I'm Dan Kurtz-Phalin, and this is the Foreign Affairs Interview.
I actually believe that we can get our cyber defenses to where we have confidence that our most important networks cannot be disrupted by an adversary. And that's really the question we have to ask ourselves: can we prevent the most critical military, power, pipeline networks from being disrupted during a crisis or conflict? And I believe that we can.
In 2024, the US government discovered that Chinese hackers had penetrated a huge swath of the American telecommunications system and remained there for years. That attack came to be known as Salt Typhoon. And from what we know, China has not just managed to steal the data and surveil the communications of hundreds of millions of Americans, it also embedded itself in the United States' most important infrastructure, giving Beijing a crucial advantage in a conflict.
Anne Neuberger was until recently the top cybersecurity official on the National Security Council. She was in that position when Salt Typhoon was discovered. And to her, the attack is not just an isolated incident of cyber espionage. Rather, it is evidence of American weakness and Chinese dominance in a central arena of national security.
Decades after the widespread adoption of the internet opened a new realm of geopolitical contestation, she writes in the current issue of Foreign Affairs, the United States has fallen behind, failing to secure a vast digital homeland. Neuberger warns that as artificial intelligence grows ever more sophisticated, the threat of a cyber attack that could paralyze the country in a time of crisis has never been higher.
I'm very glad to be having this conversation and to have your important and, frankly, fairly disquieting essay in our latest issue. It's called "China Is Winning the Cyber War," that follows a couple of pieces you did for Foreign Affairs during and just after your time serving as the senior official on the National Security Council overseeing cyber and emerging technology issues that ran until early this year. And those four years in the White House followed many more years working on cyber and tech issues at the NSA, the National Security Agency, and the Defense Department. So, you bring a ton of experience to these questions.
Thanks so much. It's great to be here with you, and it was really great to write about those issues and, frankly, work with the editors at Foreign Affairs on getting them there. These are complex, esoteric topics sometimes, and getting them out there in a way hopefully that's digestible and can be a drive for action.
I hope that's right. Let's go right to that recent piece. It opens with a fairly astonishing — and I think "astonishing" really is the word for it — Chinese cyber attack on the United States that has unfolded over the last few years and is in some sense still unfolding. It's gotten plenty of coverage in recent months, and yet I don't think most people have fully registered just how dramatic and distressing that attack has been. So let's start very simply: what is Salt Typhoon, the name for that cyber attack, and what exactly happened?
You're exactly right. You know, many have said afterwards we didn't quite understand what that was. So, Salt Typhoon was China's compromise of a large number of telecommunications companies around the United States. Frankly, it's part of a campaign where they're trying to compromise telecoms around the world as well, with the goal of collecting the kind of information that rides on our telecom networks — corporate secrets, private communications, whether political leaders or individuals, and national security secrets, of course, because telecommunications networks really are the gold mine of data, and that's what China was targeting here.
And just to be a little bit more concrete about it, you know, you go into some of the details in the piece. I imagine in a classified setting you'd be able to go into many more details, but you note that China did something — I'm quoting you here — that the United States, the tech powerhouse, could not adequately defend against. They gained and maintained access to major US telecommunications networks, copying conversations and building the ability to track the movements of US intelligence officers and law enforcement agents across the country. And that, of course, goes well beyond just people who work in the intelligence community or in national security positions. It really means they can track movements and listen to conversations of probably most Americans. Is that a fair way of putting it?
Yes, it is a fair way of putting it. China essentially turned our telecommunications companies into an espionage vehicle, you know, into a global SIGINT system, a signals intelligence system. The Salt Typhoon attack was really a window into China's espionage campaigns around the world. And what was remarkable was, in some cases, they gained a foothold. It could have been as much as three years ago. The companies didn't detect it. They certainly didn't block it. And that enabled China to get deeper and deeper into the networks, hide their tracks, and frankly get into some of the most valuable parts of the networks and turn them into a tool of signals intelligence, essentially able to collect, where concerned, any conversation at will, make a copy of it. Whether that's political leadership, whether that's potentially tracking individuals, because from cell towers you can geographically track individuals in the United States. So China really turned our own telecommunications companies into a vehicle of their intelligence.
Are we confident that we have a full picture of this, or is there a chance that they're still in some of those networks?
Because a number of those telecom companies did not have adequate detection capabilities, we really don't know in many cases when the Chinese campaign first got a foothold or how much they moved across the network.
One question that I think people have asked in reading about Salt Typhoon and reading the piece is whether this is any different — when you look at this specific example of Chinese cyber activity — whether it's any different from the kind of espionage that's happening constantly at this point. You know, what our NSA is doing to the Chinese and Russians and Iranians and many others as much as possible. The Snowden revelations more than 10 years ago at this point, I think, revealed just how aggressive and skilled the United States is in surveilling others. Which I guess this all may just be kind of a part of great power dynamics and competition at this point. Is that too blasé, or in some ways kind of not registering the extent of what the Chinese have done?
