Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Russian state media ramping up English, Spanish presence on TikTok, study finds

Microsoft is changing how you log in to your accounts

Apple is behind in AI and killed its self-driving car project. What’s next?

Election 2024 latest news: Biden holding events in battleground state of North Carolina

That time football legend, rig-driving eligible bachelor Biden was arrested

Campuses are grappling with the Gaza war. So are our columnists.

Wait, what is Stephen A. Smith talking about? Find out with our quiz.

The beginner’s illustrated guide to watching an F1 race

Police arrest pro-Palestinian protesters at Columbia

Young Georgians want to be part of Europe. Their government is in the way.

Taxes are inevitable. Paying to prepare them doesn’t have to be.

A murder plot that cannot be ignored: India must come clean at last

Trevor Williams’s escape act helps Nationals blank Rangers 

How the Nationals helped Mitchell Parker develop into a big leaguer

The 33 best things to do in D.C. this weekend and next week

Trump and allies say Biden pays rent for ‘illegals’ in Michigan. Not true.

Eighty percent of Ukraine-Israel bill will be spent in U.S. or by U.S. military

Middle East conflict live updates: Hamas says it views talks favorably; Blinken urges group to accept deal

Money goes elsewhere, aid workers flee, Haitians endure on their own

Why the Solomon Islands election matters to China and the U.S.

Cat climbed into Amazon return box, found alive 630 miles away

I learned to heal my sadness by cradling dying chickens 

Brave Little Hunter is free: Baby orca escapes lagoon for open seas

Stephen A. Smith would like even more of your attention

Local sports networks go dark mid-game amid dispute with Comcast 

Carolyn Hax: Will request for a postnup offend much younger wife?

Ask Sahaj: Responding to microaggressions is taking a toll on me. Can I stop?

Miss Manners: Offering my bedroom to guests

What’s the best bus to New York? We tested 5 for comfort and value.

Adaptive equipment is making national parks more inclusive

Southwest passengers now get a $75 voucher for big flight disruptions

US President Joe Biden Departure

Big Tech news and how to take control of your data and devices

See more coverage in your recommendations

Technology

Tips delivered to your inbox twice weekly

The Tech Friend newsletter

Business and Tech alerts

Jade Gao

The Chinese military is ramping up its ability to disrupt key American infrastructure, including power and water utilities as well as communications and transportation systems, according to U.S. officials and industry security officials.

Hackers affiliated with China’s People’s Liberation Army have burrowed into the computer systems of about two dozen critical entities over the past year, these experts said.

The intrusions are part of a broader effort to develop ways to sow panic and chaos or snarl logistics in the event of a U.S.-China conflict in the Pacific, they said.

Among the victims are a water utility in Hawaii, a major West Coast port and at least one oil and gas pipeline, people familiar with the incidents told The Washington Post. The hackers also attempted to break into the operator of Texas’s power grid, which operates independently from electrical systems in the rest of the country.

Several entities outside the United States, including electric utilities, also have been victimized by the hackers, said the people, who spoke on the condition of anonymity because of the matter’s sensitivity.

None of the intrusions affected industrial control systems that operate pumps, pistons or any critical function, or caused a disruption, U.S. officials said. But they said the attention to Hawaii, which is home to the Pacific Fleet, and to at least one port as well as logistics centers suggests the Chinese military wants the ability to complicate U.S. efforts to ship troops and equipment to the region if a conflict breaks out over Taiwan.

These previously undisclosed details help fill out a picture of a cyber campaign dubbed Volt Typhoon, first detected about a year ago by the U.S. government, as the United States and China struggle to stabilize a relationship more antagonistic now than it has been in decades. Chinese military commanders refused for more than a year to speak to American counterparts even as close-call intercepts by Chinese fighter jets of U.S. spy planes surged in the western Pacific. <a href="https://www.washingtonpost.com/elections/candidates/joe-biden-2024/" target="_blank" class="contextual_link">President Biden</a> and Chinese President Xi Jinping agreed only last month to restore those communication channels.

