China accuses U.S. of launching ‘advanced’ cyberattacks, names alleged NSA agents

A sign outside the National Security Agency (NSA) campus in Fort Meade, Md., June 6, 2013. (AP / Patrick Semansky, File)

BEIJING — China accused the United States National Security Agency (NSA) on Tuesday of launching “advanced” cyberattacks during the Asian Winter Games in February, targeting essential industries.

Police in the northeastern city of Harbin said three alleged NSA agents to a wanted list and also accused the University of California and Virginia Tech of being involved in the attacks after carrying out investigations, according to a report by state news agency Xinhua on Tuesday.

The NSA agents were identified by Xinhua as Katheryn A. Wilson, Robert J. Snelling and Stephen W. Johnson. The three were also found to have “repeatedly carried out cyber attacks on China’s critical information infrastructure and participated in cyber attacks on Huawei and other enterprises.”

It did not specify how the two American universities were involved.

The U.S. Embassy in China did not respond to an emailed request for comment.

China’s foreign ministry later confirmed the attacks and said Beijing had raised its concerns with the United States.

“We urge the U.S. to take a responsible attitude on the issue of cyber security and ... stop unprovoked smears and attacks on China,” ministry spokesperson Lin Jian said at a regular news briefing.

The detailed allegations come as the world’s two largest economies spiral deeper into a trade war that has already spurred travel warnings for Chinese tourists going to the U.S. and halted imports of U.S. films into China.

“The U.S. National Security Agency (NSA) launched cyber attacks against important industries such as energy, transportation, water conservancy, communications, and national defense research institutions in Heilongjiang province,” Xinhua said, citing the Harbin city public security bureau.

The attacks had “the intention of sabotaging China’s critical information infrastructure, causing social disorder, and stealing important confidential information,” it added.

Anonymous servers

Xinhua said the NSA operations took place during the Winter Games and were “suspected of activating specific pre-installed backdoors” in Microsoft Windows operating systems on specific devices in Heilongjiang.

In order to cover its tracks, the NSA purchased IP addresses in different countries and “anonymously” rented a large number of network servers including in Europe and Asia," Xinhua said.

The NSA intended to use cyberattacks to steal the personal data of participating athletes, the news agency said, adding that the cyber attacks reached a peak from the first ice hockey game on February 3.

The attacks targeted information systems such as the Asian Winter Games registration system and stored “sensitive information about the identities of relevant personnel of the event,” Xinhua said.

The U.S. routinely accuses Chinese state-backed hackers of launching attacks against its critical infrastructure and government bodies.

Last month, Washington announced indictments against a slew of alleged Chinese hackers who targeted the U.S. Defense Intelligence Agency, the U.S. Department of Commerce, and the foreign ministries of Taiwan, South Korea, India, and Indonesia.

Beijing denies all involvement in overseas cyber espionage.

After years of being accused by Western governments of cyberattacks and industrial espionage, in the past two years several Chinese organizations and government organs have accused the United States and its allies of similar behaviour.

In December, China said it found and dealt with two U.S. cyber attacks on Chinese tech firms to “steal trade secrets” since May 2023, but did not name the agency involved.

(Reporting by Laurie Chen, Liz Lee, Qiaoyi Li and Colleen Howe in Beijing and Farah Master in Hong Kong; Editing by Jacqueline Wong and Saad Sayeed)