The People’s Republic of China (PRC) is executing a long-term, cyber-enabled economic campaign designed to capture and control key strategic industries. The campaign is more than just the theft of intellectual property or cyber espionage. According to recent testimony provided to the U.S.-China Economic and Security Review Commission, it is a “centrally controlled national strategy designed to achieve economic, military, and diplomatic superiority”—a form of “unrestricted warfare.”2
Among the strategic industries targeted by the PRC, several are critical to the U.S. Navy. These include the semiconductor and associated industries, the undersea cable industry, and maritime shipbuilding. If the PRC is able to gain effective control of these sectors, it will have significant political, economic, and military leverage over the United States and its allies, and the ability of the Navy to execute its core functions will be in doubt.
Semiconductors
Semiconductors are the tiny, wafer-like “brains” of nearly every modern electronic system, from coffeemakers to the F-35 Joint Strike Fighter. As a consumer of products that rely on semiconductors, the Department of Defense (DOD) is vulnerable to a number of threats. In 2014, for example, a Massachusetts man pleaded guilty in U.S. District Court to selling counterfeit semiconductors from China and Hong Kong to contractors supplying them to the U.S. Navy for use in nuclear submarines.3
The real threat from China, however, is not poorly made imitation products, but rather a sophisticated campaign to capture the world’s semiconductor industry, from raw materials to suppliers and manufacturing facilities. In 2016, 27 semiconductor-related companies in the PRC—including heavyweights Lenovo, Huawei, Alibaba, Baidu, and ZTE4—formed the “High End Chip Alliance” (HECA) to integrate the country’s efforts. Both the director and deputy director of the HECA are members of the PRC government.5
Recent testimony sheds light on the cyber-enabled methods and tactics the PRC is employing in its attempt to gain monopoly-like control over this industry:6
• “Power buyer” coercion. China has gained leverage by virtue of its market share and leadership in strategic sectors, such as rare earth metals (where the PRC controls approximately 95 percent of the market), enterprise communications, and mobile device manufacturing.
Aggressive investment in, and acquisition of, semiconductor industry capacity. This is especially pertinent in Taiwan, home of Taiwan Semiconductor Manufacturing, one of the world’s largest semiconductor foundries. The PRC is actively recruiting from and infiltrating Taiwanese companies, not only to steal intellectual property, but also to sabotage company operations and either drive them out of business or make them more vulnerable to Chinese buyout.
• Embedded threat actors. Placed in Western microchip manufacturers and investment entities, these actors can steal intellectual property, sabotage operations, or redirect investments.
• Strategic economic duress on Western firms operating inside China. The PRC National Development and Reform Commission may require firms to turn over source code and intellectual property or to enter into joint ventures with Chinese firms to continue to conduct business in China.
• Leverage from acquisition. For example, HNA Group, a Chinese conglomerate that includes logistics, supply chain management, shipping, and maritime transportation, acquired Ingram Micro, a global technology and supply chain service.7
The global semiconductor industry saw $330 billion in sales in 2014, of which, DOD accounted for just 1 percent, and three of the four main companies that provide products to the global market are foreign-owned—Taiwan Semiconductor Manufacturing, UAE-owned Global Foundries, and Korean-owned Samsung Semiconductor. This gives the department very little leverage over the industry.8
Beginning in 2004, DOD established a trusted supplier program to guarantee access to, and the reliability of, microelectronics components important to national defense. IBM’s fabrication facilities supplied the advanced semiconductors for the department, but this line was unprofitable. In 2014, IBM announced that UAE-owned Global Foundries would purchase its fabrication facilities in Vermont and New York. After the sale was approved by the Committee on Foreign Investment in the United States, Global Foundries obtained accreditation as a trusted supplier. In 2016, DOD reached agreement with the firm to supply microchips until 2023.
