The New York Times - USA (2020-07-22)

A12 N THE NEW YORK TIMES INTERNATIONALWEDNESDAY, JULY 22, 2020

WASHINGTON — The Justice
Department accused a pair of Chi-
nese hackers on Tuesday of tar-
geting vaccine development on
behalf of the country’s intelli-
gence service as part of a broader
yearslong campaign of global cy-
bertheft aimed at industries such
as defense contractors, high-end
manufacturing and solar energy
companies.
Justice Department officials la-
beled the suspects, Li Xiaoyu and
Dong Jiazhi, as a blended threat
who sometimes worked on behalf
of China’s spy services and some-
times to enrich themselves. The
officials said that an indictment
secured against them this month
and unsealed on Tuesday was the
first to target such a threat.
United States government offi-
cials said that the suspects had
previously stolen information
about other Chinese intelligence
targets like human rights activists
and, at the behest of the Ministry
of State Security spy service,
shifted focus this year to trying to
acquire coronavirus vaccine re-
search.
The indictment comes as the
Trump administration has
stepped up its criticism of Beijing,
both for its theft of secrets and its
failure to contain the spread of the
coronavirus, and is a significant
escalation of that campaign to de-
nounce Beijing. The Justice De-
partment said that China’s covert
activity could potentially set back
vaccine research efforts.
The accusations also came days
after the United States and allied
countries accused Russia of try-
ing to steal information on vaccine
development.
The indictment also suggests
that China did far less to curb its
spying than it had vowed to as
part of a nonaggression pact
signed with the United States in
late 2015 that was aimed at curb-
ing China’s efforts to steal Ameri-
can technological know-how.
The agreement was thought to
have slowed China’s hacking for
about 18 months, reducing the in-
dustrial espionage work done by
the Chinese military. But Mr. Li
and Mr. Dong, guided by the Chi-
nese intelligence agency, tried to
steal secrets in 2016 and 2017,
even as the agreement was pur-
portedly being honored.
Asked for comment on the accu-
sations, a press officer for the Chi-
nese Embassy pointed on Tues-
day to earlier comments by a for-
eign ministry spokeswoman, Hua
Chunying, who said that the gov-
ernment opposed all forms of

cyberattacks and threats. The suspects are unlikely to be brought to trial because China does not have an extradition treaty with the United States. The charges were the latest in a con- tinuing effort by the Justice De- partment to secure indictments against private groups and intelligence officials involved in hacking campaigns as a deterrent and to raise awareness of the threat that such groups pose. On Tuesday, David L. Bowdich, the F.B.I. deputy director, called the hacks part of a campaign of economic coercion akin to “what we expect from an organized criminal syndicate.” The suspects targeted hun- dreds of computer networks around the world and caused un- named companies to lose hun- dreds of millions of dollars of intel- lectual property, according to the indictment. For example, they stole research on radio and laser technology from a California defense firm and engineering draw- ings for a gas turbine from a company working in the United States and Japan, court papers showed. Justice Department and F.B.I. officials said the hackers were pursuing information and research about the coronavirus vac-

cine from American biotech firms but described it as an attempt to steal the data. The indictment, which was filed in the Eastern District of Washington, did not say that the hackers successfully stole information or research on the vaccine. The pair did try to hack a Mass-

achusetts biotech firm researching a vaccine as early as Jan. 27, according to the indictment. On Feb. 1, the pair tried to find vulnerabilities on the networks of a Cali- fornia biotech firm that had an- nounced it was researching coronavirus antiviral drugs. Then, in May, Mr. Li investigated a Califor- nia diagnostic firm developing virus testing kits. While the indictment named only the two suspects, unlike the larger group of Russian hackers accused of seeking vaccine data, the Justice Department portrayed

their work as far-reaching and long-running, going back to at least 2009. American officials first de- tected the suspects five years ago, when they stole a gigabyte of information including personnel and administrator accounts from the Hanford Site, an Energy De- partment facility in Washington State where plutonium was produced during World War II, according to the indictment. In some cases, the suspects tried to extort money from companies, according to the indictment. In 2017, Mr. Li threatened to pub- lish the source code of a Massa- chusetts software company if it did not give him $15,000 in cryptocurrency. Like the Russian group, the Chi- nese hackers operated with the assistance of their country’s intelligence agencies. Their interests were broad, covering manufacturing firms, defense contractors, government agencies, game de- velopers and medical device mak- ers; they recently grew to include information about coronavirus vaccine development and other virus-related data. The suspects also tried to steal other information on Chinese activists for the Ministry of State Se-

curity, Beijing’s civilian spy agency, said John C. Demers, the assistant attorney general for national security. The suspects handed over account information and passwords belonging to a Hong Kong community organizer, a former Tiananmen Square pro- tester and a pastor of a Christian church in China. “You can see by the variety of the hacks that they did how they were being directed by the government,” Mr. Demers said at a news conference at the Justice Department. “Extorting someone for cryptocurrency is not some- thing that the government is usually interested in, nor are criminal hackers usually interested in human rights activists and clergy- men.” The hackers broke into computer networks by researching personal identifying information about employees and customers, which helped them gain unauthor- ized access, according to law en- forcement officials. Once inside, they stole information from pharmaceutical companies about drugs under development and source code from software companies, the indictment said. Although the Chinese intelligence service in some cases pro-

