Chinese cyber power has been delayed by the U.S. for at least a decade, new research said

Its strengths as China’s cyber force are undermining poor security and weak intelligence analysis, according to a new study that predicts that Beijing will not be able to withstand cyber capabilities for at least a decade.

The study, released by the International Institute for Strategic Research on Monday, highlighted some hacking campaigns that are becoming an increasing threat. online espionage enemy states.

In December, U.S. officials found that Russia’s foreign intelligence service, SVR, had hijacked SolarWinds software to include targets in the Washington government’s Department of Commerce and Finance. Three months later, Microsoft threatened e-mail software with hackers backed by alleged Chinese states to study U.S. NGOs and thought groups.

IISS researchers positioned countries on the spectrum of cyber capabilities, from the strength of their digital economy and the maturity of intelligence and security functions to how cyber facilities were integrated with military operations.

China, like Russia, has proven itself in offensive cyber-operations: online espionage, intellectual property theft and disinformation campaigns against the US and its allies. According to the IISS, the two countries had relatively comparable cyber security compared to their competitors.

As a result, only the US is classified as a group that thinks of itself as a “top-level” cyber power, with China, Russia, the United Kingdom, Australia, Canada, France and Israel in second place. At the third level are India, Indonesia, Japan, Malaysia, North Korea, Iran and Vietnam.

Greg Austin, an expert on cyber, space and future conflict at the IISS, said the media has focused only on the positive aspects of China’s digital advances (such as the desire to become a world leader in artificial intelligence) which has been “excessive”. perception of his cyber skill. “To all intents and purposes, the development of cybersecurity capabilities in China is in a worse situation than in many other countries,” he said.

According to the report, focusing on “content security” – limiting the politically subversive information on its home Internet – could reduce attention to the physical networks it carries. The IISS suggested that China’s analysis of cyber intelligence was “less mature” than that of the Five Eyes intelligence allies (the US, UK, Canada, Australia and New Zealand) were driven by ideology and “increasingly linked”. . . The political goals of the leaders of the Communist Party ”.

Austin said the information era is renewing global dynamics, so traditionally strong countries in India and Japan have begun to lag behind in the third tier of cyber operators, while Israel and smaller Australian countries have built the cutting-edge cyber capabilities they have driven. into the second level.

What set the U.S. apart at the first level, according to the IISS, was its unique digital-industrial base, its cryptographic experience, and its ability to conduct “sophisticated and surgical” cyber strikes against opponents. Unlike opponents like China and Russia, the U.S. also exercised close alliances with other cyber powers, including its Five Eyes partners.

However, the US and its allies were increasingly at risk of ransomware attacks, e.g. Colonial Pipeline and Irish Health Service in the last month, activities that are not directed by the states but apparently suffered by the authorities are carried out by Russian criminal hackers.

Robert Hannigan, a former director of the UK intelligence agency GCHQ and now a senior executive at cybersecurity company BlueVoyant, said he agreed with many of the IISS’s consequences, but questioned how much Beijing and Moscow would withstand them due to weak cyber defense.

“While cybersecurity is so underdeveloped in Russia and China, it is less of a necessity than the open economies of the West,” Hannigan said. “The threat is not symmetrical: Western economies are subject to the siege of Russian-based cyber groups that are Russian-approved or authorized by Russia – not the same.”

He added that Russia knew that the West would not distinctively target critical civilian infrastructure in a destructive way, given that Russian agencies have a “reckless license”. “This requires greater cyber security in the west,” he said.