Despite the trusted supplier program, DOD remains dependent on commercial supply chains, especially foreign-owned firms, for electronic hardware.9 A 2015 Government Accountability Office report noted the security risks the country faces. First, the country continues to rely on a single-source provider of leading-edge trusted microelectronics. Even though DOD has taken steps to add suppliers, none have the “leading edge” capabilities of IBM and therefore cannot provide the advanced semiconductors needed for some of the military and intelligence community’s most critical systems. Second, growing consolidation within the defense supplier base is reducing competition and creating more reliance on single-source providers for components and subsystems. This puts upward pressure on acquisition and maintenance costs and carries significant national security implications.10
Undersea Cables
Nearly all global information traffic—telecommunications, data, the Internet—travels on submarine cables.11 In fact, while most people think of cyberspace as a digital, limitless domain, it is in reality very much constrained by physical components and geography. There are only about 200 systems worldwide that carry data traffic, and they are concentrated in a few cable landing sites. These systems are vulnerable to natural events, such as the 2006 earthquake that severed cables and disrupted Internet service in Taiwan. They also have been a source of intelligence collection, such as in Operation Ivy Bells, a Cold War communications intelligence collection program run by the U.S. Navy, Central Intelligence Agency, and National Security Agency.12 In 2005, the Associated Press reported the then-recently commissioned nuclear attack submarine USS Jimmy Carter (SSN-23) was capable of tapping undersea cables.13
States have targeted submarine cable systems to sever communications links. This occurred during both World Wars and remains a risk today. In 2015, Russian Navy submarines and intelligence-collection ships were observed operating near known submarine cable systems. In the event of rising tensions or conflict, the cable systems on which the U.S. military relies for command and control could be targeted. Should that be successful, satellite and other alternative secure communication systems would not be able to fill the void.14
Recognizing the importance of the submarine cable system, state-owned China Unicom, China Telecom, and China Mobile expanded their cable consortium projects, becoming owners of the SeaMeWe-5 cable connecting Europe, the Middle East, and Southeast Asia. Chinese companies have expanded beyond ownership of infrastructure directly connected to the Chinese mainland. For example, China Unicom now shares ownership of the cable connection between Brazil and Cameroon.15
While state-owned companies are expanding ownership of the worldwide undersea cable system, China’s Huawei Marine Systems has become one of the leading global submarine cable system installers, building cable systems throughout Asia, Africa, the Middle East, and Europe. Huawei’s growth is especially intriguing since submarine cable installation is tremendously expensive, yet Huawei is able to offer extraordinarily low prices, raising the possibility of illegal government subsidies.16 The firm also is suspected of having ties to the Chinese Communist Party.17
Ownership in the undersea cable system, as well as leverage over its installation and maintenance, presents significant strategic opportunities for the PRC. Relying on Chinese infrastructure can place states at risk of coercion. Consider the case of Vietnam, where Chinese investors dominate the physical and digital infrastructure. When Vietnam expressed disapproval of China’s South China Sea expansion, investors froze cash projects.18 Chinese hackers also disrupted Vietnamese air traffic computers and airline websites.19
Control over the undersea information infrastructure could permit the PRC access to nearly all communication and data traffic worldwide, to include U.S. military traffic. It also would permit the PRC to preplace disruption capabilities, to effectively sever critical cables at a time and place of its choosing.
Shipbuilding
Through its control of Chinese national conglomerates and industries, the PRC has used cyber-enabled techniques to gain access to classified and sensitive ship design and propulsion plans and specifications. It has targeted companies of key allies such as Taiwan, France, Turkey, Germany, the UAE, and Great Britain for either cyber exploitation or coercion. Several state-affiliated PRC institutions—including the Harbin Engineering University, Beijing Institute of Technology, the University of Science and Technology of China, and Beihang University—are involved in converting illicitly gained intellectual property for use by Chinese shipbuilders.20
One important example is Rolls-Royce, a British corporation and world leader in civil, military, marine, and energy sectors. Rolls-Royce propulsion systems power the most advanced U.S. military platforms, including the F-35 Joint Strike Fighter, the USS Zumwalt (DDG-1000), and the new John Lewis (T-AO-205)-class fleet replenishment ships.21 Today, Rolls-Royce’s global marine headquarters is in Singapore.
More than 10 percent of Rolls-Royce revenue comes from China. The PRC has used this sales-related incentive (and disincentives) to manipulate Rolls-Royce into providing “access to expensive propulsion-related” engineering designs and schematics. With this knowledge, the PLA-Navy has been able to improve its own submarine and surface fleet propulsion systems. It has even enjoyed a financial return through the sale of two attack submarines and two surface warships with the same propulsion systems to Pakistan.22
Response
The United States is not without options to respond to China’s actions. Perhaps the most important response is to recognize that cyber-enabled warfare is happening and that the United States—and especially the U.S. Navy—is not prepared. The United States has conducted economic warfare in the past, to include cyber-enabled strategies. We must learn from that history and improve on past experiences.23
Most of the PRC activities mentioned are against U.S. law and the World Trade Organization (WTO) agreement (including the barriers-to-entry; anti-dumping; and subsidies and countervailing measures sections). These activities should be pursued in U.S. courts and in the WTO. Because these activities also are illegal under PRC law, the Department of Justice can seek redress from Chinese law enforcement, a public relations move that would force China to acknowledge what it is doing.24
The Navy needs to partner with U.S. Cyber Command, the National Security Agency, the Defense Information Systems Agency, and others to identify the critical industries associated with all information systems, weapon platforms, networks, space systems, and communications the Navy requires to fulfill its core missions and functions. The Navy also should work through DOD with interagency partners such as Treasury, Commerce, Justice, and Homeland Security to inform their understanding of the national security implications of foreign capture of these critical industries. Ideally, the scope of the Committee on Foreign Investment in the United States should be expanded to permit further oversight and protection of strategic industries.
