Chinese hackers target U.S. Chamber of Commerce, report says

The United States Chamber of Commerce, the country's largest business-lobbying organization, was hacked by Chinese hackers, the Wall Street Journal is reporting, citing sources.

Although details are scant, it appears that the hackers had access to the Chamber's network for over a year before they were cleared out in May 2010, the Journal's sources say. The hackers stole six weeks of e-mail from four Chamber employees who were focusing their time on Asia, and could have gained access to all the information the Chamber has on its 3 million members. Although officials are unsure exactly what was taken, investigators found evidence of searches for financial and budget information, the Journal's sources say.

"What was unusual about it was that this was clearly somebody very sophisticated, who knew exactly who we are and who targeted specific people and used sophisticated tools to try to gather intelligence," the Chamber's chief operating officer David Chavern told the Journal in an interview published today.

Although the U.S. government hasn't officially tied the breach to the Chinese government, sources tell the Journal that the group suspected of hacking into the organization's network has ties with Beijing. The Chinese Embassy in Washington told the Journal that claims the government was behind the attacks are "irresponsible."

The U.S. has charged China with waging a clandestine hacking war for years now. Last year, the U.S.-China Economic and Security Review Commission (USCC) said that the Chinese government is attacking the U.S. on a "massive scale."

"Recent high-profile, China-based computer exploitations continue to suggest some level of state support," the Commission wrote in its report to Congress. "Indicators include the massive scale of these exploitations and the extensive intelligence and reconnaissance components."

However, each time the U.S. charges China with hacking into networks, servers, or Web sites, the Chinese say they're innocent. After the U.S. charged China with hacking into satellites earlier this year in another USCC report, for example, China Foreign Ministry spokesman Hong Lei said that the the claims were simply "untrue."

The Chinese government has also fired back at the U.S., saying that intelligence officials are also targeting its interests. However, unlike the U.S., which has largely balked at upping the military rhetoric surrounding the cyberwar, China has made it clear that it will do more to protect itself.

"The U.S. military is hastening to seize the commanding military heights on the Internet, and another Internet war is being pushed to a stormy peak," the Chinese military wrote in its official newspaper, Liberation Army Daily, earlier this year. "Their actions remind us that to protect the nation's Internet security, we must accelerate Internet defense development and accelerate steps to make a strong Internet army."

The Chamber's infiltration seems to corroborate claims made earlier this year by former U.S. national security official Richard Clarke. He pointed out that the U.S. has "no strategy to stop the Chinese cyberassault," and added that so far, the government is doing nothing to protect American companies.

"Rather than defending American companies, the Pentagon seems focused on 'active defense,' by which it means offense," Clarke wrote in a guest column in the Wall Street Journal. "That cyberoffense might be employed if China were ever to launch a massive cyberwar on the U.S. But in the daily guerrilla cyberwar with China, our government is engaged in defending only its own networks.

"It is failing in its responsibility to protect the rest of America from Chinese cyberattack," he continued.

The Chamber's network is now believed to be secure. After analyzing how the hackers were gaining access to information, the Chamber spent 36 hours over one weekend destroying computers and dramatically improving its security. The timing on the overhaul was planned after the Chamber discovered the hackers kept regular working hours and did not work on weekends.