Defense Department Report Highlights Cyber Threat from China

China’s cyber capabilities pose a greater threat to U.S. interests than ever before, according to a new Pentagon report on Chinese military power. Worse, according to the report, the Chinese Communist Party (CCP) has already demonstrated a willingness to use its capabilities to project power. When you combine the capability to do damage and the will to do damage – you’ve got a real threat on your hands. On the cyber front, China has both.

Specifically, this report warns that in addition to its growing nuclear and conventional kinetic military capabilities, the CCP poses an increasingly sophisticated, persistent four-legged cyber threat to the United States and its key allies and partners – specifically, Taiwan. China’s aggressive pursuit of cyber capabilities is driven by the CCP leadership’s determination to level the playing field with the United States.

So, what are the four legs of the Chinese cyber threat?

First, the report underscores China’s intention to “create disruptive and destructive effects” by targeting U.S. critical infrastructure. China has the capacity to launch cyberattacks capable of causing “localized, temporary disruptions” in U.S. critical infrastructure sectors such as energy, defense, and telecommunications, the report warns, echoing earlier assessments from the intelligence community. The report takes this one step further, warning that China believes cyberattacks are even “more effective against militarily superior adversaries.” These calculated attacks on military mobility and economic productivity aim to deter U.S. action or defeat U.S. responses in Taiwan.

Second, Chinese cyberattacks extend beyond critical infrastructure networks. The report also warns that China is using cyber means to “exfiltrate sensitive information” to gain “economic and military advantage.” China steals intellectual property and sensitive information from “academic, economic, military, and political targets,” enabling the CCP to “build an operational picture of U.S. defense networks, military disposition, logistics, and related military capabilities.”

Third, the report notes that China “could conduct a range of cyberspace, blockade, and kinetic campaigns” as a tool to coerce Taiwan. Failing that, the CCP might “escalate cyberspace, space, or nuclear activities” to bring a rapid end to a China-Taiwan conflict on its own terms. In this context, China is likely to conduct cyberattacks on Taiwan’s military command and control systems to undermine Taiwan’s ability to defend itself.

Fourth, the report also draws attention to China’s cognitive domain operations, which combine “psychological warfare with cyber operations to shape adversary behavior and decision making.” China is actively targeting the American public, the report warns, to “influence public opinion and promote [China’s] interests.” By altering public sentiments, China seeks to craft a “favorable international environment that is conducive to [China’s] rise and rejuvenation.”

The report paints a grim picture of China’s aggressive military technology innovation and its negative impacts on the U.S. and its allies and partners. To counter these cyber threats, the United States must adopt and implement a comprehensive response.

Conducting an accurate risk assessment of U.S. critical infrastructure is the first step to protecting the infrastructure that supports military mobility and economic productivity. The risk assessment should include incident response and readiness for potential disruptions from Chinese cyberattacks. Moreover, the U.S. must improve its cyber and information resilience, maintaining the ability to detect and track adversaries, share information, and mobilize and sustain personnel. This would include improving efforts to collaborate with private sector partners and seamlessly share relevant threat information and known threat signatures prior to a contingency or conflict with China.

Strengthening data security across government networks and various institutions targeted by China is also crucial to protecting against Chinese intellectual property theft. Safeguarding proprietary military technologies requires robust counterintelligence efforts, coupled with the identification and sanctioning of Chinese companies that practice or directly benefit from these illicit activities. This effort must run parallel to ongoing initiatives to encourage venture capitalists to focus their emerging technology investment on companies in the United States and reliable allies and partners.

In addition to strengthening its own security, the United States must help the primary regional target of Chinese cyberattacks – Taiwan. Cyber capacity building for Taiwan would enhance its military readiness and resilience in a crisis. It is critical for the United States to maintain and strengthen its alliances and partnerships in the Indo-Pacific region through information sharing and providing resources to help fend off China’s cyber threats. By doing so, the United States can reaffirm its commitment to a regional partner while simultaneously enhancing Taiwan’s overall cyber readiness against Chinese cyber threats, thereby helping deter any potential attack.

Lastly, the United States should ensure the timely implementation of the national cybersecurity strategy’s elements that directly counter China’s influence operations campaigns. This involves raising public awareness of Chinese disinformation campaigns and actively engaging with like-minded allies and partners to collectively challenge China’s influence operations. These engagements could present opportunities for increased investments to improve technologies that detect and mitigate disinformation, as well as establish regulatory frameworks to increase transparency on social media and information sharing platforms.

The Pentagon’s latest report underscores the pressing need to protect America’s technological edge, economic prosperity, and national security from Chinese cyberattacks. The message that Washington sends back to China should be clear: the United States is committed to safeguarding its cyberspace and digital assets, as well as those of allies and partners – especially Taiwan’s.

Rear Adm. (Ret.) Mark Montgomery is a senior director at the Center on Cyber and Technology Innovation (CCTI) at the Foundation for Defense of Democracies. He directs CSC 2.0, which works to implement the recommendations of the Cyberspace Solarium Commission, where he previously served as executive director. Follow him on X @MarkCMontgomery. Jiwon Ma is a program analyst at CCTI, where she contributes to the CSC 2.0 project. Follow her on X @jiwonma_92.