Did the US force China to develop its online army?

Addressing AusCERT 2013 at the Gold Coast, Queensland on Wednesday, retired US Marine Corps Lieutenant Colonel and author of 21st Century Chinese Cyber Warfare, Bill Hagestad said that many are playing a dangerous game by pointing the blame for cyber attacks at China, and that the resulting consequences of making unproven claims are creating an unsettling situation.

Hagestad, who declared upfront that he really likes China, but likes his country better, said that it simply wasn't possible in most cases to prove whether China was behind an attack.

"One thing that is certain when it comes to attacks from any country is that attribution is not possible. It is relatively impossible."

"Imagine what the Chinese are thinking when it comes to this — left hand does not know what right is doing, do they?"

"If we had 100 percent attribution, then we would be taking to task the Chinese in terms of these hacks that we're seeing. That's not happening. Instead we're having these larger than life statements that we should go on the offensive and hack China. It doesn't make any sense to me."

Yet, he pointed out that that hasn't stopped many from speculating on the truth, including the US government, or wanting it to be true.

He pointed to the US House Intelligence Committee's recent report that identified Huawei and ZTE as a national security threat.

"What happened a week later? The executive branch of the US Government came out and said we find no basis or fact for the US House Intelligence report. Are you as confused as I am? Yes, you should be. Imagine what the Chinese are thinking when it comes to this — left hand does not know what right is doing, do they?"

Hagestad pointed to several other US government publications, such as the Report to Congress of the US-China Economic and Security Review Commission (PDF) and Defence's Annual Report to Congress: Military and Security Developments Involving the People’s Republic of China, 2013 (PDF)

"Prepare for war is basically what they're saying. So you can imagine if you're in China: 'Wait a minute, wasn't the chairman of the joint chiefs just in Beijing wanting to sing kumbayah and then [we're] issued a report like this? Who is in charge?' I have to ask myself that."

"Within five years there's a little company in San Francisco Bay that will cease to exist."

As for China's establishment of a "cyber command", Hagestad did acknowledge they were taking the situation very seriously. He pointed to the five generals that currently oversee China's online cyber-initiatives are all "card-carrying communist members", well-versed and published technologists, and "pure Han Chinese."

In contrast, Hagestad claims the US only has one technologist — National Security Agency director Keith Alexander — that compares.

"He's the only one that fits this. Otherwise, US military officers are generalists, not specifics."

But despite the obvious increase in attention and resources that the Chinese are amassing, Hagestad said that China was doing it to prevent it from becoming a target. Rather than developing an army to attack the US, Hagestad said the Chinese thought that they needed to be worried about an impending US attack on them, not the other way around.

Hagestad indicated that the paranoia and unease from US government reports may have already set the wheels in motion, pointing to the Chinese government's instructions to state-owned enterprises to replace all western-based network equipment with Huawei and ZTE equivalents in response to the US House Intelligence Committee's report.

"I predict that within five years there's a little company in San Francisco Bay that will cease to exist because China, the biggest customer of Cisco, is going to pull it all out. You know what that's called? A cold technical war."

Only a few hours prior to Hagestad's talk, the New York Times revealed that one of the actions currently being considered by a US commission includes authorising US organisations to legally counter-attack and essentially privatise online warfare.

"The US Government is now saying that if you're hacked, you can take it to the Chinese. Take it to what Chinese? If we can't prove 100 percent attribution of an IP, how are we going to prove that they've attacked us?"

And Hagestad worried that this was a dangerous situation that could only escalate.

"It could lead to larger war. It could lead to a confrontation that we don't possibly want. The US military does not want to go to war with China. It doesn't make any sense."

"Authorising commercial enterprises to go and hack [...] it's a dangerous game to play and we might not like the outcome of that. Nobody wants to go to war. Trust me. It's nasty and dirty and once you've done it, you never want to go back."