vided them with hacking tools, much of their work was done us- ing more common methods to breach publicly known software vulnerabilities. The hackers also worked to cover their tracks, sometimes in ways that could damage the data they were stealing, like by chang- ing the file names of information they downloaded, according to court papers. To further avoid de- tection, the two hackers worked inside computers’ “recycle bins,” where files are hidden by default and harder for system adminis- trators to see. Mr. Demers said an attempted breach could slow down research because it must be secured, but re- searchers also must make sure their data has not been corrupted or altered by the intruders. The government officials did not say they had evidence that such ma- nipulation had occurred, however. “Once someone is in your system, they cannot only take the data, they can manipulate the data,” Mr. Demers said. “So what you have to focus on is making sure through backup or other sys- tems that nothing has changed about your data.” The indictment contained 11 criminal charges against Mr. Li and Mr. Dong, including conspira- cies to commit computer fraud and theft as well as multiple counts of aggravated identity theft. Trump administration officials, both in public speeches and classi- fied briefings to Congress, have stepped up warnings in recent weeks about Chinese intelligence services and their campaign to steal information and influence American politics. Lawmakers have been wrestling with how to better deter China, Russia and other nations from trying to hack into pharmaceutical companies, technology firms and other organizations. “We need a comprehensive strategy to deter the serial theft of strategic U.S. secrets,” Senator Chris Van Hollen, Democrat of Maryland, said in an interview. “It is not enough to have these one-off indictments.” Mr. Van Hollen and Senator Ben Sasse, Republican of Nebraska and a member of the Senate Intel- ligence Committee, have pushed a bill that would impose sanctions on foreigners and foreign companies that try to steal American in- tellectual property. “This indictment reveals yet again that Chairman Xi leads an army of hackers that steal and attempt to steal — every single day, in almost every country and in- dustry,” Mr. Sasse said, referring to President Xi Jinping of China.

U.S. Says 2 Hackers Tried to Steal Coronavirus Vaccine Data for China

By JULIAN E. BARNES

A lab developing a coronavirus vaccine in Shenyang, China. The White House says that Beijing has resorted to stealing secrets.

NOEL CELIS/AGENCE FRANCE-PRESSE — GETTY IMAGES

Suspects were said

to previously target

human rights activists.

David E. Sanger contributed re-
porting.

“made no request of Mr. Mundell
regarding the British Open or any
other sporting event.” The state-
ment did not address whether the
ambassador had broached the is-
sue of Turnberry, which Mr.
Trump bought in 2014, but none of
the next four Opens are scheduled
to be played there.
Still, the episode left Mr. Lukens
and other diplomats deeply unset-
tled. Mr. Lukens, who served as
the acting ambassador before Mr.
Johnson arrived in November
2017, emailed officials at the State
Department to tell them what had
happened, colleagues said. A few
months later, Mr. Johnson forced
out Mr. Lukens, a career diplomat
who had earlier served as ambas-
sador to Senegal, shortly before
his term was to end.
The White House declined to
comment on Mr. Trump’s instruc-
tions to Mr. Johnson, as did the
ambassador and the State Depart-
ment.
Although Mr. Trump, as presi-
dent, is exempt from a federal con-
flict of interest law that makes it a
criminal offense to take part in
“government matters that will af-
fect your own personal financial
interest,” the Constitution pro-
hibits federal officials from ac-
cepting gifts, or “emoluments,”
from foreign governments.
Experts on government ethics
pointed to one potential violation
of the emoluments clause that still
may have been triggered by the
president’s actions: The British or
Scottish governments would most
likely have to pay for security at
the tournament, an event that
would profit Mr. Trump.
It was not the first time the
president tried to steer business
to one of his properties. Last year,
the White House chose the Trump
National Doral resort in Miami as
the site of a Group of 7 meeting.
Mr. Trump backed off after it ignit-
ed a political storm, moving the

meeting to Camp David before canceling it because of the coronavirus pandemic. Mr. Trump also urged Vice President Mike Pence to stay at his family’s golf resort in Doon- beg, Ireland, last year during a visit, even though the vice president’s official business was on the other side of the country. That trip generated headlines for the golf club, but also controversy. And Mr. Trump has visited his family- owned golf courses more than 275 times since he took office, bring- ing reporters with him each time, ensuring that the resorts get am- ple news coverage. The Trump International Hotel in Washington has done a brisk trade in guests, foreign and do- mestic, who are in town to lobby the federal government. Turn- berry itself drew attention when the Pentagon acknowledged it had been sending troops to the resort while they were on overnight layovers at the nearby Glasgow Prestwick Airport. But Mr. Trump and his children have struggled for more than a decade to attract professional golf tournaments to the family’s 16 golf courses, knowing those events draw global television audiences and help drive traffic. They own most of the courses outright — as opposed to simply selling the family name, as is the case with sev- eral of their hotels and residential towers — and the courses gener- ate about a third of the family’s revenue, with tournaments seen as a crucial way to publicize them. This has been particularly im- portant for the two Trump resorts in Scotland and one in Ireland, which have been losing money under Mr. Trump’s ownership. Mr. Trump himself was intensely involved in promoting them before he was elected, regularly pushing golf writers and the editors of golf magazines to play with him, often after whisking them to Scotland on his private jet. The losses at the British resorts have come even after the family made costly investments to build or upgrade their courses, including $150 million at Turnberry. The most recent annual report for

