白宫
华盛顿哥伦比亚特区
2021年7月19日
长期以来，美国对中华人民共和国在网络空间采取不负责和破坏稳定的行为一贯表示关注。今天，美国与我们的各盟国和伙伴进一步详细揭露中华人民共和国采取恶意网络活动的惯用模式，并采取进一步行动予以抵制，因为这类活动对美国和盟国的经济和国家安全构成了重大威胁。
各盟国和伙伴——包括欧洲联盟（European Union）、英国和北约（NATO）——前所未有地共同加入美国的行列，对中华人民共和国的恶意网络活动进行揭露和批评。
中华人民共和国在网络空间采取不负责的行为模式不符合其声称在全世界展现为负责任的领导者的表示。今天，世界各国都明确表示，对中华人民共和国恶意网络活动的关注促使各国一致揭露这些活动，促进网络保护和网络安全，并采取行动制止对我们经济和国家安全造成的威胁。
我们的各盟国和伙伴是力量的巨大来源，成为美国一项独特的优势。我们对网络威胁一致采取共享信息、防范和缓解措施有助于追究中国等国的责任。协同努力可以提高并增进与公共和民间利益相关方的信息共享，包括涉及网络威胁的情报和网络防护的信息，同时为加强我们共同的网络应变能力和安全合作拓展外交联系。今天宣布的事项以总统第一次外访取得的进展为基础。从7国集团（G7）和欧盟在勒索软件问题上坚持的立场到北约7年来第一次采取新的网络防护政策，总统与我们的盟国采取共同的网络措施，就负责任的国家在网络空间的行为如何达到期待的状态提出明确的要求和标志。
今天，拜登（Biden）政府与我们的盟国协同一致采取以下行动：
揭露中华人民共和国利用犯罪的合同黑客进行未经授权的全球作业，包括为其一己私利。
美国高度关注中华人民共和国培植的包括合同黑客在内的情报机器。这些黑客也在全世界从事未经授权的网络作业，其中包括为自己个人牟利。2018年10月及2020年7月和9月发布的公诉文件详细指出，曾为中华人民共和国国家安全部工作的黑客参与针对世界各地受害者的勒索软件攻击、网络敲诈、网络劫持和军人身份盗窃等活动，目的都在于获取钱财。
在某些案例中，我们了解到隶属中华人民共和国政府的网络操作人员对民营公司采取勒索软件行动，索求千百万美元的赎金。中华人民共和国不愿意解决合同黑客的罪恶活动问题，致使各地政府、工商业和重要的基础设施运营者遭到伤害，在知识产权、所有权信息、支付赎金和降低危害等方面承受高达数十亿美元的损失。
[美国司法部（United States Department of Justice）]对4名国家安全部的黑客进行惩罚并宣布提起刑事指控
美国司法部宣布对国家安全部黑客提起刑事指控，要求审查其以外国政府和关键部门实体为目标多年从事的涉案活动，其中至少涉及10多个国家的海事、航空、国防、教育和卫生领域。司法部的文件陈述了国家安全部黑客如何企图盗窃埃博拉（Ebola）病毒疫苗的研究，说明中华人民共和国盗窃知识产权、商业秘密和工商业机密信息的活动已扩展到重要的公共卫生领域。司法部指控国家安全部从事的众多活动完全背离了中华人民共和国关于不为获得商业优势参与网络盗窃知识产权活动的双边和多边承诺。
高度确信隶属中华人民共和国国家安全部的恶意网络行动人员利用2021年3月初披露的微软交换服务组件Microsoft Exchange Server零时差漏洞从事网络间谍活动。
在微软发布安全更新前，隶属国家安全部的网络操作人员利用其中的漏洞导致世界各地成千上万的电脑和网络受损，其中大多数是民间部门的受害者，需要为采取补救措施承担高昂的代价。
我们已就上述事件和中华人民共和国更广泛的恶意网络活动向中华人民共和国政府高级官员提出我方的关注，明确指出中华人民共和国的行动对网络空间的安全、信心和稳定构成了威胁。
拜登政府对Microsoft Exchange事件的反应增强了美国政府的网络防护。
过去几个月，我们重点要求从公共和民间网络中驱逐隶属国家安全部的恶意网络行动人员，使漏洞得到弥补和缓解，防止恶意行动人员卷土重来或造成更大的损失。
拜登政府正在夜以继日地努力使联邦网络现代化，并改善全国的网络安全，其中包括关键性基础设施的安全。
o国家标准与技术研究院（National Institute of Standards and Technology）召集了一次研讨会，有来自产业界、学术界和政府的近1,000名参与者，以获得开发安全软件的最佳做法的建议。
o国家标准与技术研究院发布了应被供应商用于检测他们的软件安全的最基本的标准指南。这显示出我们如何借助于联邦采购工作来提高不仅是联邦政府所使用的，而且是公司企业、州和地方政府以及个人所使用的软件的安全。
o国家电信和信息管理局（National Telecommunications and Information Administration）发布了软件物料清单（Software Bill of Materials）的最基本元素，作为提高美国公众所使用的软件的透明度的第一步。
o网络安全和基础设施安全局（Cybersecurity and Infrastructure Security Agency）确立了一个管理联邦文职机构如何安全地使用云服务的框架。
通过揭示中华人民共和国的恶意活动，我们正在继续本届政府向系统所有者和运营者提供信息并赋权以采取行动的努力。我们敦促民营部门的公司企业效仿联邦政府的领导作用，采取有魄力的举措，本着最大限度地减少今后的安全事件的目标增强网络安全投资，并与该目标保持一致。
________________________________________
欲查看原稿内容:  https://www.whitehouse.gov/briefing-room/statements-releases/2021/07/19/the-united-states-joined-by-allies-and-partners-attributes-malicious-cyber-activity-and-irresponsible-state-behavior-to-the-peoples-republic-of-china/

The United States, Joined by Allies and Partners, Attributes Malicious Cyber Activity and Irresponsible State Behavior to the People’s Republic of China
JULY 19, 2021
The United States has long been concerned about the People’s Republic of China’s (PRC) irresponsible and destabilizing behavior in cyberspace. Today, the United States and our allies and partners are exposing further details of the PRC’s pattern of malicious cyber activity and taking further action to counter it, as it poses a major threat to U.S. and allies’ economic and national security.
An unprecedented group of allies and partners – including the European Union, the United Kingdom, and NATO – are joining the United States in exposing and criticizing the PRC’s malicious cyber activities.
The PRC’s pattern of irresponsible behavior in cyberspace is inconsistent with its stated objective of being seen as a responsible leader in the world. Today, countries around the world are making it clear that concerns regarding the PRC’s malicious cyber activities is bringing them together to call out those activities, promote network defense and cybersecurity, and act to disrupt threats to our economies and national security.
