China hacking claims: tech firms move to front line in US,West/China cyberwar

Mandiant founder reveals how balance of power in US cyberwar has shifted to multibillion-dollar computer security firms

China hacking claims: US national security and intelligence experts at Peterson air force base in Colorado Springs, Colorado. Rick Wilking/Reuters

When Kevin Mandia, a retired military cybercrime investigator, decided to expose China as a primary threat to US computer networks, he did not have to consult with US diplomats in Beijing or declassify tactics to safely reveal government secrets.

He compiled a 76-page report based on seven years of his company's work and produced the most detailed public account yet of how, he says, the Chinese government has been rummaging through the networks of major US companies.

It was not news to Mandia's commercial competitors, or the federal government, that systematic attacks could be traced to a nondescript office building outside Shanghai that he believes was run by the Chinese army. What was remarkable was that the extraordinary details – code names of hackers, one's affection for Harry Potter and how they stole sensitive trade secrets and passwords – came from a private security company without the official backing of the US military or intelligence agencies responsible for protecting the nation from a cyber-attack.

The report, welcomed by stakeholders in government and industry, represented a notable alignment of interests in Washington: the Obama administration has pressed for fresh evidence of Chinese hacking that it can leverage in diplomatic talks without revealing secrets about its own hacking investigations, and Mandiant makes headlines with its sensational revelations.

The report also shows the balance of power in America's cyberwar has shifted into the hands of the $30bn-a-year computer security industry. "We probably kicked the hornet's nest," Mandia, 42, said at the Alexandria, Virginia, headquarters of Mandiant. But "tolerance is just dwindling. People are tired of the status quo of being hacked with impunity, where there's no risk or repercussion." China has rejected the allegations.

Mandiant founder and chief executive Kevin Mandia. Photograph:AP

Mandiant, which took some $100m of business last year, up 60% from the year before, is part of a lucrative and exploding market that goes beyond antivirus software and firewalls. These "digital forensics" outfits can tell a business whether its systems have been breached and, if the company pays extra, who attacked it.

Among Mandiant's staff are retired intelligence and law enforcement agents who specialise in computer forensics and promise their clients confidentiality and control over the investigation. In turn, they get unfettered access to the crime scene and resources to fix the problem (Mandiant will not say exactly how much it charges, but it is estimated to average about $400 an hour).

The growing reliance on contractors like Mandiant has been compared with that enjoyed by the military and state department contractor formerly known as Blackwater, which provided physical security to diplomats and other VIPs during the Iraq war.

Officials inside and outside government believe contractors can often act more quickly than the government and without as much red tape. There are also serious privacy concerns: Most US citizens do not want the government to access their bank accounts, for example, even if China is attacking their bank.

"The government doesn't have the capacity," said Shawn Henry, a former FBI executive assistant director who works for CrowdStrike, a Mandiant competitor. "There are a lot of people working hard. But the structures aren't there."

Michael DuBose, another former senior justice department official who works for a similar firm, Kroll Advisory Solutions, added: "I think there's a recognition that the government can't stand at the entry point of theinternet to the United States and shield it from all bad things coming in."

Since Mandiant released its report this week, government officials and legislators have publicly embraced its findings. Senator Dianne Feinstein, the Democratic chair of the Senate intelligence committee, hailed Mandiant for exposing the hacking issue. She called its report "sobering" and said she hoped it would spur an international agreement to protect companies from cyber-espionage.

"It's a forcing function in the private sector, and frankly … it's a forcing function with the government," said retired a air force general, Michael Hayden, the former director of the CIA and the National Security Agency who now works for Chertoff, a security consulting firm.

Mandiant's report raises questions, too, about the extent to which private companies are in control of defending the nation's most crucial networks, such as power companies and water treatment plants. Another question is what rules of engagement private companies might rely on. When does a company strike back?

Barack Obama has pressed for Chinese hacking evidence. Photograph: Getty

Mandia and his competitors say they are beholden to US and international laws, which prohibit the type of intrusive acts they accuse China of. Mandia also says his clients are not interested in starting a cyberwar with foreign hackers, in part because they are so vulnerable. "The only time (retaliatory hacking) would really work is if we got all the bad guys out of our networks in the first place," he said. "Then you can start playing that game." Still, publishing the hacking report was an offensive shot across China's bow.

Mandia launched his company in 2004 after several years in the private sector because, he says, there was no company focused on investigating intrusions. With a master's degree in forensic science from George Washington University, he became Mandiant's sole employee and, two years later, got a cash injection from a friend.

Now, he oversees some 330 employees and the field is growing rapidly. He says he used to see about three major incidents a month when he started his business; now he estimates there are between 30 and 100 incidents a month.

Mandia is hardly alone. A former colleague, Stuart McClure, recently started a company called Cylance. He received $15bn in venture capital funds for his business, which he says is distinctive because of its focus on prevention. McClure said he sees the future of cyber-defence residing in the private sector, which has deeper pockets and less red tape.

As for any problems they might cause in diplomatic or security circles for the federal government, Mandia and his competitors say that is not a concern, although he has been hiring lawyers to help monitor US policies and regulations. But as a tech expert, he says he has been focused on stopping intrusions. "We're security guys," Mandia said. "We're not diplomats."