Last month, US and Chinese governments agreed to a "digital truce", where neither country would knowingly support cyberattacks against each other to steal commercial secrets. While the agreement is solid overall, it does have a number of caveats, including the lack of protection where government secrets are concerned.
Nonetheless, based on the findings of security research firm CrowdStrike, it seems like this agreement could be considered pointless. Since the agreement took place, CrowdStrike monitored seven different instances where Chinese-based hackers tried to penetrate U.S. businesses. Five of these were technology companies, while the other two were pharmaceuticals.
The important thing in these attacks is that these were not just regular hackers; CrowdStrike has found enough evidence to believe that they are directly affiliated with the Chinese government. Most of this was surmised based on the servers used, as well as the software.
CrowdStrike believes that the sole purpose of these attacks was to steal intellectual property, which directly goes against the agreement made a mere four weeks ago. “The fact that there is some time delay between agreement and execution is not entirely unexpected,” wrote CrowdStrike’s Dmitri Aplerovitch. “But, we need to know the parameters for success, and whether the parties to the agreement discussed a timeframe for implementation or, instead, expected it to be immediate.”
So far, the U.S. government has made no comment on CrowdStrike's findings. Ultimately, China could deny any knowledge of these attacks, since the agreement largely covers knowingly supporting such attacks.
It's still much too early to draw hard conclusions, but if China is found to be in breach of this agreement, it shouldn't take long to hear about it.