Finally, DOD and the Navy should reform acquisition policy and law to encourage and incentivize industry partners to “build in” network and information security. This may require the Navy to develop information networks that reside separate from the Internet and telecommunications backbone, as well as to provide cybersecurity and defense of information networks for small-to-medium companies that do not have the internal capacity to provide effective network defense and information assurance.
In The Influence of Sea Power on History, Alfred Thayer Mahan focuses on the link between the effective development and employment of naval power and a nation’s economic strength. Today, the PRC is waging cyber-enabled economic warfare to gain control over key pillars of maritime and naval power, to include dominating the information components and networks on which the modern digital economy relies. This presents a clear threat to the U.S. Navy’s ability to carry out its core functions in support of U.S. national security. It is time to respond.
1. Samantha F. Ravich and Annie Fixler, “Framework and Terminology for Understanding Cyber-Enabled Economic Warfare” (Center on Sanctions & Illicit Finance, 2017).
2. Jeffrey Johnson, “Testimony before the U.S.–China Economic and Security Review Commission Hearing on Chinese Investment in the United States: Impacts and Issues for Policy Makers” (Washington, DC: China Economic and Security Review Commission, 2017).
3. “Massachusetts Man Pleads Guilty to Importing and Selling Counterfeit Integrated Circuits from China and Hong Kong,” news release, Department of Justice, 3 June 2014.
4. David Manners, “27 China Chip Operations Form HECA,” Electronics Weekly, 8 August 2016; and Simon Sharwood, “China forms 27-strong alliance to grow silicon standards,” The Register, 9 August 2016.
5. Johnson, “Testimony.”
6. Johnson, “Testimony.”
7. “Ingram Micro and HNA Group Announce Completion of Acquisition,” news release, Business Wire, 6 December 2016.
8. Andre Gudger, Kristen Baldwin, and Brett Hamilton, Testimony before the U.S. House of Representatives Committee on Armed Services, Subcommittee on Oversight and Investigations, on “Assessing DoD’s Assured Access to Micro-Electronics in Support of National Security Requirements,” 28 October 2015.
9. Michaela D. Platzer and John F. Sargent, “U.S. Semiconductor Manufacturing: Industry Trends, Global Competition, Federal Policy” (Congressional Research Service, 2016).
10. “Trusted Defense Microelectronics” (GAO 16-185T), Government Accountability Office, 28 October 2015.
11. Douglas Main, “Undersea Cables Transport 99 Percent of International Data,” Newsweek, 2 April 2015.
12. Greg Miller, “Undersea Internet Cables Are Surprisingly Vulnerable,” Wired, 29 October 2015.
13. Associated Press, “New Nuclear Sub Is Said to Have Special Eavesdropping Ability,” The New York Times, 20 February 2005.
14. Bruce Dorminey, “How Bad Would It Be If the Russian Started Cutting Undersea Cables? Try Trillions in Damage,” Forbes, 2 November 2015.
15. Stacia Lee, “The Cybersecurity Implications of Chinese Undersea Cable Investment,” The Henry M. Jackson School of International Studies, University of Washington, 25 January 2017.
16. Lee, “The Cybersecurity Implications of Chinese Undersea Cable Investment.”
17. “China’s Huawei, ZTE Pose Security Threat: U.S.,” Australian Financial Review, 8 October 2012.
18. Lee, “The Cybersecurity Implications of Chinese Undersea Cable Investment.”
19. “South China Sea: Vietnam Airport Screens Hacked,” BBC News, 29 July 2016.
20. Johnson, “Testimony.”
21. “Rolls-Royce: Whirring, Not Purring,” The Economist, 14 July 2005; and Rolls-Royce, “Rolls-Royce Secures Power and Propulsion Contract for Us Navy’s New Fleet Replenishment Ships,” news release, 17 October 2016.
22. Johnson, “Testimony.”
23. Samantha F. Ravich, ed., Cyber-Enabled Economic Warfare: An Evolving Challenge (Hudson Institute, 2015).
24. Johnson, “Testimony.”