“It is very clear that Chinese attempts to compromise critical infrastructure are in part to pre-position themselves to be able to disrupt or destroy that critical infrastructure in the event of a conflict, to either prevent the United States from being able to project power into Asia or to cause societal chaos inside the United States — to affect our decision-making around a crisis,” said Brandon Wales, executive director of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA). “That is a significant change from Chinese cyber activity from seven to 10 years ago that was focused primarily on political and economic espionage.”

Morgan Adamski, director of the National Security Agency’s Cybersecurity Collaboration Center, confirmed in an email that Volt Typhoon activity “appears to be focused on targets within the Indo-Pacific region, to include Hawaii.”

The hackers often sought to mask their tracks  by threading their attacks through innocuous devices such as home or office routers before reaching their victims, officials said. A key goal was to steal employee credentials they could use to return, posing as normal users. But some of their entry methods have not been determined.

The hackers are looking for a way to get in and stay in without being detected, said Joe McReynolds, a China security studies fellow at the Jamestown Foundation, a think tank focused on security issues. “You’re trying to build tunnels into your enemies’ infrastructure that you can later use to attack. Until then you lie in wait, carry out reconnaissance, figure out if you can move into industrial control systems or more critical companies or targets upstream. And one day, if you get the order from on high, you switch from reconnaissance to attack.”

Callaghan O'hare

The disclosures to The Post build on the annual threat assessment in February by the Office of the Director of National Intelligence, which warned that China “almost certainly is capable” of launching cyberattacks that would disrupt U.S. critical infrastructure, including oil and gas pipelines and rail systems.

“If Beijing feared that a major conflict with the United States were imminent, it almost certainly would consider undertaking aggressive cyber operations against U.S. homeland critical infrastructure and military assets worldwide,” the assessment said.

Some of the victims compromised by Volt Typhoon were smaller companies and organizations across a range of sectors and “not necessarily those that would have an immediate relevant connection to a critical function upon which many Americans depend,” said Eric Goldstein, CISA’s executive assistant director. This may have been “opportunistic targeting ... based upon where they can gain access” — a way to get a toehold into a supply chain in the hopes of one day moving into larger, more-critical customers, he said.

Chinese military officers have described in internal documents how they might use cyber tools or “network warfare” in a conflict, said McReynolds, who has seen some of the writings. He said military strategists speak of synchronizing air and missile strikes with disruption of command-and-control networks, critical infrastructure, satellite networks and military logistics systems.

They have talked about these tools applying in amphibious invasions, he said. “This is stuff they pretty clearly see as relevant to a Taiwan scenario,” he said, “though they don’t explicitly say this is how we’re going to take over Taiwan.”

This is far from China’s first foray into hacking critical infrastructure. In 2012, a Canadian company, Telvent, whose software remotely operated major natural gas pipelines in North America, notified customers that a sophisticated hacker had breached its firewalls and stolen data relating to industrial control systems. The cybersecurity firm Mandiant traced the breach to a prolific PLA hacking group, Unit 61398. <a href="https://www.washingtonpost.com/world/national-security/us-to-announce-first-criminal-charges-against-foreign-country-for-cyberspying/2014/05/19/586c9992-df45-11e3-810f-764fe508b82d_story.html?hpid=z1" target=_blank>Five members of the unit were indicted</a> in 2014 on charges of hacking U.S. companies.

Charles Dharapak

At the time, the U.S. government wasn’t sure whether China’s aim was to collect intelligence or pre-position itself to disrupt. Today, based on intelligence collection and the fact that the facilities targeted have little intelligence of political or economic value, U.S. officials say it’s clear that the only reason to penetrate them is to be able to conduct disruptive or destructive actions later.

