GCHQ Warns Of Mass Data Harvest By China
China has waged a multi-year hacking campaign that harvested personal data belonging to every British citizen, cybersecurity experts have warned.
The GCHQ intelligence agency said the data had been stockpiled in an “unrestrained campaign of malicious cyber-activities” by state sponsored hackers. It includes classified information, research material, business IP that could be used to take down the National Grid and spy on individuals at their workplaces.
It is a further blow to the government’s credibility after the collapse of a China spying case after the failure by senior civil servants to formally declare Beijing a “national security threat”.
Dominic Cummings, who served as a senior adviser to Boris Johnson, also revealed last week that China obtained “vast amounts” of classified government information over a period of many years.
Experts believe that much of the data has not yet been decrypted by China, but has rather been gathered for processing later in what experts call a “harvest now/decrypt later” attack. They believe the hackers are relying on quantum computers, which are advancing so rapidly they may become powerful enough to crack even the most secure forms of encryption within months.
GCHQ claims Beijing is behind the recently discovered “Salt Typhoon” cyberattacks, which since 2021 have targeted government institutions, telecoms systems and critical infrastructure in 80 countries, including Britain and the US.
“It is credible that almost all UK citizens will have had data compromised in these attacks,” said Daniel Shiu, the former head of cryptographic design — the science of how to secure valuable digital information at GCHQ.
Security officials believe the vast haul of data gathered could allow Beijing to target individuals or employees, such as academics, scientists and civil servants, for espionage purposes in areas which would give the country a competitive advantage, including in tech companies, the defence industry and the energy sector.
Such individuals might be hacked or approached via social networking sites, such as LinkedIn, by Chinese agents. Having someone’s personal data, including bank details, could also make them susceptible to blackmail.
In August, the National Cyber Security Centre (NCSC), which is part of GCHQ, took the unusual step of naming the three Chinese companies that perpetrated the hack: Sichuan Juxinhe Network Technology, Beijing Huanyu Tianqiong Information Technology Company and Sichuan Zhixin Ruijie Network Technology Company.
It described these companies as “state-sponsored” by the “People’s Republic of China” and warned that the targets included “telecommunications, government, transportation, lodging, and military infrastructure networks”.
Scientists have said much of the stockpiled data is currently protected but increasingly vulnerable to being cracked.
Everything from personal banking passwords and encrypted messaging services such as WhatsApp to the most top-secret communications about Britain’s military and nuclear warheads, could be rendered defenceless. Harvest now/decrypt later hacks are also feared to include information related to the country’s critical national infrastructure, including energy networks and airports.
“Harvest now/decrypt later attacks are a credible threat we are taking very seriously,” said a senior official at the NCSC. For security reasons, the official’s name is not being disclosed.
The Salt Typhoon attack has already allowed China to monitor communications between politicians and the military and track them worldwide, according to the NCSC. The FBI said the telephone conversations of Donald Trump and JD Vance were also compromised.
“Salt Typhoon is a very large-scale threat, backed by nation-state level resources,” said Shiu, who now works as head of cryptography at the cybersecurity firm Arqit.
He warned that the security threat of the recent hacks has been complicated further by the rapidly advancing field of quantum computing, in which subatomic particles are used to perform previously unimaginably complex calculations.
Last week Cummings said that he and the then prime minister Johnson were informed about a significant security breach in 2020 but that there had been a subsequent cover-up. The hack included “material from intelligence services. Material from the National Security Secretariat in the Cabinet Office. Things the government has to keep secret,” Cummings said.
Security chiefs believe China presents the biggest long-term strategic challenge to Britain compared with other hostile states, such as Russia and Iran. In his annual threat update on Thursday, Sir Ken McCallum, director-general of MI5, warned: “The UK-China relationship is by its nature complex, but MI5’s role is not we detect and deal, robustly, with activity threatening UK national security.”
McCallum warned that Chinese state actors presented a threat “every day” and across a multitude of areas.
“We’ve intervened operationally again in just the last week and will keep doing so,” he said. He singled out China’s “wide-ranging Salt Typhoon intrusions” as “a form of cyberespionage”.
“It is absolutely the case that the UK is subject to highly aggressive and increasingly sophisticated cyberactivity from a range of adversaries, including, very specifically, Chinese hackers,” he added.
Dr Petar Radanliev, a mathematician who specialises in post-quantum encryption at Oxford University, said: “The risk of quantum computers to society is so severe that it cannot be ignored, so we have developedmethods of encryption that are resistant to quantum computers and this process has been ongoing for a decade.”
There believed to be as many as 200 quantum computers in the world, 12 of which are in the UK. China keeps its quantum computing assets secret, but its publicly announced spending on quantum technologies to date is about £11 billion, four times higher than the United States and 15 times higher than Britain.