As President-elect Donald Trump enters his second term on Monday, he faces an unprecedented foreign threat: Chinese hackers.
There have been three separate Chinese hacking campaigns in the United States over the past few years, reportedly even penetrating U.S. government computers belonging to senior Biden administration officials.
Experts and U.S. officials say that while China has long been the top cyber adversary of the United States, it has become more tenacious and ambitious than ever under the Biden administration and is tackling what may become the biggest cyber challenge facing the United States. faced so far.
"I think there's no doubt that the risk of cyberattacks from China has increased," said Adam Segal, who served as the State Department's senior cybersecurity adviser last year. "China's capabilities appear to have grown significantly over the past four years."
The most recent breach, discovered in December, allowed hackers to access Treasury Department files. The department described the breach as a "significant incident" and sanctioned a Chinese company for allegedly helping the country's cyber projects. Another attack, dubbed "Salt Typhoon," included massive intrusions into telecommunications companies such as AT&T and Verizon, giving hackers access to phone calls from the Trump and Harris campaigns last year, as well as the phone records of more than 1 million Americans. FBI Director Christopher Wray said last month that this could be "the most significant cyber espionage campaign in history."
Perhaps the biggest threat, dubbed "Volt Typhoon," consists of hackers covertly invading infrastructure, including power, communications, and water supplies. U.S. officials said the Volta Typhoon was pre-positioned to prevent a military conflict - especially if China invaded the self-ruled island of Taiwan. massive confusion and impeding an immediate and comprehensive U.S. response.
While AT&T and Verizon say they have worked to remove the hackers from their systems, White House officials say the Salt and Volt Typhoon hacks should be considered permanent operations and that hackers are unlikely to give up attempts to re-enter. has denied being behind all three hacks.
As the Biden administration prepares to leave the White House, there are signs that the administration realizes it is not doing enough to stop China-backed hackers.
In one of his final official actions as president, Joe Biden on Thursday signed an executive order that primarily addresses cybersecurity issues, including giving the Cybersecurity and Infrastructure Security Agency more authority to monitor federal networks for hacking. .
Senators received multiple briefings on Typhoon Salt last month, according to a Jan. 6 memo issued by the Southern Nevada Counterterrorism Center, one of dozens of fusion centers across the U.S. that share law enforcement and intelligence information. The memo, seen by NBC News, is unclassified but marked for official use only and was provided to NBC News by People's Property, a nonprofit that uses freedom of information requests to obtain hidden government documents.
In at least one of the briefings, private experts told senators that confronting China would require strengthening the U.S. phone network — a massive investment — and beginning “sustained, direct and more vigorous efforts to curb Chinese espionage.” One expert suggested the United States creates "a credible threat of painful retaliation" against such activity.
Trump’s new team said it plans to take tougher confrontational and aggressive measures against China.
"For too long, our nation has been on the defensive when it comes to cyberattacks," Brian Hughes, a spokesman for the Trump-Vance transition, told NBC News in an emailed statement.
"The Trump Administration is committed to holding accountable private and state actors who continue to steal our data and attack our infrastructure," Hughes said.
Rep. Michael Walz, R-Fla., Trump's pick for national security adviser, told CBS News last month that the next administration would take a "different approach" to cyber.
“I think we need to go on the offensive and start imposing higher costs and consequences on private actors and nation-state actors that continue to steal our data, continue to spy on us, and even worse, as Volt Typhoon infiltrates, it actually It's about placing a cyber time bomb on our infrastructure," Walz said.
Walz declined to say in the interview whether that might include sanctions or what such deterrence might mean.
Trump eliminated the federal government’s cybersecurity czar during his first term, a move that drew strong criticism from Democrats. Experts have praised the Biden administration's cyber policies even as problems affecting citizens and the government itself appear to have escalated dramatically.
Chris Painter, the top cyber diplomat during the Obama administration, said it was clear that China's cyber activities were not being blocked, but it was unclear how the Trump administration's approach would address the problem.
"There's been a lot of activity over the years by the Trump administration and this administration, but that's not protecting us from these massive events. They have to take this seriously," he said.
Painter said vulnerabilities at private companies, such as those exploited by hackers to access U.S. telecommunications, are an "enduring problem" that the Biden team is trying to address with regulations that are unlikely to last under Trump. One question. Trump campaigned on the "most aggressive regulatory cuts" and vowed to sign a series of executive orders on his first day in office, many reversing Biden's policies.
"So how do you cure this? The Biden administration is proposing this idea in the National Cyber Strategy for the first time in years, and maybe it's time to think about the dirty word of regulation and take more responsibility. I think the new administration is no longer thinking about that. This is a situation.”
Siegel, a former Biden official, said the United States cannot convince China to stop conducting cyber espionage, especially given its own long history of cyber espionage.
"There's very little we can do against China when it comes to espionage," Siegel told NBC News. "Countries are going to spy and continue to spy, so we actually have a responsibility to protect ourselves better."
The Biden administration has moved to disrupt China's hacking infrastructure, just as it has done with other hackers confronting the United States. On Tuesday, the Justice Department and FBI announced they had removed a type of malware used by China to infect Americans' computers to unknowingly carry out Beijing's orders.
Most of the operations conducted by U.S. Cyber Command, including hacking operations to disrupt China, are classified, making their effectiveness impossible to fully judge. But Brandon Welsh, executive director of the Cybersecurity and Infrastructure Security Agency during Trump's first administration, said it's unclear whether simply compromising such hacking infrastructure is an effective long-term plan.
"Offensive cyber operations can complicate adversary plans and disrupt operational infrastructure, but we see both nation-states and criminal organizations relatively quickly Infrastructure was rebuilt.”
“The U.S. government has the best access to Chinese networks, do we want to immediately burn those networks that are operational, or do we keep them in order to avoid conflict because they could mean the difference between life and death?” he said.