Hackers: the China Syndrome

For years, the U.S. intelligence community worried that China’s government was attacking our cyber-infrastructure. Now one man has discovered it’s worse: It’s hundreds of thousands of everyday civilians. And they’ve only just begun

By Mara Hvistendahl Posted 04.23.2009 at 9:34 am 26 Comments

Scott Henderson: John B. Carnett

STUMBLING ONTO THE DANGER

In 2004, Scott Henderson, a trim 46-year-old with sandy brown hair, had just retired from decades as a language expert for the U.S. Army to work for a private intelligence contractor in Fort Leavenworth, Kansas. With a command of Mandarin, not to mention a Taiwanese wife, Henderson's knowledge of China makes him valuable in the intelligence community. His mandate at the new job was open-source intelligence, which meant using only information from publicly available sources, mimicking the capabilities of the average civilian. Although he had little experience in the subject, he was assigned a report on Chinese hackers.

Sitting down at a desk overlooking the Fort Leavenworth military base, Henderson started, like any novice, with Google. Using Mandarin characters, he typed heike -- literally, "black guest" -- pulling up the characters for "hacker." Probably, he thought, he'd find articles rehashing weak Western reports. But when he hit "return," his browser displayed a slew of unfamiliar sites: hackbase.com, hacker123.com, hack8.cn. There were hundreds, maybe thousands. He quickly realized that each was the online headquarters of a Chinese hacker organization, with detailed logs of hacks, contact information for hackers, and forums where users discussed targets. Chinese hackers, it turns out, take credit on their own sites for attacks, leaving a long trail of documentation. They are so attention-driven that when they post images of their successes to online trophy rooms, they tag them with e-mail addresses, URLs, even cellphone numbers. Within three minutes, Henderson had more information than he knew what to do with.

He spent the next few months trying to make sense of the data. To map connections among hacker sites, he laid a large sheet of paper out on the floor of his office and started sketching the network by hand. The diagram quickly extended off the page. Then it extended off several taped-together pages. After a co-worker suggested the computer program i2 Analyst's Notebook, an investigative tool that allowed him to craft a more sophisticated model, Henderson, following links from site to site, connected 250 hacker pages. Monitoring a cross-section of sites over several days to estimate the number of people logged in at any given time, he came up with 380,000 hackers.

There were localized clubs, whose members saw one another regularly. There were fleeting groups, whose sites appeared and disappeared in a matter of weeks. There were kid hackers, femme-fatale hackers and hacker wannabes (although most hackers are simply computer-savvy 20-somethings -- what Henderson calls "normal guys"). One group penned a theme song. Henderson recognized early on that such publicity ploys were not the work of the state. "If this was some secret government-run organization," he says, "it was the most horribly run secret government organization in the universe."

Instead, Chinese hackers work in small, competing crews, he found. During moments of crisis, like the 2001 EP-3 collision, the groups band together into coalitions called "Chinese emergency conference centers." The Red Hacker Alliance, often described in the Western press as a monolithic group, is in fact a loose association allowing disparate cells to coordinate their efforts.

But the largest unifying characteristic is nationalism. In a 2005 Hong Kong Sunday Morning Post article, a man identified as "the Godfather of hackers" explains, "Unlike our Western [hacker] counterparts, most of whom are individualists or anarchists, Chinese hackers tend to get more involved with politics because most of them are young, passionate, and patriotic." Nationalism is hip, and hackers -- who spearhead nationalist campaigns with just a laptop and an Internet connection -- are figures to revere.

Henderson says he's found nothing to show a direct connection between the central government and civilian hacker groups. But he emphasizes that the relationship between citizen and state is fluid in China, and that the Chinese government tends not to prosecute hackers unless they attack within China. To Henderson, that lack of supervision is tacit approval, and it constitutes a de facto partnership between civilian hackers and the Chinese government.

Jack Linchuan Qiu, a communications professor at the Chinese University of Hong Kong who spent the 2001 hacker war logged into mainland forums, agrees. "Chinese hackerism is not the American 'hacktivism' that wants social change," he says. "It's actually very close to the state. The Chinese distinction between the private and public domains is very small." Chinese entrepreneurs returning from working in Silicon Valley, Qiu says, sometimes comply with government requests to provide filtering technology to China's Internet police. Homegrown hackers might just as easily be recruited to write viruses or software for the People's Liberation Army.

Ultimately, hackers with loose government connections may be more frightening than state-sponsored cyberwarfare. According to Lewis, "The government at a minimum tolerates them. Sometimes it encourages them. And sometimes it tasks them and controls them." In the end, he says, "it's easy for the government to turn on and hard to turn off."

"These rogue groups are missing oversight," Henderson says. "When a situation is approaching critical mass" -- if, for instance, these hackers decide to abandon simple vandalism and start gunning for Social Security numbers or classified information -- "who's the guy who pulls back and says, 'No, we don't go any further'?"

Previous Article: The Taste of Science

Next Article: Self-Control is Good, But Only up to a Point

Want to learn more about breakthroughs in electronics, medicine, nanotech, and more?
Subscribe to Popular Science and enter to win $5,000!

26 Comments

26 Comments

Photo Galleries

Science

Popular Science Photo Pool

Popular on Popsci

Most Viewed

Science

Most Commented

Science

Most Emailed

Science

Today on PopSci.com

Footer Menu