I think it is a bit too blasé because as a country we want to protect our nation's secrets. We want to protect sensitive conversations from the eyes of a competitor or an adversary. So the fact that, as a country, as a technological and innovation leader in the world, we — when I say that our overall system of companies and government could not detect, could not block, and that China was able to maintain this kind of presence and collect at this vast scale, and potentially the scale and the particular information that was of interest — is something we definitely should not be blasé about. We can be better, and that's what the piece talks about: what are the steps we can take to prevent this kind of Chinese intelligence success in the future.
So I want to get to a lot of the elements of prescription, some of the recommendations that you make in the piece, but still want to talk a bit about the larger campaign that Salt Typhoon is just the latest example of. You note in the piece that — I'm quoting you here — "China is positioning itself to dominate the digital battle space. The United States has fallen behind, failing to secure a vast digital homeland and the physical assets that depend on it." One really striking aspect of that campaign that you describe in the piece is the way in which China has put in malware into American energy and water and pipeline and transportation systems, which suggests that China has something else in mind than just kind of traditional espionage. What is that campaign? What are the steps that China has taken, and why do you find that so concerning, especially in a crisis scenario?
You know, your listeners may have heard the term Volt Typhoon, particularly from the former director of the FBI, Chris Wray, who talked about how Chinese malware had been found in various sectors in the US, from pipelines to ports to water systems. And the reason that's concerning is because we're a connected country. Our critical infrastructure is connected to the internet. And when you think about, for example, the average port or water filtration system, those systems are reachable by the internet. They can be turned on or off. And our concern is that China, as part of its overall strategic goals, really views cyber and space for that matter as a part of its broader competition with the United States.
And as such, given that the US military, for example, relies on the power, pipelines, and ports of the broader nation, that China could use its position in critical infrastructure to disrupt or disable those components, either to impede military mobilization or to put pressure or coerce a future US leadership from staying out of a conflict or crisis. And there are unique aspects of cyberspace that make it a useful tool to achieve both of those goals.
And just to give this a degree of concreteness, the scenario you would worry about would be something like some kind of crisis in the Taiwan Strait and China suddenly threatening to disable American hospital systems or prevent American military bases from mobilizing in the way they might in that moment in order to deter American involvement? Or is it just kind of — give us a sense of how to understand that risk.
Pretty close to that, right? Our nation's soldiers and service members deploy from our ports and airports. So you could see China causing issues in the port navigation system or in an air traffic control system in order to disable flights for a period of time. That could be a critical period of time, delaying service members' ability to deploy in the event of a crisis or conflict. That's a great example. In parallel to that, because cyberspace is not like a traditional geographic space where there's homeland and battleground, it's all one connected set of systems. So one could see China potentially threatening to disable parts of critical infrastructure and leaving future US leadership having to balance and consider the impact on the homeland if the US gets involved in a particular crisis. So it's either buying time potentially, or as a tool of coercion or information warfare as part of China achieving its strategic goals in the Indo-Pacific.
It was really striking that you note in the piece that Chinese military theorists refer to this as an important part of strategic deterrence, right? That this is not a kind of marginal part of their national security strategy, but really central to it.
It is. If one keeps us out of the fight, that could be a key goal of Chinese military planners.
I imagine there's some Sun Tzu quote that we could invoke here that would capture it, but we won't strain for that. Instead, I want to go back into some of the history of this. You've of course worked on these issues, I think, much longer than most people have who are in this space, and probably longer than most of us who are not kind of steeped in these issues day to day have been paying close attention to it. And yet you assess that, you know, even after a decade and a half of pretty intensive focus on these risks and these vulnerabilities by the US national security community and state more broadly, that our cyber defense is, quote, "unready for battle," that we have not done a great job of addressing vulnerabilities. As you look back at our efforts to address this problem over the last couple of decades, why do we remain so vulnerable? Why are we still so unprepared for the threat?
It's a really important question. So I would say first, I've been fortunate to lead both offensive and defensive operations, and as a result, I've seen the continuum across them. Our strategy overall for deterrence in cyberspace needs to reflect both, because if we can't defend our most important critical networks that Americans rely on, that our military relies on, we are — and we can be — hesitant to actually use our offensive capabilities because we're concerned about escalation and a potential uncontrolled tit-for-tat. So that leads me to the first point, to say that we have to look at cyberspace as a continuum across defense and offense.
