group of Chinese scholars, businesspeople, and officials--perhaps along with their American colleagues--could stand together to denounce these cyberattacks as not worthy of the strong, confident, and successful country China is becoming. 

It is interesting for me to join in this conversation from Orville's phrase: “paradox between how much China has changed, and how little China has changed.”

The cyberattack on the New York Times, the Wall Street Journal and Bloomberg News immediately reminds their readers about the investigative reports these media have done on Chinese leaders. That might indeed be what triggered these attacks.  Seeing this issue from "control the China Image abroad,” or China’s “soft power seeking" perspective is very useful for us to understand this issue, and therefore raising the question of "at what cost?” 

But I would also like to focus on another phrase in James opening post, “Entire regime relies on an information-control strategy.”

In this light, for the Chinese Party-State, foreign media, including those from the U.S., EU, Japan, and those from India or other parts of the world such as Al Jazeera in Qatar, or media from Taiwan and Hong Kong, are all in a general category of having an adversarial relationship with such an “information-control strategy.” This status quo of foreign media explains why these journalists, and sometimes the agencies themselves are often under Chinese cyberattack.  The attacks are partially aiming to monitor and intimidate journalists reporting on China, and probably more importantly, aiming to intimidate potential Chinese “sources” to cooperate with these “external hostile forces.”

Today’s Hong Kong media published stories about how Hong Kong journalists routinely come under cyberattack by Chinese security agencies in their China reporting work. In confidential interviews, I also have learned that certain Chinese military units have been using the list of foreign media and foreign human rights NGOs as regular cyberattack training targets, not just to prevent or to punish one specific report about Chinese high politics.

So to me, little has changed in terms of this statement: China’s “entire regime relies on an information-control strategy.” What has remarkably changed is the implementation of such control, which now extends to sophisticated high technology and has gone way beyond of borders of the People's Republic of China.

Within about twelve hours of The New York Times story, The Wall Street Journal also ran a long piece discussing its hacking:

In the most recent incident, the Journal was notified by the FBI of a potential breach in the middle of last year, when the FBI came across data that apparently had come from the computer network in the Journal's Beijing bureau, people familiar with the incident said.

The Journal hired consultants to investigate the matter and uncovered a major breach in which hacking groups—it wasn't clear whether they were working together—entered the company's networks, in part through computers in the Beijing office, people familiar with the situation said. The hackers then infiltrated the paper's global computer system, the people said.

Per James Fallows’ points about practicing good security hygiene, it is interesting that the Journal appears to have had no idea they were under attack until the FBI let them know. We may never know how the “FBI came across data that apparently had come from the computer network in the Journal’s Beijing bureau,” but that is a curious revelation. 

Given the minimal direct costs to the hackers and the small chance that this kind of behavior can be diplomatically changed any time soon, companies that are likely targets, and especially leading western media firms that cover China, need to invest much more in their IT security. 

We learned from the New York Times and Wall Street Journal admissions that Bloomberg was attacked but nothing was compromised, which is not surprising given its importance to global financial markets, customer base, and remarkably healthy financial position that allows it to invest heavily in protecting its networks. The New York Times was attacked and compromised but since they had asked AT&T to watch for unusual activity they knew almost immediately they were under attack, though not the full extent of the intrusions. The Wall Street Journal had no idea it was going on until the FBI called. Given the perilous financial state of most Western media firms, network security budgets are unlikely to be as large as needed in the current environment, to the benefit of hackers and cyberspies. 

Not to take away from the seriousness of these hackings, but I do think it is worth pointing out that the timing of the New York Times and Wall Street Journal revelations have led some in the business (and not just competitors) to point out that the Pulitzer Prize submission deadline just passed, 2012 was an amazing year for China journalism, The New York Times, The Wall Street Journal and Bloomberg all had Pulitzer-worthy coverage in 2012, and so perhaps one point of differentiation for the prize committee might have been “our stories were so impactful that the Chinese government decided to hack us.” If these revelations do sway the Pulitzer Committee, China will again have shot itself in the foot.