Our allies and partners are a tremendous source of strength and a unique American advantage, and our collective approach to cyber threat information sharing, defense, and mitigation helps hold countries like China to account. Working collectively enhances and increases information sharing, including cyber threat intelligence and network defense information, with public and private stakeholders and expand diplomatic engagement to strengthen our collective cyber resilience and security cooperation. Today’s announcement builds on the progress made from the President’s first foreign trip. From the G7 and EU commitments around ransomware to NATO adopting a new cyber defense policy for the first time in seven years, the President is putting forward a common cyber approach with our allies and laying down clear expectations and markers on how responsible nations behave in cyberspace.
Today, in coordination with our allies, the Biden administration is:
Exposing the PRC’s use of criminal contract hackers to conduct unsanctioned cyber operations globally, including for their own personal profit.
The United States is deeply concerned that the PRC has fostered an intelligence enterprise that includes contract hackers who also conduct unsanctioned cyber operations worldwide, including for their own personal profit. As detailed in public charging documents unsealed in October 2018 and July and September 2020, hackers with a history of working for the PRC Ministry of State Security (MSS) have engaged in ransomware attacks, cyber enabled extortion, crypto-jacking, and rank theft from victims around the world, all for financial gain.
In some cases, we are aware that PRC government-affiliated cyber operators have conducted ransomware operations against private companies that have included ransom demands of millions of dollars. The PRC’s unwillingness to address criminal activity by contract hackers harms governments, businesses, and critical infrastructure operators through billions of dollars in lost intellectual property, proprietary information, ransom payments, and mitigation efforts.
[United States Department of Justice] imposing costs and announcing criminal charges against four MSS hackers.
The US Department of Justice is announcing criminal charges against four MSS hackers addressing activities concerning a multiyear campaign targeting foreign governments and entities in key sectors, including maritime, aviation, defense, education, and healthcare in a least a dozen countries. DOJ documents outline how MSS hackers pursued the theft of Ebola virus vaccine research and demonstrate that the PRC’s theft of intellectual property, trade secrets, and confidential business information extends to critical public health information. Much of the MSS activity alleged in the Department of Justice’s charges stands in stark contrast to the PRC’s bilateral and multilateral commitments to refrain from engaging in cyber-enabled theft of intellectual property for commercial advantage.
Attributing with a high degree of confidence that malicious cyber actors affiliated with PRC’s MSS conducted cyber espionage operations utilizing the zero-day vulnerabilities in Microsoft Exchange Server disclosed in early March 2021.
Before Microsoft released its security updates, MSS-affiliated cyber operators exploited these vulnerabilities to compromise tens of thousands of computers and networks worldwide in a massive operation that resulted in significant remediation costs for its mostly private sector victims.
We have raised our concerns about both this incident and the PRC’s broader malicious cyber activity with senior PRC Government officials, making clear that the PRC’s actions threaten security, confidence, and stability in cyberspace.
The Biden Administration’s response to the Microsoft Exchange incident has strengthened the USG’s Cyber Defenses.
In the past few months, we have focused on ensuring the MSS-affiliated malicious cyber actors were expelled from public and private sector networks and the vulnerability was patched and mitigated to prevent the malicious cyber actors from returning or causing additional damage.
As announced in April, the U.S. Government conducted cyber operations and pursued proactive network defense actions to prevent systems compromised through the Exchange Server vulnerabilities from being used for ransomware attacks or other malicious purposes. The United States will continue to take all appropriate steps to protect the American people from cyber threats. Following Microsoft’s original disclosure in early March 2021, the United States Government also identified other vulnerabilities in the Exchange Server software. Rather than withholding them, the United States Government recognized that these vulnerabilities could pose systemic risk and the National Security Agency notified Microsoft to ensure patches were developed and released to the private sector. We will continue to prioritize sharing vulnerability information with the private sector to secure the nation’s networks and infrastructure.
The U.S. Government announced and operated under a new model for cyber incident response by including private companies in the Cyber Unified Coordination Group (UCG) to address the Exchange Server vulnerabilities. The UCG is a whole-of-government coordination element stood up in response to a significant cyber incident. We credit those companies for being willing to collaborate with the United States Government in the face of a significant cyber incident that could have been substantially worse without key partnership of the private sector. We will build on this model to bolster public-private collaboration and information sharing between the United States Government and the private sector on cybersecurity.
Today, the National Security Agency, the Cybersecurity and Infrastructure Agency, and the Federal Bureau of Investigation released a cybersecurity advisory to detail additional PRC state-sponsored cyber techniques used to target U.S. and allied networks, including those used when targeting the Exchange Server vulnerabilities. By exposing these techniques and providing actionable guidance to mitigate them, the U.S. Government continues to empower network defenders around the world to take action against cybersecurity threats. We will continue to provide such advisories to ensure companies and government agencies have actionable information to quickly defend their networks and protect their data.
The Biden Administration is working around the clock to modernize Federal networks and improve the nation’s cybersecurity, including of critical infrastructure.
The Administration has funded five cybersecurity modernization efforts across the Federal government to modernize network defenses to meet the threat. These include state-of-the-art endpoint security, improving logging practices, moving to a secure cloud environment, upgrading security operations centers, and deploying multi-factor authentication and encryption technologies.
The Administration is implementing President Biden’s Executive Order to improve the nation’s cybersecurity and protect Federal government networks. The E.O. contains aggressive but achievable implementation milestones, and to date we have met every milestone on time including:
The National Institute of Standards and Technology (NIST) convened a workshop with almost 1000 participants from industry, academia, and government to obtain input on best practices for building secure software.
NIST issued guidelines for the minimum standards that should be used by vendors to test the security of their software. This shows how we are leveraging federal procurement to improve the security of software not only used by the federal government but also used by companies, state and local governments, and individuals.
The National Telecommunications and Information Administration (NTIA) published minimum elements for a Software Bill of Materials, as a first step to improve transparency of software used by the American public.
The Cybersecurity and Infrastructure Security Agency (CISA) established a framework to govern how Federal civilian agencies can securely use cloud services.
We continue to work closely with the private sector to address cybersecurity vulnerabilities of critical infrastructure. The Administration announced an Industrial Control System Cybersecurity Initiative in April and launched the Electricity Subsector Action Plan as a pilot. Under this pilot, we have already seen over 145 of 255 priority electricity entities that service over 76 million American customers adopt ICS cybersecurity monitoring technologies to date, and that number keeps growing. The Electricity Subsector pilot will be followed by similar pilots for pipelines, water, and chemical.
The Transportation Security Administration (TSA) issued Security Directive 1 to require critical pipeline owners and operators to adhere to cybersecurity standards. Under this directive, those owners and operators are required to report confirmed and potential cybersecurity incidents to CISA and to designate a Cybersecurity Coordinator, to be available 24 hours a day, seven days a week. The directive also requires critical pipeline owners and operators to review their current practices as well as to identify any gaps and related remediation measures to address cyber-related risks and report the results to TSA and CISA within 30 days. In days to come, TSA will issue Security Directive 2 to further support the pipeline industry in enhancing its cybersecurity and that strengthen the public-private partnership so critical to the cybersecurity of our homeland.
By exposing the PRC’s malicious activity, we are continuing the Administration’s efforts to inform and empower system owners and operators to act. We call on private sector companies to follow the Federal government’s lead and take ambitious measures to augment and align cybersecurity investments with the goal of minimizing future incidents.
###