President Biden is putting new pressure on China by publicly attributing the wide-ranging Microsoft Exchange Server cyberattack to hackers affiliated with Beijing.
The coordinated effort by the United States and its allies on Monday to condemn China’s aggressive behavior in cyberspace marks the first time NATO has formally rebuked Beijing for cyberattacks.
White House officials touted the effort as unprecedented given the breadth of nations that joined together.
“We’ve crossed the line on what can be tolerated anymore. China is more aggressive when it comes to espionage,” James Lewis, a senior vice president at the Center for Strategic and International Studies, told The Hill. “This is to make sure that the Chinese don’t think we forgot about them and they had an open door.”
The move comes four months after Microsoft announced that vulnerabilities in its Exchange Server application were being exploited by a Chinese state-sponsored hacking group known as “Hafnium.” The vulnerabilities were used by the hacking group, and later other cyber criminals, to compromise thousands of organizations around the world.
The attack came on the heels of the massive SolarWinds hack, which allowed Russian hackers to compromise nine U.S. federal agencies. Both incidents forced Biden to zero in on cybersecurity.
The public rebuke of China promises to further escalate tensions between the U.S. and China, which have not eased with the transition from the Trump administration to the Biden administration.
On his first foreign trip last month, Biden urged allies to take a firmer line on calling out China for its human rights abuses and rallied the world’s wealthiest democracies behind a global infrastructure proposal to counter China’s Belt and Road Initiative. Biden has also framed his domestic agenda as necessary in order to outcompete China.
“In the competition against China and other nations of the 21st century, let’s show that American democracy and the American people can truly outcompete anyone,” Biden said earlier this month as he signed a sweeping executive order to crack down on anti-competitive business practices.
The U.S. has not ruled out further actions to punish China over its behavior in cyberspace. Biden indicated to reporters on Monday that he would be briefed on the cyberattacks again on Tuesday.
The Biden administration “has placed a premium on showing a united front with allies in condemning the Chinese, rather than slapping on U.S. sanctions,” said Lisa Curtis, who was senior director for South and Central Asia on the National Security Council under the Trump administration. “We will have to see whether the collective naming and shaming has an impact on Chinese cyber activity in the future.”
Some lawmakers are pressing Biden to do more.
“The only thing bad guys understand is strength,” House Homeland Security Committee ranking member John Katko (R-N.Y.) said Monday in a statement to The Hill. He said the Chinese Communist Party “is the greatest threat to U.S. interests and economic security for the next 50 years and it’s time the Biden Administration start treating them as such.”
Senate Intelligence Committee Chairman Mark Warner (D-Va.) praised the administration for its actions but stressed in a statement that “there’s still more work to do to address our cyber vulnerabilities.”
The U.S. has previously called China out for its involvement in cyberattacks, but the number of countries that joined the U.S. in admonishing China on Monday signaled an escalation. The United Kingdom, the European Union and the “Five Eyes” countries all joined the effort.
“Biden is reinforcing his effort to create a united front of democracies to stand up to China. This was a pretty broad-based coalition,” said Charles Kupchan, who served as senior director for European affairs on President Obama’s National Security Council. “We’re talking about a broad array of countries that have agreed to speak up, and that makes a difference because, unlike Russia, which in some ways relishes international criticism, China has thin skin.”
The U.S. economic relationship with China would complicate any effort to slap sanctions on Beijing, though the Biden administration has kept Trump-era tariffs on Chinese goods in place.
“We are not holding back. We are not allowing any economic circumstance or consideration to prevent us from taking actions where warranted. And also we reserve the option to take additional actions where warranted as well,” White House press secretary Jen Psaki told reporters Monday.
Officials pointed to the Justice Department’s indictment Monday of four individuals affiliated with China’s Ministry of State Security in a global hacking operation as evidence of the U.S. taking steps to punish Beijing. Still, those hackers are likely to remain out of reach of U.S. prosecutors so long as they remain in China.
Biden has met with a number of world leaders in recent months, including Russian President Vladimir Putin, but there are no plans for him to meet with Chinese President Xi Jinping. The White House says it is exploring future opportunities for engaging with Chinese officials.
The Biden administration has raised concerns about the Microsoft hack as well as other cyber incidents in conversations with senior Chinese officials, a senior Biden official told reporters on Sunday.
There has long been bipartisan support for a foreign policy that is tough on China, though Republicans in Congress and former President Trump have sought to portray Biden as weak on Beijing.
The decision to hit China, and Biden’s ability to get other nations on board, could help Biden push back at such efforts.
“Both of them had the same intent, but the Biden administration has properly organized itself to lead, and it’s appropriately reaching out to allies and partners to lead a coalition,” Mark Montgomery, a senior fellow at the Foundation for Defense of Democracies, said in comparing the Biden and Trump efforts.
He stressed that while the Trump administration “had the right intent, the processes are much cleaner and clearer under the Biden administration.”
Cybersecurity is far from the only area of contention, and the Biden administration has taken other steps to push back on what the U.S. views as unacceptable behavior on the part of China.
Those steps include barring U.S. imports of a material used in solar panels by a Chinese-based firm accused of engaging in forced labor practices and expanding a Trump-era order prohibiting investments in Chinese defense and surveillance firms that produce or use technology that is used to repress individuals or facilitate human rights abuses.
Lewis noted that despite these steps, the administration was still “trying to work out” what pushing back against China looked like, particularly on cybersecurity concerns.
“Everywhere China goes there is a problem, so they are losing fans, and the Biden administration is smart to take advantage of that,” Lewis said.