A lot of progress has been made over the last decade, but also as we saw China's program increasingly move beyond espionage to also building cyber attack capabilities for potential cyber warfare, our model and the asymmetry between the United States as a democracy and China as an authoritarian country truly came to bear. In that the United States doesn't monitor private sector networks, and the vast majority of our critical ports, pipelines, and water systems are owned by the private sector. That means that really until the last administration, not only did the United States not monitor those communications, but there was pretty bipartisan, Democratic and Republican resistance to even putting in place minimum cybersecurity requirements to ensure the companies that own those networks were taking the basic steps to defend those networks.
And in contrast, China, as an authoritarian country, deploys a great firewall, a system of sensors and controls that goal number one censors the conversations, the discussions of its domestic population, but goal number two also monitors its networks for attacks and in many cases can block and prevent those attacks as well. So that asymmetry between our two systems has meant that China stays a step ahead in the battles in cyberspace.
And the key part of that is it's not so much that the United States is less capable of launching offensive cyber operations or these kinds of espionage operations. It's that we are so much more vulnerable at home because we can never hope to get our defenses to the point that China can. Is that the right way of capturing the dilemma?
I actually believe that we can get our cyber defenses to where we have confidence that our most important networks cannot be disrupted by an adversary. And that's really the question we have to ask ourselves: can we prevent the most critical military, power, pipeline networks from being disrupted during a crisis or conflict? And I believe that we can. It's more challenging in our system because that responsibility is across government and the private sector. But we must.
You know, another area where we've spent a lot of time and a lot of focus in the past several years in the United States, but where the US is still being quite behind Chinese efforts, is the attempt to develop global telecommunications infrastructure. This was about Huawei's dominance in developing 5G, which probably during Trump's first term became a major issue. But the US is still not having made up much ground and being kind of set to lose the race not just for 5G but in the future for 6G infrastructure. Why have we not made more progress there, and what will it take to really offset Chinese advantage in that regard?
You know, 5G is so interesting because it's a window into how China focuses on strategic technologies and plays to win. And in fact, it's particularly notable because the United States led in wireless technologies and was a leader all through the '90s. And in the early 2000s, China noted the importance of telecommunications — we talked about everything rides on telecom — and started to take strategic steps. And really the three components of China's policy are a focused government investment in areas of strategic technology that they view as a priority. Second, a closed domestic market that's massive, which enables Chinese companies to both refine their product, but also make vast amounts of money that are then used to subsidize and essentially sell below cost their products overseas. I think some would say that in the case of telecom, China also used extensive theft of American and European intellectual property to really drive the first products that Huawei and ZTE produced. But those three components are really a key part of how China built dominance in telecommunications and in other strategic technologies.
Now what's unique about telecom, which is so interesting, is China also recognized that once they had subsidized a country's 3G or 4G infrastructure, the replacement cost — the cost of ripping out and putting in a system from a non-Chinese vendor — was really significant. And that's what's become the major barrier. So the Trump administration started focusing on this as a real strategic area during the first Trump administration and called on allies and educated allies to have them realize the significant national security risk of having a Chinese company subject to Chinese law that requires them to make data available at any time deployed in their networks. However, what was missing was a viable economic approach to actually compete with that.
During the Biden administration, continuing the Trump policy, we broke new ground in actually using EXIM and DFC to finance 5G deals, notably in Costa Rica.
That's the Export-Import Bank and the Development Finance Corporation, right?
Exactly. So for the first time, kind of, we noted that you got to bring money to the fight. You had to compete economically. And even though the key vendors were no longer US vendors, we went to bat for Western vendors because we felt this was a battle between essentially democracies and China on the other side. So the United States, EXIM, the Export-Import Bank, provided $300 million in financing to Costa Rica. But the story didn't end there, and that's what's so interesting. Huawei sued the Costa Rican government in their court to try to block the deal. It took over a year, but eventually the Costa Rican government won. But what it showed was the degree to which Huawei and the Chinese government would be willing to go hand-to-hand combat to maintain their predominance.
We did the same. You know, President Biden invited the president of Costa Rica to the White House and talked about the importance of this topic. We provided the financing as well, but it just shows what needs to be scaled and where European allies, frankly, need to join us in order to counter China in telecommunications.
I'm sure you've spent plenty of time talking to foreign officials about why having Huawei technology — this less expensive Huawei technology and quite effective in terms of how it functions, as I understand it — Huawei technology in telecom's infrastructure, why was that so important as you discussed this with foreign officials? How do you make the case to them that they should, you know, perhaps pay a bit more for Ericsson or Nokia technology given those risks?
