A number of CIA officers were pulled from the U.S. Embasy in Beijing as a precautionary measure taken in the wake of massive cybertheft of current and former federal employees’ personal data, officials said. Two major hacks into Office of Personnel Management were disclosed earlier this year, and this move can be seen as a direct consequence of the breach. Officials (privately) attribute the attacks to the Chinese government, but decided against publicly blaming them.
Director of National Intelligence James R. Clapper Jr. testifies before the Senate Armed Services Committee on Sept. 29.
Image via washingtonpost
The documents were stolen in what senior U.S. officials brand as political espionage, intended to identify spies and people who would be receptive to bribes, susceptible to blackmail, or willing to be recruited as spies in order to provide useful information. And as OPM records included the background checks of State Department employees, all they had to do was compare them with the list of embassy personnel. Anyone not on the list could be a CIA officer, and exposed to immense risk. As such, CIA’s move was aimed at safeguarding officers whose affiliation might have been discovered after the hack, said officials on the condition of anonymity. The CIA officially declined to comment on the issue.
The disclosure comes as senior defense and intelligence officials on Tuesday tried — not always successfully — to explain to a committee of frustrated lawmakers their policy on deterring foreign governments, such as China, from carrying out cyber-intrusions.
Director of National Intelligence James R. Clapper Jr., testifying before the Senate Armed Services Committee, sought to make a distinction between the OPM hacks and cybertheft of U.S. companies’ secrets to benefit another country’s industry. What happened in the OPM case, “as egregious as it was,” Clapper said, was not an attack: “Rather, it would be a form of theft or espionage.”
“We, too, practice cyberespionage and . . . we’re not bad at it,” he went on to say.
Seeking punishment on other countries for what their own intelligence services do as well wouldn’t be U.S’s best course of action, he believes.
“I think it’s a good idea to at least think about the old saw about how people who live in glass houses shouldn’t throw rocks.”
Sen. John McCain (R-Ariz.), the committee’s chairman, argued against what he believed is not wise restraint, but rather a show of weakness.
“So it’s okay for them to steal our secrets that are most important because we live in a glass house? That is astounding.”
“I’m just saying that both nations engage in this,” Clapper concluded, referring to China and the United States.
Several lawmakers were not satisfied with the lack of a punishment for the OPM theft, despite Clapper’s explanation.
“This is a pretty significant issue that is going to impact millions of Americans,” said Sen. Kelly Ayotte (R-N.H.). “But it seems to me they are not seeing a response right now from us, and therefore we’re going to continue to see bad behavior from the Chinese.”
At another point in the hearing, Deputy Defense Secretary Robert O. Work seemed to stray off-message when he asked what response he would recommend if the Chinese were to carry off another OPM-like cybertheft.
“Sanctions? Retaliation?” asked Sen. Dan Sullivan (R-Alaska).
“Could be any of those, Senator. Maybe all of the above,” Work responded.
But in the end, it’s unlikely the administration will impose sanctions or retaliate officially for the OPM intrusions for the exact reasons that Clapper outlined. During the Cold War, Sen. Martin Heinrich (D-N.M.) noted, a foreign agent who was nabbed trying to steal U.S. secrets would be kicked out of the country if he or she had diplomatic cover or thrown in jail otherwise.
“[But in the OPM case] the U.S. government seems uncertain about what a proportioned response would look like,” he added.
The counterintelligence risks of the OPM breach are significant, Clapper said. He noted that the intelligence agencies do not know specifically whose records were taken. But the scale of the compromise — more than 22 million individuals’ records breached — “has very serious implications . . . from the standpoint of the intelligence community and the potential for identifying people” who may be undercover.
“Unfortunately,” he said, “this is a gift that’s going to keep on giving for years.”