Threat researcher Jonathan Condra of security company Recorded Future — which during the summer found Volt Typhoon probing the Texas grid — said the secrecy with which the Chinese have conducted the attacks argues against any notion that they wanted the United States to know their capabilities.

The hackers “were doing this a lot more stealthily than if they were trying to get caught,” he said.

The U.S. government has long sought to improve coordination with the private sector, which owns most of the nation’s critical infrastructure, and with tech companies that can detect cyberthreats. Companies such as Microsoft share anonymized information about adversary tactics, indicators that a system has been compromised, and mitigations, said CISA’s Goldstein. Generally, these companies are not seeing the hacker’s presence within the customer’s networks, but rather are detecting it through communications to the servers the hacker is using to direct the attack, he said.

In some cases, the victims themselves seek assistance from CISA. In others, Goldstein said, CISA is alerted by a software or communications vendor to a victim and the government must seek a court order to compel the vendor to reveal the victim’s identity.

In May, Microsoft <a href="https://www.washingtonpost.com/technology/2023/05/24/china-hack-guam-taiwan/" target=_blank>said </a>it had found Volt Typhoon infiltrating critical infrastructure in Guam and elsewhere, listing a number of sectors. Those included telecommunications firms, according to people familiar with the matter. The hacks were especially concerning, analysts said, because Guam is the closest U.S. territory to the contested Taiwan Strait.

The intrusions into sectors such as water and energy systems come as the Biden administration has sought to strengthen industries’ ability to defend themselves by issuing mandatory cybersecurity rules. In the<a href="https://www.washingtonpost.com/national-security/cybersecurity-energy-pipelines-ransomware/2021/10/03/6df9cab2-2157-11ec-8200-5e3fd4c49f5e_story.html" target=_blank> summer of 2021</a>, the administration <a href="https://www.washingtonpost.com/business/2021/07/20/tsa-pipeline-cyberattack-rules/" target=_blank>rolled out</a> first-ever oil and gas <a href="https://www.tsa.gov/sites/default/files/tsa_sd_pipeline-2021-02-july-21_2022.pdf" target=_blank>pipeline cyber regulations</a>. In March, the Environmental Protection Agency announced a requirement for states to report on cyberthreats in their public water system audits. Soon after, however, three states sued the administration, charging regulatory overreach.

The <a href="https://www.washingtonpost.com/politics/2023/10/16/biden-administration-goes-back-drawing-board-water-cybersecurity/" target="_blank">EPA pulled back the rule </a>and has asked Congress to act on a regulation. In the meantime, the agency must rely on states to report threats voluntarily.

In a joint <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a#_Toc135639517" target=_blank>advisory </a>issued in May, the Five Eyes intelligence alliance of the United States, Britain, Canada, Australia and New Zealand offered advice on how to hunt for the intruders. One of the challenges is the hackers’ tactic of evading detection by firewalls and other defenses by using legitimate tools so that the hackers’ presence blends in with normal network activity. The technique is called “living off the land.”

“The two toughest challenges with these techniques are determining that a compromise has occurred, and then once detected, having confidence that the actor was evicted,” said the NSA’s Adamski, whose Cybersecurity Collaboration Center coordinates with private industry.

The NSA and other agencies recommend mass password resets and better monitoring of accounts that have high network privileges. They have also urged companies to require more secure forms of multifactor authentication, such as hardware tokens, rather than relying on a text message to a user’s phone, which can be intercepted by foreign governments.

Despite the heightened scrutiny growing out of the May advisory, the hackers persisted, seeking new targets.

In August, according to Recorded Future, the hackers attempted to make connections from infrastructure that had been used by Volt Typhoon to internet domains or subdomains used by the Public Utility Commission of Texas and the Electric Reliability Council of Texas, which operates that state’s electric grid. Though there is no evidence the attempts succeeded in penetrating the system, the effort highlights the kinds of targets the Chinese military is interested in. The two Texas agencies declined to answer questions about the incidents from The Post.

