Note: This article references the Office of Foreign Assets Control (OFAC) specially designated nationals persons list, current as of June 29, 2023. OFAC defines cyber sanctions focus on “specific harms caused by significant malicious cyber-enabled activities, and directs the Secretary of the Treasury, in consultation with the Attorney General and the Secretary of State, to impose sanctions on those persons determined to be responsible for or complicit in activities leading to such harms.“
THE RUNDOWN
The United States, as well as strong allies like the United Kingdom, has long maintained that China is one of its biggest cyber adversaries, as well as the most pervasive cyber threat against its interests. In a recent testimony the Director of the Federal Bureau of Investigation acknowledged that China’s cyber resources are substantial, with Chinese hackers outnumbering FBI cyber personnel by at least 50 to one.
The U.S. government has publicly acknowledged that China is a cyber espionage threat, in comparison with Russia and Iran who have been engaged in more disruptive cyber attacks in recent years. Per U.S. officials, Chinese intellectual property theft has been ongoing for numerous years, and is estimated to cost the United States USD 600 billion a year. Despite a 2015 agreement between presidents Barack Obama and Xi Xiping to not hack for economic advantage, China has continued to engage in such activity without any meaningful consequence to either punish or deter its actions.
Cyber Sanctions
To be fair, the United States has steadily tried to increase its pressure on state cyber actors in an effort to influence governments to alter their behaviors in cyberspace. For the past several years, the United States government has engaged in two primary courses of action to deter hostile state activity—indictments and sanctions. While these measures have allowed the United States to publicly name-and-shame state perpetrators, and by extension, assign some level of confident attribution in a public setting, they have also enabled Washington to mete out punishment as a consequence of these activities. The Department of Justice (DoJ) has levied several indictments against state and state affiliated entities tied to China, Iran, North Korea, and Russia. Though no one expects these respective governments to turn over these individuals, indictments greatly restrict the accused’s freedom of world travel.
The U.S. government has also pursued implementing cyber sanctions in order to alter the strategic decisions of state and non-state actors, an approach that it has used in other areas and other issues. By the end of 2020, the United States executed almost 8,000 sanctions against individuals and companies, affecting at least 26 countries, with at least 300 of these sanctions being cyber-related. The countries most impacted by U.S. cyber sanctions are Iran, North Korea, and Russia, although non-state entities are also represented on the list. Some of these state-related entities have been included in DoJ indictments as well, indicating that perhaps the U.S. uses indictments as a justification for cyber sanction imposition.
However, it should be noted that while cyber sanctions provide a material effect on foreign governments, there is little evidence suggesting that they have been effective in altering foreign state behavior, calling into question if such an approach isn’t more about making a statement of punishment than achieving a strategic objective. The 2023 National Cybersecurity Strategy references sanctions very few times, and only in broad terms as far as being part of its toolbox to address cyber incidents and reinforce responsible state behavior in cyberspace. It does not establish a framework or suggest how they will be implemented, making their application across the state spectrum potentially inconsistent.
CHIPS and Science Act
This is not to say that the U.S. government hasn’t made some moves to stand up to China. Washington has imposed other sanctions against Beijing, and with respect to the cyber space, Washington has tried to demonstrate its resolve against alleged Chinese cyber malfeasance by banning Chinese companies like Huawei from being used in government systems, and encouraging partner and friendly nations to follow suit. Additionally, although not directly tied to cyber espionage, the United States and China have been engaged in a tech war that has been underpinning technology competition between the two countries for some time. Washington has flexed its muscles as of late in an effort to at least partially “decouple” from China to try slow China’s tech advances, and develop them to support its military objectives. In an effort to curb Chinese technology growth, the United States implemented its CHIPS and Science Act , which allocates approximately USD $280 billion (USD $50 billion dedicated for the design and production of chips domestically) to strengthen U.S. semiconductor capacity, catalyze research and development, and create regional high-tech hubs. It has also restricted Chinese access to U.S. technology in areas like artificial intelligence with possible plans to do the same with respect to cloud computing in the future.
But protectionist economic maneuvers are not the same as imposing penalties for egregious cyber activities that have both boosted Chinese intelligence collection and helped bolster China’s private sector projects. Given the same economic considerations of a rampant two-decades long IP theft campaign, the question remains: why hasn’t the United States instituted cyber sanctions against Beijing if they are a part of its statecraft toolbox? The 300 lb. elephant in the room is the dependency of both economies on the other. Despite the tensions and contentious issues between Beijing and Washington, trade between them hit a record high USD $690 billion in 2022 (the U.S. imported USD 538.8 billion of Chinese goods, and exported USD 153.8 billion), suggesting that even when at odds a strong partnership between the world’s two largest economies makes sense, at least from a fiscal perspective. Any major move against Beijing’s economy as punishment for its cyber espionage offenses would certainly elicit an appropriate Chinese response, as was evidenced in a reciprocal tariff war during the Trump presidency.
Finger pointing about cyber espionage and other cyber malfeasance does not go one way. Over the past several months, China has also joined in the naming-and-shaming alleging U.S. cyber wrongdoing and “cyber hegemony.” And regardless of the intent of the U.S. programs that have been exposed, detrimental leaks caused by Edward Snowden and the recent disclosure of Pentagon documents paint the United States’ spying efforts in an unflattering light. If one accepts that governments spy for their own benefit and to support their national security objectives, it is difficult to distinguish types of spying. If Beijing considers economic spying to support its industries a national security imperative, then it is pursuing its interests. If other countries don’t feel the same way, that becomes a matter of cultural and perhaps ideological perspective differences. It all can be written off as governments looking after their own well-being.
Therefore, another equally compelling reason that no cyber-specific sanctions will be imposed on China is that Biden may be seeking to build consensus among likeminded nations before doing so, knowing the potential economic impact it will have on the United States and the larger global economy if reciprocal actions are taken. A hallmark of Biden’s foreign policy has been to avoid unilateral action in favor of building coalitions and consensus, as reflected in the strengthening the trans-Atlantic relationship during the Ukraine conflict. Similarly, Biden may be looking for other countries impacted by Chinese cyber espionage to put forth a united front. Interestingly, no other victimized country has brought sanctions against China for cyber espionage either, which may be why such a coalition has not yet materialized and may not anytime in the near future.
TAKEAWAY
The United States is trying to improve relations with China, having sent both the Secretaries of State and Treasury on to separate trips to Beijing for this purpose. Even in the midst of tariffs and an ongoing tech war, Washington understands that it’s not good business if the world’s two largest economies are at odds with one another, making the possibility of technological decoupling a difficult venture even if there is increasing talk about it. The United States’ history of implementing sanctions has had varied success but remains one of Washington’s most powerful instruments of statecraft influence. They have been levied to punish states and alter their behavior on a range of issues that include but are not limited to human rights, terrorism, unfair trade practices, arms sales, and as of April 2015, cyber-enabled activities.
However, Washington will likely continue to avoid cyber sanction imposition on China for the foreseeable future, as long as Beijing does not cross an enigmatic redline that puts robust their mutual economic benefit in peril. Should an event such as a Taiwan situation escalate in a similar manner as Ukraine, Washington might be compelled to levy cyber sanctions against Chinese companies, individuals, and/or government agencies that have been outlined in Department of Justice indictments as economic punishment. This will not influence China to alter its course of action. Still, short of such an incident, Washington will continue to try to mend the broken relationship through diplomacy and confidence building measures to put the two countries on surer footing, a potentially lengthy process that benefits China in the long run.