Turnberry shows it lost nearly $ million, on $19 million in sales, in 2018. But the campaign to recruit tournaments has been compli- cated by Mr. Trump’s political as- cent. Executives who run the Scottish Open, for example, said in 2017 that they would most likely not hold the tournament at the Trump family’s Aberdeen golf resort, even after direct appeals by Mr. Trump. “Politics aside, Trump would be an ideal venue — but you can’t put politics aside,” Martin Gilbert, the chief executive of Aberdeen Asset Management, which is the lead sponsor of the Scottish Open, told reporters. As ambassador, Mr. Johnson has had to navigate Mr. Trump’s up-and-down relations with

British leaders. The president soured on the prime minister at the time, Theresa May, and berat- ed her on trans-Atlantic phone calls. His relations with Prime Minister Boris Johnson, a like- minded populist, have been warmer, though Mr. Johnson has sometimes steered clear of Mr. Trump, who is deeply unpopular in Britain. A prominent Republican donor, Mr. Johnson initially supported Jeb Bush for the Republican nomi- nation in 2016, but he later backed Mr. Trump, introducing him to other figures in the party’s money circles. Enlisting Mr. Johnson as an emissary on behalf of his golf course was another way the president was looking for help further- ing his financial interests. Beyond the legal and ethical red

flags, asking for such a favor from his host country would put Mr. Johnson in an untenable position as the emissary of the United States. “It is diplomatic malpractice because once you do that, you put yourself in a compromised position,” said Norman L. Eisen, who served as President Barack Oba- ma’s special counsel for ethics and later as his ambassador to the Czech Republic. “They can always say, ‘Remember that time when you made that suggestion.’ No ex- perienced diplomat would do that.” For Mr. Johnson, 73, London was a reward fit for the billionaire heir to the Johnson & Johnson pharmaceutical fortune. Formally known as the Court of St. James’s, the assignment is the plum of the diplomatic corps — one that comes with a palatial residence, Winfield House, and entree to the highest levels of British society. Like many political appointees, Mr. Johnson had no diplomatic ex- perience before arriving in Lon- don. Affable and well connected, he is known mainly for the nick- name Woody and his ownership of the New York Jets, a perennially struggling N.F.L. franchise. His

transition to leading a large embassy was bumpy. Mr. Johnson’s throwback style has been criticized as offensive. There have been complaints that he complimented the appear- ances of female employees during staff meetings, and after inter- viewing a candidate to replace Mr. Lukens as deputy chief of mission, he asked a colleague whether she was Jewish. The ambassador, colleagues said, forced out Mr. Lukens after hearing he gave a speech at a British university in which he told a positive anecdote about a visit Mr. Obama had made to Senegal in 2013, when Mr. Lukens was the envoy. At least some of those complaints were raised with the department’s Office of the Inspector General last fall, when a team of investigators began a routine review of diplomatic operations at the embassy. The findings were submitted in February, and the complaints are expected to be in- cluded, according to one of the investigators. It is not clear why the review has not been made public. Neither the State Department nor the embassy addressed the accusations, but the department said Mr. Johnson had led the embassy “honorably and profession- ally.” In a statement, it said, “We stand by Ambassador Johnson and look forward to him continu- ing to ensure our special relation- ship with the U.K. is strong.” As for Mr. Trump’s request for help in getting the Open, it is not clear how much sway the British government would have had even if had responded to Mr. Johnson’s hints. The tournament is run by the R&A, a golf association based at the Royal and Ancient Golf Club in St. Andrews, which is the British counterpart to the United States Golf Association. A spokesman for the R&A, Mike Woodcock, said a committee se- lects the site from a pool of 10 courses in Scotland, England and Northern Ireland based on factors like the readiness of the course and public infrastructure. “We haven’t received any ap- proaches from the British government or the Scottish government about this,” he said.

Mark Landler reported from Lon-
don, Lara Jakes from Washington
and Maggie Haberman from New
York. Eric Lipton contributed re-
porting from Washington.

Trump Pressured Envoy

To Secure His Own Resort

As Home of British Open

DOUG MILLS/THE NEW YORK TIMES

CHANG W. LEE/THE NEW YORK TIMES

From Page A

Above, Robert Wood Johnson IV, left, with President Trump and his wife, Melania, in 2018. At left, Mr. Johnson, who owns the New York Jets, at the team’s New Jersey home.

An episode that left

career diplomats

deeply unsettled.

The New York Times - USA (2020-07-22)

Get our desktop app

Company

Features

Documentation

Resources