China’s Ministry of Defense Exhibits High Level of Deception in Response to Hacking Allegations

China’s Ministry of Defense on Feb. 20 issued a statement in response to a report by U.S. cybersecurity firm Mandiant that the Chinese military is aggressively conducting cyberattacks against targets in the United States. QVerity’s analysis of the statement indicates that the Ministry exhibited a high level of deceptive behavior in addressing the allegations.

The English translation of the Ministry of Defense statement, which was issued in Chinese, follows. The deceptive behaviors we identified are annotated after each paragraph.

In a Feb. 20 news conference held by the Ministry of Defense News Affairs Office, Defense Ministry spokesman Geng Yansheng said Chinese law forbids hacker attacks or any breach of Internet security, that the Chinese government has always resolutely cracked down on criminal activity, and that the Chinese military has never supported any hacking.

Convincing statements: “Chinese law forbids hacker attacks or any breach of Internet security” and “the Chinese government has always resolutely cracked down on criminal activity.”

Convincing statements are statements that are made to influence the audience’s perception. They are intended to convince us of something, rather than to convey information that gets to the truth of the matter at hand. 

Non-specific denial: “the Chinese military has never supported any hacking.”

A non-specific denial is a matter of general focus rather than a denial of the particular matter at hand. The lack of direct association with the matter at hand makes it psychologically easier to convey.

Mandiant’s claim that the Chinese military engages in cyber espionage has no basis in fact. First, the report, in relying solely on linking IP addresses to reach the conclusion that the hacking attacks originated from China, lacks technical proof. Everyone knows that the use of usurped IP addresses to carry out hacking attacks happens on an almost daily basis. It is widely understood that this is a common practice online. Second, there is still no internationally clear, unified definition of what constitutes a “hacking attack.” There is no legal evidence behind the report’s subjective conclusion that the everyday gathering of online information amounts to cyberspying. Third, cyberattacks are by nature transnational, anonymous and deceptive, and the origin of attacks is highly uncertain. It is therefore irresponsible to publish these claims, and it is not conducive to solving the problem.

Unintended message: “First, the report, in relying solely on linking IP addresses to reach the conclusion that the hacking attacks originated from China, lacks technical proof.”

By focusing on the literal meaning of what a person says, we can spot unintended messages, which are conveyed without the person even realizing it. Here, the unintended message appears to be that the allegation is false not because the Chinese military didn’t engage in hacking, but because the accuser lacks proof.

Convincing statements: “Everyone knows that the use of usurped IP addresses to carry out hacking attacks happens on an almost daily basis. It is widely understood that this is a common practice online.” 

Failure to understand a simple word or phrase: “There is still no internationally clear, unified definition of what constitutes a “'hacking attack.'”

In an interview scenario, we refer to this behavior as failure to understand a simple question. This strategy is typically used when a person feels trapped by the wording of the question and needs to shrink its scope.

Unintended message: “There is no legal evidence behind the report’s subjective conclusion that the everyday gathering of online information amounts to cyberspying.”

Here, the unintended message appears to be that it’s not a matter of the Chinese military not being engaged in cyberspying, but that there’s no legal evidence to prove it.

Convincing statement: “Cyberattacks are by nature transnational, anonymous and deceptive, and the origin of attacks is highly uncertain.”

Attack behavior: “It is therefore irresponsible to publish these claims, and it is not conducive to solving the problem.”

When the truth isn’t a person’s ally and he’s backed into a corner, especially when the matter at hand has potentially serious consequences, he often resorts to attacking his questioner or accuser. Here, the Ministry is attacking not only Mandiant for reporting the claims, but the media for publishing them.

China is one of the main victims of cyberattacks. Statistics show that Chinese military computers accessing the Internet have suffered a large number of foreign attacks. According to the IP address information, a considerable number of these attacks come from the United States, but we don’t use this as a pretext to criticize the United States. Every country should be dealt with in a professional and responsible manner regarding the issue of network security.

Convincing statements: “China is one of the main victims of cyberattacks. Statistics show that Chinese military computers accessing the Internet have suffered a large number of foreign attacks.”

Attack behavior: “According to the IP address information, a considerable number of these attacks come from the United States, but we don’t use this as a pretext to criticize the United States. Every country should be dealt with in a professional and responsible manner regarding the issue of network security.”

Here, the Ministry is not only attacking the United States directly for engaging in cyberattacks against China, but indirectly for dealing with the matter at hand in an unprofessional and irresponsible manner.

China has always attached great importance to international cooperation in cyberspace, and to jointly combat cybercrime. Since 2004, the Chinese Ministry of Public Security has assisted in the investigation of over 1,100 cybercrime cases in more than 50 countries and regions. China has established bilateral law enforcement agreements with the United States, Britain, Germany, Russia, and 30 other countries and regions, and has signed bilateral judicial cooperation treaties with many countries. Using this mechanism in the fight against cybercrime and hacking attacks is far preferable to officials and media in other countries making accusations of Chinese hacking. China hopes to solve the problem through normal law enforcement cooperation and consultation. Unilateral public accusations in the media are not only ineffective, but undermine the climate of cooperation.

Convincing statements: “China has always attached great importance to international cooperation in cyberspace, and to jointly combat cybercrime. Since 2004, the Chinese Ministry of Public Security has assisted in the investigation of over 1,100 cybercrime cases in more than 50 countries and regions. China has established bilateral law enforcement agreements with the United States, Britain, Germany, Russia, and 30 other countries and regions, and has signed bilateral judicial cooperation treaties with many countries.”

Attack behavior: “Using this mechanism in the fight against cybercrime and hacking attacks is far preferable to officials and media in other countries making accusations of Chinese hacking.”

Convincing statement: “China hopes to solve the problem through normal law enforcement cooperation and consultation.”

Attack behavior: “Unilateral public accusations in the media are not only ineffective, but undermine the climate of cooperation.”