China and Russia: Cyber Cousins but not Cyber Brothers

There seems to be a strong divergence in perception behind China’s desire to command cyberspace offensively. On the one hand, there is the assumption that this is a natural manifestation of its growing desire to achieve global superpower status.

On the other hand, there is the counter-argument that emphasizes China’s own perception to be unable to operate effectively against the United States in a conventional military confrontation. (Hjortdal 2011) Indeed, many Chinese writings suggest cyber warfare is considered an obvious asymmetric instrument for balancing overwhelming US power. (Hjortdal 2011) This latter argument is more compelling based on the stark military realities:

•In overall spending, the United States puts between five and 10 times as much money into the military per year as does China.

•Chinese forces are only now beginning to be brought up to speed. Just one-quarter of its naval surface fleet is considered modern in electronics, engines, and weaponry.

•In certain categories of weaponry, the Chinese do not compete. For instance, the U.S. Navy has 11 nuclear-powered aircraft-carrier battle groups. The Chinese navy is only now moving toward the complete construction of its very first carrier.

•In terms of military effectiveness, i.e. logistics, training, readiness, the difference between Chinese and American standards is not a gap but a chasm. The Chinese military took days to reach survivors after the devastating Sichuan earthquake in May of 2008, because it had so few helicopters and emergency vehicles. (Fallows 2010)

Given this state of military affairs, a Chinese perception of insecurity is not surprising. Even more logical is the Chinese resolve to evolve its asymmetric cyber capabilities: such attacks are usually inexpensive and exceedingly difficult to properly attribute, meaning the victim is unlikely to know who was directly responsible for initiating the attack. It is even more complex for states, where cyber-attacks can be ‘launched’ from inside of neutral or allied countries. (Ollman 2011)

Given an authoritarian state’s capacity for paranoia, it is illogical for China to not develop its offensive cyber capabilities. In this case the weakness – conventional military strength – is quite real. To that end, the People’s Republic of China has endeavored to create its own set of lopsided military advantages in the cyber domain:

•The Pentagon’s annual assessment of Chinese military strength determined in 2009 that the People’s Liberation Army had established information warfare units to develop viruses to attack enemy computer systems and networks.

•The PLA has created a number of uniformed cyber warfare units, including the Technology Reconnaissance Department and the Electronic Countermeasures and Radar Department. These cyber units are engaged on a daily basis in the development and deployment of a range of offensive cyber and information weapons.

•China is believed to be engaged in lacing the United States’ network-dependent infrastructure with malicious code known as ‘logic bombs.’ (Manson 2011)

The official newspaper of the PRC, the Liberation Army Daily, confirmed China’s insecurity about potential confrontation with the United States in June 2011. In it, the Chinese government proclaimed that, “the US military is hastening to seize the commanding military heights on the Internet…Their actions remind us that to protect the nation’s Internet security we must accelerate Internet defense development and accelerate steps to make a strong Internet Army.” (Reisinger 2011) Clearly, the Chinese have sought to maximize their technological capacity in response to kinetic realities. This is not to say the United States is therefore guaranteed to be in an inferior position (information about American virtual capabilities at the moment remains largely classified), but the overt investment, recruitment, and development of Chinese virtual capabilities presents opportunities that the US should also be willing to entertain.

How does all of this compare and contrast with the Russian approach to the cyber domain? Anyone studying cyber conflict over the last five years is well aware of Russia’s apparent willingness to engage in cyber offensives. The 2007 incident in which the Estonian government was attacked and the 2008 war with Georgia are universally considered examples of Russia using cyber technology as the tip of their military spear. While it is true that Russia actively encourages what has come to be known as ‘hacktivism’ and lauds ‘patriotic nationalist’ cyber vigilantism as part of one’s ‘civic duty,’ there are still distinct differences with China.

Much of Russia’s cyber activity, when not in an open conflict, seems to be of the criminal variety and not necessarily tied directly into the state. Indeed, Russia seems to utilize organized crime groups as a cyber conduit when necessary and then backs away, allowing said groups continued commercial domination. Russia, therefore, almost acts as a rentier state with criminal groups: cyber weapons are the ‘natural resource’ and the Russian government is the number one consumer. This produces a different structure, style, and governance model when compared to China.

Parsing Cyber Rogues

Purpose

China’s purpose in developing its cyber capability seems motivated by protectionist instincts, based largely on the perception that it is not able to defend itself against the United States in a straight conventional military conflict. Russia’s purpose seems utterly predatory. This is no doubt influenced by the fact that most of the power dominating cyber capability in the Russian Federation is organized and controlled by criminal groups, sometimes independently and sometimes in conjunction with governmental oversight.

Psychology

The operational mindset of China seems to be both long-term and rational. It develops its strategies based on future strategic objectives and its position within the global community. Most if not all of China’s goals in the cyber domain can be clearly understood if rational self-interest is taken into consideration. Russia’s cyber mindset is dominated by short-term thinking, largely motivated by the pursuit of massive profit and wielding inequitable political power. When analyzing just how much of Russian cyber activity is in fact controlled by the desire for wealth it is hard to not have an overall impression akin to state cynicism.

Style

The atmospheric style in which Chinese cyber activity takes place is strategic. The state strives to control the cyber environment and maintain influence over all groups in the interest of the state. The Russian cyber atmosphere unfortunately resembles nothing if not anarchy. The state engages criminal groups whereby the relationship’s authority structure is blurred if not non-existent. As a result, there is little confidence that the government of Russia exclusively controls its cyber environment.

Governance Model

It is clear that China’s cyber governance model is state-centric. This may not be most ideal for democracy, but it shows how China does not allow competing authorities or shadow power structures to interfere with its own national interests. Russia’s cyber governance model is crimino-bureaucratic. It is not so much that the state is completely absent from the cyber domain in Russia: it is rather the ambiguity of power and authority that defines the cyber domain. Russia may enjoy claiming the allegiance of its patriotic nationalist hackers, but it does not in fact tightly control its own cyber netizens, at least not in comparison to China.

While both Russia and China are not afraid to use offensive cyber weapons, there are dramatic structural, motivational, strategic, and philosophical differences. Russia seems to embody a criminal-governmental fusion that has permeated the entire state apparatus. The cyber domain there is used for temporary forays to achieve state objectives and then returns to more permanent criminal projects. As such, the domain is not truly state-controlled, is relatively anarchic, and cannot establish any deterring equilibrium. China, on the other hand, may be the first state to truly embrace the importance of tech-war: it has realistically assessed its own kinetic shortcomings and looked to cyber for compensation. In short, it has fused Sun Tzu with Machiavelli: better to quietly overcome an adversary’s plans than to try to loudly overcome his armies.

This analysis paints Russia in a relatively stark strategic light. While these differences do not give rise to a trusted alliance with China, the manner in which China approaches its cyber domain presents interesting new ideas about how the US or the West should approach the global cyber commons. Russia has room to improve still on the cyber front if its interests are in greater cooperation internationally with the world’s other great powers. If it prefers its current ‘lone wolf’ approach, then it is doubtful the cyber commons will ever see any organized or honored regime of rules and proper behavior.