Neuberger: Defining espionage vs. pre-positioning for attacks is key to battling state actors

MUNICH, GERMANY — Just a week after federal agencies published an advisory about Chinese hackers pre-positioning themselves in U.S. critical infrastructure, the White House’s top cyber official said there needs to be more clarity as to what constitutes cyber espionage as opposed to a precursor to a cyberattack.

“For a long time when we all in the industry talked about cybersecurity our key focus was theft of data,” Anne Neuberger, the deputy national security adviser for cyber and emerging technologies, told the Munich Cyber Security Conference.

Now she says the new concern is what the Chinese hacking group Volt Typhoon — which overlaps with groups tracked as BRONZE SILHOETTE and TAG-87 — appears to be doing. “We know it is not for espionage purposes, because when we look at the sectors like water sectors and civilian airport sectors, those have very little intelligence value,” she said.

In response, she said the U.S. government has adopted a three-pronged approach. They are seeking to improve cybersecurity in critical infrastructure by “adopting the European model … by putting in place regulations in key sectors beginning with pipelines, followed by rail and aviation.”

The Biden administration is also trying to deepen both its ties to foreign partners and the classified information it shares with them. Neuberger said key partners need to make “distinctions between cyber espionage and cyberattack pre-positioning and work to put those rules in place.”

Last week, an advisory from the Cybersecurity and Infrastructure Security Agency (CISA), NSA and FBI said they had assessed “that People’s Republic of China (PRC) state-sponsored cyber actors are seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against U.S. critical infrastructure in the event of a major crisis or conflict with the United States.”

READ MORE: Munich Cyber Security Conference 2024 Live Updates