Telecommunications networks are so complex. There's millions and millions of lines of code, and there's legitimate reasons why the company providing the telecom equipment would maintain remote access to fix a problem, for example, or to help a system recover if it's down. So as such, it is nearly impossible to secure a Huawei telecommunication system in a country that's of interest to China. And the point we would make was, you know, as you know, the UK, for example, tried to pilot efforts where Huawei would deliver its code and GCHQ, the NSA equivalent in the UK, would assess its code. First, they found that there were so many vulnerabilities in the Huawei code at the time, it was hard to determine what was intentional, what was just bad programming. But bottom line, they learned from that that the model couldn't work. It was very, very difficult, if not impossible actually, to secure Huawei telecommunication systems because of the legitimate rights that they would have for remote access.
So that was the first part of our message. The second, particularly with our European allies in the European Union, was a call for partnership to say that we're going all in to ensure Western telecom equipment companies survive, and we're going all in to ensure China can't use standards bodies to maintain its predominance. We need your partnership. We can do this together.
But you say pretty clearly in the piece you wrote last spring for Foreign Affairs that despite all this effort — and I'm quoting you here — "we have not resolved the core issue: the absence of alternative technologies that can compete with China's on price." That has not changed, I imagine.
That hasn't changed. Companies' willingness to really go all in to compete with Huawei, and frankly, governments' willingness to ensure that those companies can compete, has increased. But we need to scale that. We have the tools that we need to help finance and compete with Chinese subsidies, whether that's the Export-Import Bank, whether that's the Development Finance Corporation. In fact, across Europe, those same tools exist. When President Biden visited Finland, for example, we signed an agreement between the US and Finnish financing agencies to partner together on deals. And I think, if I recall correctly, actually financed a major deal of Nokia's deployment in India together.
So the bottom line is to say that what we need to connect are our strategic goals — compete with China in the most important technological areas — with the tools we have: financing, alliances, intelligence sharing to highlight where China uses Chinese companies to conduct its cyber warfare and espionage campaigns. We've made a lot of progress, and I think there's an opportunity around the discussions now of deepening economic ties to go further to ensure that we can compete effectively in 6G.
A couple elements of past efforts that you're fairly dismissive of in the piece that are worth talking about. I mean, the first is diplomacy. You note that both President Obama and President Biden made cyber issues pretty central to US-China bilateral diplomacy. I think in an early Obama-Xi Jinping meeting, there was a kind of headline agreement on cyber and restraining cyber operations. What failed there? I mean, is there any role for diplomacy and potential value to diplomatic commitments in allaying some of these risks and addressing some of this competition?
So, first, at the time that Obama engaged China, China's campaign, we believed still at the time, was largely focused on espionage. In fact, it was focused on espionage, stealing corporate trade secrets, American corporate trade secrets, to benefit Chinese strategic industries. So the purpose of Obama's engagement with Xi was to put in place constraints and controls on that, and indeed they reached agreement to do so. China soon broke that agreement, and indeed over the ensuing years we also saw China's program expand from espionage, as I noted, to creating disruptive capabilities and positioning themselves in parts of critical infrastructure where there was limited intelligence value, like a water system.
One question: what intelligence value does China seek with a presence on a water system? Which led us, combined with the evolution of Chinese doctrine, to understand that it was indeed prepositioning more for disruption than for espionage.
And as you were watching this over your time both at the White House and then previously at the NSA, what were the kinds of options that we had for addressing it as we thought about the response? What was the development of our own thinking about either defense or offense when it came to our own cyber operations?
So our first focus was on intelligence sharing, improving the way the US government, the intelligence community, shared information with the companies, largely critical infrastructure owners and operators who were affected. And indeed, you know, the US intelligence community made significant progress in ensuring that when we had insights, we shared those with affected companies, and also bringing together sectors to ensure that companies collaborated with each other. And as a result, over the last number of years, you've seen an increase in intelligence, really unclassified products coming out of the US and coming out of the US and its allies, pointing to China's actions and outlining the specific cybersecurity steps that the US government and its peers and allies recommended.
However, it wasn't until the last administration that the US government took a second step, which was to say, "We're not just recommending companies take these steps. We're requiring them to do so." Because while some companies did indeed follow recommendations and put in place better cybersecurity, some did not. And as a result, in the last administration, the White House used emergency authorities to put in place requirements that water systems, pipelines, airports actually put in place basic cybersecurity steps.
So that was one part of cybersecurity. The gap between China's system monitoring networks directly to be positioned to block attacks and the US remained. The United States also started building out its offensive cyber capabilities and considering how it could use offensive cyber in a crisis or conflict as well. The link between defense and offense: the fact that the US, relatively more vulnerable in cyberspace, could hesitate to use offensive cyber capabilities because of the potential that an adversary's response could disable significant parts of critical infrastructure, was a hard part of policy and doctrine that we grappled with across multiple administrations, Republican and Democrat.