The Reliability Council said it works closely with federal agencies and industry groups and that it has redundant systems and controlled access as part of a “layered defense.”

In the weeks leading up to the Biden-Xi meeting last month, NSA officials speaking at industry conferences repeated the call to the private sector to share information on hacking attempts. The NSA can peer into adversaries’ networks overseas, while U.S. companies have visibility into domestic corporate networks. Together, industry and government can have a fuller picture of attackers’ goals, tactics and motives, U.S. officials say.

China “is sitting on a stockpile of strategic” vulnerabilities, or undisclosed security flaws it can use in stealthy attacks, Adamski said last month at the CyberWarCon conference in Washington. “This is a fight for our critical infrastructure. We have to make it harder for them.”

The topic of Chinese cyber intrusions into critical infrastructure was on a proposed list of talking points to raise in Biden’s encounter with Xi, according to people familiar with the matter, but it did not come up in the four-hour meeting.

Pulitzer Prize for Public Service, 2014

Gerald Loeb Award 2014, NSA stories

Society of American Business Editors and Writers enterprise award 2009, for the story "Banking Regulator Played Advocate over Enforcer"

Daily Californian Alumni Association Alumna of the Year, 2017

Pulitzer Prize for reporting on Russian interference in the 2016 presidential election, 2018

Pulitzer Prize for Public Service in 2022 for an investigation of the Jan. 6 assault on the U.S. Capitol

The Prince of Tennessee

City University, London, MA in international journalism

University of California at Berkeley, BA in humanities

Ellen Nakashima is a national security reporter with The Washington Post. She was a member of three Pulitzer Prize-winning teams, in 2022 for an investigation of the Jan. 6 assault on the U.S. Capitol, in 2018 for coverage of Russia's interference in the 2016 election, and in 2014 and for reporting on the hidden scope of government surveillance. 



Ellen Nakashima

Top 10 nonfiction books of 2019, Hudson Booksellers

Top 10 nonfiction books of 2010, Hudson Booksellers

Book of the year finalist in 2003, Investigative Reporters & Editors 

Best in Business awards in 2017 and other years, Society for Advancing Business Editing and Writing

Gerald Loeb Awards finalist in 2017 and other years

Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World

Fatal System Error: The Hunt for the New Crime Lords who are Bringing Down the Internet

All the Rave: The Rise and Fall of Shawn Fanning's Napster

Harvard College, A.B. in English

Joseph Menn joined The Post in 2022 after two decades covering technology for Reuters, the Financial Times and the Los Angeles Times. His books include "Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World" (2019) and "Fatal System Error: The Hunt for the New Crime Lords who are Bringing Down the Internet" (2010). 

Joseph Menn

washpost

China’s cyber intrusions have hit ports and utilities, officials say 

the-washington-post

CHINA-US-DIPLOMACY-APEC-SUMMIT

Contributor

AFP/Getty Images

Help Desk

Artificial Intelligence

Internet Culture

Space

Tech Policy

Tech

prism://prism.query/two-sites,/technology,/politics/powerpost/the-technology-202?limit=20

prism://prism.query/site,/technology/tech-policy&limit=20

prism://prism.query/site,/world/asia-pacific&limit=20

Asia

The Washington Post provides the latest information and analysis of breaking Asia news stories. Includes news coverage on China, Japan, North Korea, South Korea, Vietnam, Indonesia, Malaysia, Taiwan and Cambodia.

prism://prism.query/site-articles-only,/world/&limit=20

World

The Washington Post World section provides information and analysis of breaking world news stories. In addition to our world news and video, Post World News offers discussions and blogs on major international news and economic issues.

prism://prism.query/ap-articles-by-site-id,/world

prism://prism.query/site,/national-security&limit=20

Sign up for Fact Checker, our weekly review of what's true, false or in-between in politics.

National Security

The Washington Post's coverage of national security issues, including the military, intelligence, justice, and foreign policy.