China Breaks Up School for Hackers

(Feb. 9) -- Ever since Chinese hackers' apparently concerted attack on Google and 34 other U.S. companies was made public last month, American politicians and business leaders have been calling on the People's Republic to crack down on cybercrime. So when Chinese authorities announced on Monday that the headquarters of Black Hawk Safety Net -- a hacker-training Web site -- had been raided and its owners arrested, it seemed as though China was finally heeding Western demands.

Black Hawk Safety Net -- which operated through the now-closed Web site 3800ccior.com -- appeared to be a major threat. Over the past five years, it has taught more than 12,000 paying subscribers and 120,000 free users how to carry out cyber-attacks, and provided them with the so-called "trojan" software needed to secretly seize control of computers. Local media reported that the site's proprietors had earned more than $1 million from Black Hawk since 2005.

However, many U.S. security experts have dismissed Monday's announcement as little more than propaganda. That's because Black Hawk's three owners were captured in the central province of Hubei in December and January, while their offices were stormed in November. Commentators say the Chinese government is only now publicizing the arrests to dampen the international criticism that followed the Google debacle.

"It seems aimed at bolstering the Foreign Ministry's claim that China is getting tough on hackers," James Mulvenon, director of the Washington-based Center for Intelligence Research and Analysis at Defense Group, told the Los Angeles Times. "This is meant for an international audience, not for domestic criminal prosecution."

Indeed, it's business as usual for most Chinese cybercriminals. The servers that were used during the attack on Google are still up and running, and their operators haven't been arrested -- possibly, some experts say, because their attack was approved by the state.

"[The government's] crackdown on this apparent hacker group needs to be placed in a broader context," Ronald J. Deibert, a cybersecurity expert at the Munk Center for International Studies at the University of Toronto, told The New York Times. "I would characterize it as window dressing."

The Black Hawk announcement is part of a wider publicity battle that Beijing is waging around issues of Web freedom and security. Just a week after the Google attack was made public, China's No. 1 search engine, Baidu.com, filed a lawsuit in New York against domain name registrar Register.com for allegedly allowing a hack that disabled and defaced its site. Then, late last month, the state-run media tore into U.S. Secretary of State Hillary Clinton for suggesting that China investigate the Google strike, accusing the U.S. of hypocritically backing cyber-assaults on Chinese firms and government offices.

Indeed, a high-ranking Chinese official claimed today that far from being the planet's main cybercrime perpetrator, China is actually the biggest victim. "China is the country worst hit by worldwide hackers," Peng Bo, deputy chief of the Internet Affairs Bureau, told state news agency Xinhua. "There are tens of thousands of computers in China hijacked by people outside the country."

China's National Computer Network Emergency Response Coordination Center has calculated that hackers caused losses of $1.11 billion in the country last year. But Daniel Slain, chairman of Congress' U.S.-China Economic and Security Review Commission, estimates that American businesses lose intellectual property worth hundreds of billions of dollars to Chinese hackers each year.

It may well be that the Black Hawk founders' biggest mistake was targeting their cybercrime toward computers at home rather than abroad. According to The Times in London, the site first came to the attention of authorities in October 2007, when a virus shut down the Internet connection of an entire district of Macheng city in central China. Police eventually discovered the attackers were members of Black Hawk and arrested the site's founders under legislation introduced last year, which outlaws the distribution of Web attack programs.