China's cyber-espionage against U.S. is 'more audacious,' NSA official says amid Huawei flap

“We do have concerns,” Rob Joyce says. “Those are based on real, grounded examples. They’re not things we’re going to carry out into the public because we need to be able to track those in the national security space.”

The U.S. government again is concerned about Chinese cyber-operations, a senior National Security Agency official said Tuesday amid ongoing news about possible vulnerabilities in widely used technology.

“We have to worry about national security,” Rob Joyce, a senior adviser for cybersecurity strategy at NSA, said Tuesday at a Wall Street Journal event in New York. “We’ve been strong and consistent in saying we have some specific concerns about supply chain risks and ways nations may take advantage of that.”

Joyce was referring to heightened international scrutiny around the Chinese technology giant Huawei. Canadian authorities this month arrested Meng Wangzhou, Huawei’s chief financial officer, on suspicion of violation U.S. sanctions. Officials in the U.S., U.K., Australia and elsewhere have warned that Huawei’s ties with the Chinese government, combined with widespread adoption of the company’s technology, could result in espionage opportunities for Beijing.

Western officials have not revealed any evidence proving such allegations, and Huawei has consistently denied wrongdoing.

“We do have concerns,” Joyce said Tuesday. “Those are based on real, grounded examples. They’re not things we’re going to carry out into the public because we need to be able to track those in the national security space.”

The questions about Huawei only represent one national security threat with which U.S. officials are considering, Joyce said. Chinese hackers again are becoming “more audacious” three years after the Obama administration and Chinese President Xi Jinping agreed to halt cyber-operations motivated by economic gain, he said.

One challenge is that nation-state hackers exploit vulnerabilities in the very foundation of the internet, Joyce said. He cited Border Gateway Protocol, a mechanism by which traffic is routing access the global web, as a problem that needs to be solved. That issue most recently was on display when several million connections destined for Google instead were rerouted through a Chinese telecom in November, apparently by accident.

“We’re seeing criminal do this, and we’ve certainly seen nation-states do this,” he said of rerouting traffic. “The good thing is that it’s very visible. The world will notice … but any time you’re trying to retrofit something, it’s a challenge.”

Officials disrupt Chinese espionage operation that hit multiple federal agencies

The full hacking suite, seized by authorities, allowed Chinese government funded attackers to intrude highly sensitive networks undetected for more than eight years.

AI-fueled attacks pose ‘active threat’ to water, other sectors, U.S. agencies warn

Former NSA chiefs worry American offensive edge in cybersecurity is slipping

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure