PLA_NW_OPS

8/7/2019 PLA_NW_OPS

1/34

253

CHAPTER 8

PLA COMPUTER NETWORK OPERATIONS:SCENARIOS, DOCTRINE, ORGANIZATIONS,

AND CAPABILITY

James Mulvenon

INTRODUCTION

Theorists in the Chinese military have long beenat the forefront of doctrinal thinking about cyberconict, arguing that computer network attack offersBeijing some important asymmetric advantagesagainst adversaries with superior technology. Yetthe actual manifestations of this theorizing have beenheretofore restricted to interesting but relatively minor

hacking by Chinese patriotic hacker groups duringcrises or the alleged, large-scale cyber espionageagainst unclassied Department of Defense (DoD)computer systems. The well-publicized cyber attacksagainst Estonia in April 2007 and Georgia in July 2008,however, raise the specter of the use of cyberspacefor state-level conict, particularly as globalizationraises the stakes by compelling greater electronicdependencies and interdependencies. This chapterexamines computer network operations (CNO) asa tool of Chinese state power, outlining the possiblescenarios, doctrinal concepts, organizations, andcapabilities being developed by the Peoples LiberationArmy (PLA). Specically, the chapter explores the useof computer network exploit and computer network

attack as missions designed to coerce Taiwan towardreunication on Chinas terms, while deterring ordisrupting U.S. military intervention on Taiwans

8/7/2019 PLA_NW_OPS

2/34

254

behalf. In terms of assumptions, therefore, this chapterbegins from the premise that we live in the A quadrant

of Dr. Andrew Scobells matrix (Chapter 2), sincecyber operations often simmer beneath the surface of across-strait conict that can neither be fully resolved orpermitted to break out into all-out war between China,Taiwan, and the United States.

Denitional Issues.

The Chinese military did not invent the termcomputer network operations but instead borrowedit from its U.S. counterparts, much as they have donewith previous related concepts. Indeed, if one tracksChinese military terminology over time, it is possibleto discern a short lag between the adoption of newcyber concepts in the United States and their eventual

adoption in China. This process was aided by the factthat some of the most important rst generation PLAcyber theorists, like Wang Baocun, were experts onthe American military and not doctrinal thinkers bytrade. Thus, one can see the PLA making the sameprogression from the term information warfare (IW)[] in early writings, moving to informationoperations [], and then to more specicconcepts like network warfare []. As thelimited Western literature on the subject shows,the content of these concepts evolved from simpledescription of foreign ideas in the information warfareliterature to increasingly sophisticated adaptions andmodications of the concepts of information operationsand computer network operations to the PLAs specic

strategic goals, technology levels, doctrinal landscapeand even the tortured syntax of Marxist-Leninist-MaoZedong thought, the strategic wisdom of the Chinese

8/7/2019 PLA_NW_OPS

3/34

255

ancients, and dialectical materialism.1 For example,the common use of the term countermeasures [

] in core PLA Information Operations (IO)terms like electronic countermeasures [],communications countermeasures [], andnetwork countermeasures [], is embeddedwith Beijings self-perception of itself as the aggrievedparty forced to counterattack against hegemonisticforces, even though the text of the concepts containsclear references to preemptive rst strikes to gainadvantage. For the purposes of this chapter, however,we adopt the clearer PLA denition of computernetwork warfare:

The general term for all sorts of information offenseand defense actions in which computers and computernetworks are the main targets, in which advancedinformation technology is a basic means, and which take

place throughout the space occupied by networks. Thecore of computer network warfare is to disrupt the layersin which information is processed, with the objective ofseizing and maintaining control of the network space.

CYBER: AN EMERGING TOOL OF CHINESE

STATE POWER

As demonstrated by the hacker wars thatfollowed former Taiwan President Lee Teng-huisannouncement of special state-to-state relations, theU.S. bombing of the Chinese Embassy in Yugoslavia in1999, and the EP-3 crisis in 2001, cyber attacks againstforeign countries by so-called Chinese patriotichacker groups have become a permanent feature of

Chinese foreign and security policy crises since themid- to late-1990s. Patriotic hacking has arguablybeen a mixed blessing for China. On the one hand, the

8/7/2019 PLA_NW_OPS

4/34

256

emergence of this trend presents the Peoples Republicof China (PRC) military and political leadership with

serious command and control problems. Specically,uncontrolled hacking by irregulars against the UnitedStates and Taiwan could potentially undermine a PRCpolitical-military coercive diplomacy strategy vis--visTaiwan and the United States during a crisis. Unliketraditional military instruments such as missiles,many of the levers of computer network operationsby unofcial means are beyond the control of theChinese government. This could negate the intendedimpact of strategic pausing and other political signalsduring a crisis. Yet at the same time patriotic hackingoffers several new opportunities for the PRC. First,it increases plausible deniability for ofcial Chinesecomputer network attack and exploit activities. Second,it has the potential to create a large, if unsophisticated

set of operators who could engage in disruptionactivities against U.S. and Taiwan networks.

Yet the overall strategic impact of these patriotichacker wars has been relatively minor, more correctlydescribed as a nuisance than a threat to other nation-states. More recent phenomena in this arena, such asthe Russia-Estonia clash in 2007, the Russia-Georgiacrisis in 2008, and especially the widespread allegationsof Chinese cyber espionage against the DoD, however,have raised the stakes for cyber conict as a legitimatetool of state power, portending future and perhapsmore damaging uses of the technologies and methods.The crossing of this threshold has been largelyfacilitated by the increasingly networked nature of theglobal system, permitting nation states to threaten each

others national power through cyberspace. While theBeijing authorities continue to petulantly insist thatChina would never engage in cyber conict, asserting

8/7/2019 PLA_NW_OPS

5/34

257

that the idea is totally groundless and a reection ofCold War mentality,2 recent events strongly suggest

that both Beijing and Moscow see cyber conict as alegitimate, if plausibly deniable, form of 21st centurystatecraft.

THE PLA AND COMPUTER NETWORK

OPERATIONS

In order to explore the full range of the PLAsinterest in computer network operations, this section isdivided into four broad areas: CNO-related doctrinalconcepts, scenarios, organizations, and capabilities.

PLA Doctrinal Framework for InformationOperations and Computer Network Operations.

While no ofcial doctrine has been identied,Chinese military strategists describe IO and CNOas useful supplements to conventional warghtingcapability, and powerful asymmetric options forovercoming the superior with the inferior. Accordingto one PRC author, Computer network attack is one ofthe most effective means for a weak military to ght astrong one.3 Yet another important theme in Chinesewritings on CNO is the use of computer networkattack as the spearpoint of deterrence. Emphasizingthe potential role of computer network attack (CNA)in this type of signaling, a PRC strategist writes thatWe must send a message to the enemy throughcomputer network attack, forcing the enemy to giveup without ghting.4 Computer network attack is

particularly attractive to the PLA, since it has a longerrange than their conventional power projection assets.This allows the PLA to reach out and touch the

8/7/2019 PLA_NW_OPS

6/34

258

United States, even in the continental United States.Thanks to computers, one strategist writes, long-

distance surveillance and accurate, powerful, and long-distance attacks are now available to our military.5Yet computer network attack is also believed to enjoya high degree of plausible deniability, rendering ita possible tool of strategic denial and deception. Asone source notes, An information war is inexpensive,as the enemy country can receive a paralyzing blowthrough the Internet, and the party on the receivingend will not be able to tell whether it is a childs prankor an attack from an enemy.6

It is important to note that Chinese CNA doctrinefocuses on disruption and paralysis, not destruction.Philosophically and historically, the evolving doctrinedraws inspiration from Mao Zedongs theory ofprotracted war, in which he argued that We must as

far as possible seal up the enemies eyes and ears, andmake them become blind and deaf, and we must asfar as possible confuse the minds of their commandersand turn them into madmen, using this to achieve ourown victory.7 In the modem age, one authoritativesource states: Computer warfare targets computersthe core of weapons systems and command, control,communications, computers and intelligence (C4I)systemsin order to paralyze the enemy.8 The goalof this paralyzing attack is to inict a mortal blow[zhiming daji], though this does not necessarily refer todefeat. Instead, Chinese analysts often speak of usingthese attacks to deter the enemy, or to raise the costs ofconict to an unacceptable level. Specically, computernetwork attacks on nonmilitary targets are designed

to . . . shake war resoluteness, destroy war potentialand win the upper hand in war, thus underminingthe political will of the population for participation inmilitary conict.9

8/7/2019 PLA_NW_OPS

7/34

259

At an operational level, the emerging Chinese CNOstrategy has ve key features. First, Chinese authors

emphasize defense as the top priority, and chastiseAmerican theorists for their fetish of the offensive. Ininterviews, analysts assert their belief that the UnitedStates is already carrying out extensive computernetwork exploitation (CNE) activities against Chineseservers. As a result, computer network defense (CND)must be the highest priority in peacetime, and onlyafter that problem is solved can they consider tacticalcounteroffensives. Second, CNA is viewed as anunconventional warfare weapon to be used in theopening phase of the conict, not a battleeld forcemultiplier that can be employed during every phaseof the war. PLA analysts believe that a bolt from theblue at the beginning is necessary, because the enemymay simply unplug the network, denying them access

to the target set, or patch the relevant vulnerabilities,thus obviating all prior intelligence preparation of thebattleeld. Third, CNA is seen as a tool to permit Chinato ght and win an information campaign, precludingthe need for conventional military action. Fourth,Chinas enemies, in particular the United States, are seenas information dependent, while China is not. Thislatter point is an interesting misperception, given thatthe current Chinese C4I modernization is paradoxicallymaking them more vulnerable to U.S. counter-C4Imethods. Perhaps most signicant, computer networkattack is characterized as a preemption weapon to beused under the rubric of the rising Chinese strategyof xianfa zhiren [], or gaining mastery beforethe enemy has struck. Preemption is a core concept

of emerging Chinese military doctrine. One authorrecommends that an effective strategy by whichthe weaker party can overcome its more powerful

8/7/2019 PLA_NW_OPS

8/34

260

enemy is to take advantage of serious gaps in thedeployment of forces by the enemy with a high-tech

edge by launching a preemptive strike during theearly phase of the war or in the preparations leadingto the offensive.10 Conrming earlier analysis ofChinese views of U.S. operational vulnerabilities in thedeployment phase, the reason for striking is that theenemy is most vulnerable during the early phase ofthe war.11 In terms of specic targets, the author assertsthat we should zero in on the hubs and other cruciallinks in the system that moves enemy troops as wellas the war-making machine, such as harbors, airports,means of transportation, battleeld installations,and the communications, command and control andinformation systems.12 If these targets are not attackedor the attack fails, the high-tech equipped enemy willamass troops and deploy hardware swiftly to the war

zone, where it will carry out large-scale air strikes inan attempt to weaken . . . Chinas combat capability.13More recent and authoritative sources expand onthis view. In order to control information power,one source states, there must also be preemption . .. information offensives mainly rely on distant battleand stealth in order to be effective, and are best used asa surprise. . . . Therefore, it is clear that whoever strikesrst has the advantage.14 The best defense is offense,according to the authors of Information Operations: Wemust launch preemptive attacks to disrupt and destroyenemy computer systems.15

Integrated Network Electronic Warfare (INEW).The dominant doctrinal concept encompassing PLAinformation operations, including computer network

operations, is Integrated Network Electronic Warfare [], or INEW. As Dai Qingmin explains in hisseminal article, INEW is the organic combination of

8/7/2019 PLA_NW_OPS

9/34

261

electronic warfare and computer network warfare.16The synthesis of these two realms in Chinese thinking

was all the more revolutionary, given long-standingtension among U.S. information warfare expertsdivided between the electronic warfare (EW) school,which argued that computer network attack fell withinthe broad denition of the electromagnetic spectrum,and the new CNO school, which insisted that computernetwork attack was a fundamentally different dynamicthan traditional EW missions like jamming. Rather thansee them as competing, Dai and the INEW advocatesargue that combining them is the essence of integratedcombat operations against enemy informationsystems with the goal of seizing battleeldinformation superiority.17 Specically, INEW utilizesboth EW and CNO to weaken and disrupt the entireprocess by which battleeld information systems

acquire, foreword, process, and use information.Integrated network-electronic warfare uses electronicwarfare to disrupt the opponents acquisition andforwarding of information. It uses computer networkwarfare to disrupt the opponents processing and useof information.18

The resulting doctrinal concept serves as informa-tion operations theory with Chinese characteristics,playing an important guiding role in the constructionof our Armys information operations forces and inghting and winning future high-tech local wars.19 Inparticular, INEW provides the doctrinal underpinningfor the integration of computer network attack, oftentreated as an isolated covert action in other militaries,into larger PLA campaigns.

8/7/2019 PLA_NW_OPS

10/34

262

The Key CNO Scenarios.

The Legacy CNO Scenario: Taiwan. It is importantto contextualize the PLAs interest in computer networkoperations within Beijings larger perceived strategicenvironment. In the minds of the Chinese leadership,the available evidence suggests that the most importantpolitical-military challenge, and the most likelyashpoint for Sino-U.S. conict is Taiwan. In seekingto reunify the island with the mainland, however, it isimportant to note that the PRC has a political strategywith a military component, not a military strategy witha political component. The PRC would prefer to winwithout ghting, since Beijings worst case outcomeis a failed operation that would result in de factoindependence for Taiwan. Also, the leadership realizesthat attacking Taiwan with kinetic weapons will result

in signicant international opprobrium and make thenative population ungovernable.

Should the situation deteriorate into direct militaryconict, the PLA since 1992 has been hard at workbolstering the hedging options of the leadership,developing advanced campaign doctrines, testing theconcepts in increasingly complex training and exercises,and integrating new indigenous and imported weaponssystems. At the strategic level, the writings of Chinesemilitary authors suggest that there are two maincenters of gravity in a Taiwan scenario, both of whichcan be attacked with computer network operations inconcert with other kinetic and nonkinetic capabilities.The rst of these is the will of the Taiwanese people,which they hope to undermine through exercises,

cyber attacks against critical infrastructure, missileattacks, special operations forces (SOF) operations, andother operations that have a psychological operations

8/7/2019 PLA_NW_OPS

11/34

263

(psyops) focus. Based on its own analysis from the1995-96 exercises, as well as public opinion polling

in Taiwan, China appears to have concluded that theTaiwanese people do not have the stomach for conictand will therefore sue for peace after suffering only asmall amount of pain. The second center of gravity isthe will and capability of the United States to intervenedecisively in a cross-strait conict. In a strategic sense,China has traditionally believed that its intercontinentalballistic missile (ICBM) inventory, which is capable ofstriking the continental United States (CONUS), willserve as a deterrent to U.S. intervention or at least abrake on escalation. Closer to Taiwan, the PLA hasbeen engaged in an active program of equipmentmodernization, purchasing niche anti-access, area-denial capabilities such as long-range cruise missilesand submarines to shape the operational calculus of

the American carrier battle group commander onstation. At the same time, a key lesson learned fromanalyzing U.S. military operations since OperationDESERT STORM was the vulnerability of the logisticsand deployment system to cyber attack.

Center of Gravity Number One: The Will of thePeople on Taiwan. Chinese strategies to manipulatethe national psychology of the populace and leadershipon Taiwan involve the full spectrum of informationoperations, including psyops, special operations,computer network operations, and intelligenceoperations. To this end, Beijing can employ all of thesocial, economic, political, and military tools of Chinesenational power, as well as enlist the assistance of privatesector players and sympathetic co-conspirators on

Taiwan. The goal of these efforts is to shake the widelyperceived psychological fragility of the populace,causing the government to prematurely capitulate to

8/7/2019 PLA_NW_OPS

12/34

264

political negotiations with the mainland. In a sense,China seeks to use the immaturity of Taiwanese

democracy against itself. Analysis of both Beijingsstrategies in this arena as well as Taipeis ability toresist such methods conrms Taiwans high levelvulnerability to Chinese soft coercion, and raises majorquestions about the islands viability in the openingphase of a PRC coercion campaign, their credibility asa source of intelligence information on the mainlandand a keeper of U.S. secrets, and their expected abilityto interoperate successfully with U.S. forces in a crisis.

Taiwans vulnerabilities in the critical infrastructureprotection arena can be divided into two categories:informational and physical. On the information side,Taiwan is a highly information-dependent society with arelatively low level of information or computer security.Signicant disruptions in information systems could

have major negative effects on the island, particularlyin the economic and nancial realms, and increase fearand panic among the population. Past Chinese usesof regional media to send psyops messages have alsoenjoyed success in affecting popular morale and publicopinion. For example, an Internet rumor in 1999 that aChinese Su-27 had shot down a Taiwan aircraft causedthe Taipei stock market to drop more than 2 percent inless than 4 hours.

On the physical side of the equation, Taiwanscurrent capability and readiness level is much lowerthan one might expect for a state under such a directlevel of threat, especially when compared with othernational security states like Israel or South Korea.Critical infrastructure protection has been a low priority

for the government, and Taiwan is acutely vulnerableto Spetsnaz-like or fth column operations, aidedsignicantly by ethnic and linguistic homogeneity and

8/7/2019 PLA_NW_OPS

13/34

265

signicant cross-border ows, which facilitate entryand access to potential targets. In terms of civilian

infrastructure, Taiwans telecommunications, electricpower, and transportation infrastructure are all highlysusceptible to sabotage. These weaknesses have beenindirectly exposed by periodic natural disasters, suchas the September 1999 earthquake and the September2001 typhoon, when the communications infrastructureeffectively collapsed. Taiwans ports, including Suao, Jeelung, and Gaoxiong (the third highest volumecontainer port in the world), are attractive targets.Port charts and ship movements are available on theInternet, and Gaoxiong in particular has two narrowmouths that could easily be blocked with scuttledvessels. Taiwans highways are a vulnerable bottleneck,particularly given the large number of undefendedmountain tunnels and bridges that could be destroyed

by SOF units. Finally, the power grid is known to befragile, marked by numerous single-point failurenodes, and no cross-hatching of subgrids to formredundancy. The loss of a single tower in the centralmountainous region, thanks to a landslide, knockedout 90 percent of the grid a couple of years ago, anddelays in construction of a fourth nuclear plant haveconstrained capacity.

SOFs and fth column are also a major threat fordisruption of military command and control anddecapitation of the national command authority, aswell as providing reconnaissance for initial missile andair strikes and battle damage assessments (BDA) forfollow-on strikes. Entry into the country for SOF is nota substantial obstacle, thanks to ethnic and linguistic

homogeneity and the dramatic increases in cross-strait people ows. Between 1988 and October 2002,for example, more than 828,000 mainlanders visited

8/7/2019 PLA_NW_OPS

14/34

266

the island. Moreover, these special forces could alsofacilitate control of key civilian and military airelds

and ports that could be used as points of entry forinvading forces. The lack of operational security atkey facilities is particularly inexplicable and appalling.Visits to national political and military commandcenters reveal them to be relatively unguarded, withpoor information security practices, including the useof personal cell phones in supposedly secure areas.The Presidential Palace in downtown Taipei, home tothe President and his key staff, has no fenceline and nosecurity checkpoints. Building information, includingthe location of the Presidents ofce, is openlyavailable on the Internet. Given the poor performanceof President Chens personal security detail during the2004 assassination attempt on his life, the possibility ofelimination of the top leadership through direct action

cannot be discounted.Finally, there is substantial open source evidence

to suggest that China is winning the intelligence waracross the strait, raising serious doubts about the purityof Taiwanese intelligence proffered to the UnitedStates, the safety of advanced military technologiestransferred to the island, and the ability of ofcialTaiwan interlocutors to safeguard shared U.S. secretsabout intelligence collection or joint warplanning. Inthe last 5 years, a steady series of leaked stories haveappeared in the Taiwan and other regional media,describing either the rounding up of Taiwanese agentnetworks on the mainland or the unmasking of high-ranking Taiwanese agents in the military, with similarsuccesses a rarity on the Taiwan side, despite signicant

political incentive to publicize such discoveries.21Reported examples since early 2003 include the arrestof the president of the PLA Air Force Command Acad-

8/7/2019 PLA_NW_OPS

15/34

267

emy, Major-General Liu Guangzhi; his former deputy,Major-General Li Suolin, and 10 of their subordinates;22

the arrest of 24 Taiwanese and 19 mainlanders in late2003;23 the arrest of Chang Hsu-min, age 27, and his24-year-old girlfriend Yu Shi-ping;24 the arrest of XuJianchi;25 the arrest of Ma Peiming in February 2003;26and the arrest and conviction to life imprisonment ofPetty Ofcer First Class Liu Yueh-lung for passingnaval communications codes to the PRC.27 Farther back,high-prole intelligence losses include the discovery,arrest, and execution of General Logistics DepartmentLieutenant-General Liu Liankun and Senior ColonelShao Zhengzhong as a result of Taiwanese governmentintelligence disclosures about the fact that warheadson Chinese missiles red near the island in 1996were unarmed,28 the arrest and sentencing of HainanProvince deputy head Lin Kecheng and nine others in

1999 for providing economic, political, and other kindsof intelligence to the Taiwan Military IntelligenceBureau (MIB),29 and the arrest and imprisonment of alocal ofcial named Wang Ping in Nanchong, Sichuan,for allegedly also working for the MIB.30 In addition,retired senior Taiwan intelligence ofcials, includingNational Security Bureau personnel chief Pan Hsi-hsien and at least one former J-2, continue to travel toand often reside in China despite Taiwan regulationsbarring such movement for 3 years after retirement.31At the same time, Taiwan and international media areregularly lled with leaks about sensitive U.S.-Taiwanmilitary interactions or weapons transfers, sourcedto either legislators or standing Taiwan governmentofcials. Examples include disclosures about possible

deployment of an Integrated Underwater SurveillanceSystem (IUSS) north and south of the island to detectChinese submarines,32 the provision of early warning

8/7/2019 PLA_NW_OPS

16/34

268

data on Chinese missile attack from the DefenseSupport Program (DSP) satellite constellation,33 and

the alleged signals intelligence (SIGINT) cooperationbetween the National Security Agency and Taiwanon Yangming Mountain.34 All of these possiblecompromises raise serious concerns about futuretechnology or information sharing with Taiwan.

Center of Gravity Number Two: U.S. MilitaryIntervention. When Chinese strategists contemplatehow to affect U.S. deployments, they confront thelimitations of their current conventional force, whichdoes not have range sufcient to interdict U.S. facilitiesor assets beyond the Japanese home islands. Nuclearoptions, while theoretically available, are nonethelessfar too escalatory to be used so early in the conict.Theater missile systems, which are possibly moving toa mixture of conventional and nuclear warheads, could

be used against Japan or Guam, but uncertainties aboutthe nature of a given warhead would likely generateresponses similar to the nuclear scenario.

According to the predictable cadre of truebelievers, both of the centers of gravity identiedabove can be attacked using computer networkoperations. In the rst case, the Chinese IO communitybelieves that CNO will play a useful psychologicalrole in undermining the will of the Taiwanese peopleby attacking infrastructure and economic vitality. Inthe second case, the Chinese IO community envisionscomputer network attacks effectively deterring ordelaying U.S. intervention and causing pain sufcientto compel Taipei to capitulate before the United Statesarrives. The remainder of this section outlines how

these IO theorists propose operationalizing such astrategy.

8/7/2019 PLA_NW_OPS

17/34

269

Specic Targeting Analysis of Network AttacksAgainst Logistics.

There are two macro-level targets for Chinesecomputer network operations: military networkinformation and military information stored onnetworks. Computer network attack seeks to use theformer to degrade the latter. Like U.S. doctrine, ChineseCNA targeting therefore focuses specically on enemycommand and control (C2) centers, especially enemyinformation systems. Of these information systems,PLA writings and interviews suggest that logisticscomputer systems are a top military target. Accordingto one PLA source, we must zero in on the . . . cruciallinks in the system that move enemy troops . . . suchas information systems.35 Another source writes, wemust attack system information accuracy, timeliness

of information, and reliability of information.36

Inaddition to logistics computer systems, another keymilitary target for Chinese CNA is military reliance oncivilian communications systems.

These concepts, combined with the earlier analysisof the PLA view that the main U.S. weakness isthe deployment phase, lead PLA IO theorists toconclude that U.S. dependence on computer systems,particularly logistics systems, is a weak link that couldpotentially be exploited through computer networkattack. Specically, Chinese authors highlight DoDsneed to use the civilian backbone and unclassiedcomputer networks (i.e., NIPRNET) as an AchillesHeel. There is also recognition that operations in thePacic are especially reliant on precisely coordinated

transportation, communications, and logistics networks,given the tyranny of distance in the theater. PLAstrategists believe that a disruptive computer network

8/7/2019 PLA_NW_OPS

18/34

270

attack against these systems or afliated civiliansystems could potentially delay or degrade U.S. force

deployment to the region while allowing the PRC tomaintain a degree of plausible deniability.

The Chinese are right to highlight the NIPRNET asan attractive and accessible target, unlike its classiedcounterparts. It is attractive because it contains andtransmits critical deployment information in the all-important time-phased force deployment list (TPFDL),which is valuable for both intelligence-gathering aboutU.S. military operations but also a lucrative targetfor disruptive attacks. In terms of accessibility, it isrelatively easy to gather data about the NIRPNET fromopen sources, at least before September 11, 2001 (9/11).Moreover, the very nature of the system is the sourceof its vulnerabilities, since it has to be unclassied andconnected to the greater global network, albeit through

protected gateways. To migrate all of the NIPRNETto a secure, air-gapped network would likely tax theresources and bandwidth of DoD military networks.

DoDs classied networks are an attractive but lessaccessible target for the Chinese. On the one hand, thesenetworks would be an intelligence gold mine, and islikely a priority CNE target. On the other, they are lessattractive as a computer network attack target, thanksto the difculty of penetrating their high defenses. Anyoverall Chinese military strategy predicated on a highdegree of success in penetrating these networks duringcrisis or war is a high-risk venture, and increases thechances of failure of the overall effort to an unacceptablelevel. Moreover, internal PRC writings on informationwarfare show no condence in the PRCs ability to

get inside network-centric warfare aboard deployedships or other self-contained operational units.Instead, the literature is focused on preventing the

8/7/2019 PLA_NW_OPS

19/34

271

units from deploying in the rst place, and thereafterbreaking the C4I linkages between the ships and their

headquarters.Chinese CNE or CNA operations against logistics

networks could have a detrimental impact on U.S.logistics support to operations. PRC CNE activitiesdirected against U.S. military logistics networks couldreveal force deployment information, such as thenames of ships deployed, readiness status of variousunits, timing and destination of deployments, andrendezvous schedules. This is especially important forthe Chinese in times of crisis, since the PRC in peacetimeutilizes U.S. military web sites and newspapers as aprincipal source for deployment information. An articlein October 2001 in Peoples Daily, for example, explicitlycited U.S. Navy web sites for information about theorigins, destination, and purpose of two carrier battle

groups exercising in the South China Sea. Since thequantity and quality of deployment information onopen websites has been dramatically reduced after9/11, the intelligence benets (necessity?) of exploitingthe NIPRNET have become even more paramount.37Computer network attack could also delay resupply tothe theater by misdirecting stores, fuel, and munitions,corrupting or deleting inventory les, and therebyhindering mission capability.

The advantages to this strategy are numerous: (1) itis available to the PLA in the near-term; (2) it does notrequire the PLA to be able to attack/invade Taiwanwith air/sea assets; (3) it has a reasonable level ofdeniability, provided that the attack is sophisticatedenough to prevent tracing; (4) it exploits perceived U.S.

casualty aversion, over-attention to force protection,the tyranny of distance in the Pacic, and U.S.dependence on information systems; and (5) it could

8/7/2019 PLA_NW_OPS

20/34

272

achieve the desired operational and psychologicaleffects: deterrence of U.S. response or degrading of

deployments.

PLA CNO Organizations.

The PLAs computer network operations organi-zations can be divided into three broad categories:command organizations, doctrinal and professionalmilitary education institutions, and research anddevelopment organizations. PLA CNO Command Organizations. The General StaffDepartment (GSD) Communications Department versusthe GSD 4th Department (Electronic CountermeasuresDepartment). For years, a debate has raged overwhether the GSD Communications Department or theGSD 4th Department (Electronic Countermeasures

Department) had operational responsibility forcomputer network operations in the PLA, specicallythe CNA mission. While the CommunicationsDepartment clearly has personnel well-versed in thetechnical details of the PLAs communications andcomputer networks, the Electronic CountermeasuresDepartment since its inception has been directlyresponsible for not only traditional EW jamming, butalso electronic offense, or the use of electronic andinformation systems to attack the enemys electronicand information systems. An early, pre-Internetopen source description of these differentiated rolescan be found in the 1997 Guidebook for Staff OfcersProfessional Work in Wartime.38 In 1999, the preface of animportant book by the then-head of the PLA Electronic

Engineering Academy, Dai Qingmin, revealed thatIntroduction to Information Warfare was published bythe PLA Publishing House only after an appraisal by

8/7/2019 PLA_NW_OPS

21/34

273

the GSD Electronic Countermeasures Department.When Dai became head of the 4th Department shortly

thereafter, a series of articles and books were publishedunder his byline on information operations-relatedtopics including Pay Close Attention to AirborneInformation Operations, Introduction to InformationWarfare (2001),39 Information Warfare Review (1999),40On Four Abilities for Informationized Warfare,41Innovating and Developing Views on InformationOperations,42 Information War Concepts,43 and Onthe Development of Army Informationization andInformation Warfare.44 It is also instructive to notethat Dai, after he retired from active duty, assumedthe directorship of the All-PLA InformationizationConsultation Committee, which is in part responsiblefor the development of PLA systems for offensive IOmissions.

Yet the rise of the Internet and the development ofcomputer network operations appeared to raise newquestions about which department would take thelead in this new warfare arena. An important signpostin the PLA debate appeared in the February 2002 issueof China Military Science, in which the heads of theGSD Communications Department (Major GeneralXu Xiaoyan) and GSD 4th Department/ElectronicCountermeasures Department (Major General DaiQingmin) each made their case for operationalcontrol of CNO in a pair of dueling articles.45 DaiQingmins article On Integrating Network Warfareand Electronic Warfare introduced the concept ofINEW (discussed above), and clearly won out overthe concepts in Xus article, A Concept for a Strategy

of Development in which Informationization DrivesMechanization. During his tenure at the GSD/4thDepartment, Dai also edited a more detailed version

8/7/2019 PLA_NW_OPS

22/34

274

of the articles thesis, entitled Introduction to IntegratedNetwork and Electronic Warfare []. Dais

INEW concept continues to be the dominant doctrinalcore for PLA information operations until the presentday, very likely consolidating the leadership positionof the GSD/4th Department on related CNO issues.

GSD Third Department (SIGINT). Given the knownmission prole of the GSD Third Department, it isreasonable to speculate that it may have the lead rolein the defensive/information assurance mission (CND)as well as intelligence preparation of the battleeld(CNE).

Joint Campaign Command HQ and the Warzone.46While the GSD 4th Department is the locus forCNA planning during peacetime, some wartimeresponsibilities fall to the Joint Campaign CommandHQ under the Warzone. Within the Main Command

Post [] of the HQ, various centers direct theIO and CNO-related functions. The most important ofthese is the Information Countermeasures Center []. This unit is composed of relevant servicecommanders and their staff ofcers. It is responsiblefor providing advice on information countermeasureissues, planning and coordinating informationsystems, and guiding and coordinating the informationcountermeasures of every level of the operational group.The center is composed of comprehensive planning,electronic countermeasures [], network warfare[], information system defense, informationsecurity and secrecy, weapons and equipmentsupport, and comprehensive support departments.During wartime, this structure strongly suggests that

personnel from the GSD/Fourth Department will bethe trigger pullers at both the national and warzonelevel.

8/7/2019 PLA_NW_OPS

23/34

275

PLA CNO Doctrinal and Professional MilitaryEducation Organizations. Doctrinal Organizations.

1. Academy of Military Sciences (AMS) is the PLAspremier military science research institution, reportingdirectly to the Central Military Commission (CMC).The academy is the locus of development of PLAstrategy and doctrine, and is also responsible for thecoordination of various military research bodies, oftenat the behest of the CMC and the military leadership.While the majority of its work is academic, AMSsCampaign and Tactics Department []also performs a similar function to the U.S. Trainingand Doctrine Command (TRADOC) in designing,attending, and assessing military exercises in the eld.AMS is also the principal institution responsible forexploring the future of military conict, leading theanalysis of the Revolution in Military Affairs (RMA)

and cyber warfare. Some of the earliest IO and CNO-related research in the PLA was initiated at AMS,beginning with translation and analysis of foreign IWwritings in the Academys Foreign Military StudiesDepartment. The rst generation of AMS scholarsincluded Wang Pufeng and Wang Baocun. Later, asinformation operations evolved and matured in thePLA, important work was conducted in the AMSCampaign and Tactics Department.

2. The National Defense University (NDU) is thePLAs most senior professional military educationinstitution, training the best and brightest of thePLA for leading command positions. The NDU doesconduct some research, though its focus is much morenear-term than the AMS. Wang Baocun summarized

the difference this way: The NDU teaches ofcers,while the AMS writes papers and gives advice to theCMC. NDU must think about the current PLA and

8/7/2019 PLA_NW_OPS

24/34

276

be practical (how to deal with IW now). AMS mustthink about the future, out 10-20 years.47 The primary

ofce at NDU responsible for examining informationoperations issues is the Command Education ResearchOfce []. Two important NDU scholars onIO issues were Liu Guifang and Wang Jiaohuai.

3. The Wuhan Communications CommandAcademy (CCA) is the senior professional militaryeducation institution in China for PLA communicationsand electronics personnel.48 It is responsible for trainingfuture communications and electronics unit leadersin doctrine, policy, technology, and leadership.49 In1999, CCA hosted the rst all-army collective trainingsession for division and brigade chiefs of staff in IWtheory, which has continued to this day.50 It is also thelocus of PLA dissemination of doctrinal and teachingmaterials on information operations, and is the only

institution certied to accredit information operationsinstructors for PLA educational institutions at everylevel and in every service. The CCA offers 31 commandand control related cross-disciplinary courses, withemphasis on IW at the core of undergraduate andgraduate training. In December 1998, CCA establishedthe PLAs rst IW simulation experiment center. Inthe same year, the GSD Communication Departmentendorsed two CCA publications on IW for use asteaching materials, Command and Control in InformationWarfare and Technology in Information Warfare.51 Thetextbooks were drafted by a task force of 20 PLA IWtheorists and instructors from CCA.

PLA CNO Capability Assessment.

Setting the Bar Too High: A More Realistic Assessmentof PLA Cyber Capabilities. In terms of courses of action,

8/7/2019 PLA_NW_OPS

25/34

277

interviews and classied writings reveal interest inthe full spectrum of computer network attack tools,

including hacking, viruses, physical attack, insidersabotage, and electromagnetic attack. One of themost difcult challenges of this type of analysis ismeasuring Chinas actual computer network attackcapability. In rough terms, a computer network attackcapability requires four things, three of which are easyto obtain and one of which is harder. The easy threeare a computer, an Internet connection, and hackertools, thousands of which can be downloaded fromenthusiast sites around the globe. The more difcultpiece of the puzzle to acquire is the operator himself,the computer hacker. While individuals of this ilkare abundant in Chinas urban centers, they are alsocorrectly perceived to be a social group unlikely torelish military or governmental service.

PLA CNO Capabilities and the Patriotic HackerPhenomenon. The issue of PLA CNO capabilities is noteasily separated from the rise of patriotic hackingby increasingly sophisticated, nationalistic hackergroups. Some Western analysts have been temptedto assert that the patriotic hackers are controlledby Beijing, and should therefore be included in PLACNO capabilities estimates. Among the argumentsmarshaled to support this thesis is that consistentlyharsh punishments are meted out to individuals inChina committing relatively minor computer crimes,while patriotic hackers appear to suffer no sanctionfor their brazen contravention of Chinese law. Otheranalysts begin from the specious premise that sincethe Chinese government owns the Internet in China,

therefore patriotic hackers must work for the state.Still others correctly point to the fact that a number ofthese groups, such as Xfocus and NSFocus, appear to

8/7/2019 PLA_NW_OPS

26/34

278

be morphing into white-hat hackers (i.e., becomingprofessional information security professionals), often

developing relationships with companies associatedwith the Ministry of Public Security or the ministryitself. Yet interviews with hackers and ofcials stronglysuggest that the groups truly are independent actors,more correctly labeled state-tolerated or state-encouraged. They are tolerated because are usefulidiots for the regime, but they are also careful not topursue domestic hacking activities that might threateninternal stability and thereby activate the repressionapparatus. Indeed, most of the groups have issuedconstitutions or other organizing documents thatspecically prohibit members from attacking Chineseweb sites or networks.

Even if it is true that patriotic hacker groups are notcontrolled by the state, Beijing is still worried about

the possible effect of their behavior in a crisis with theUnited States and/or Taiwan. Analysis of several recenthacker wars over the last 2 years suggests an evolvingmechanism for shaping the activities of patriotichackers. In August 1999, after the conclusion of thecross-strait hacker skirmish that erupted in the wakeof Taiwan President Li Teng-huis declaration that theislands relationship to the mainland was a state-to-state relationship, aLiberation Army Dailyarticle laudedthe patriotic hackers and encouraged other hackersto join in during the next crisis with Taiwan. In April2001, Guangzhou Daily reprinted without attribution aWired article on the impending outbreak of a hackerwar between Chinese and American hackers, whichmany hackers saw as a sign of government backing.

A media-generated hacker war thereafter ensued, withChinese and American hackers defacing hundreds, ifnot thousands, of web sites. In May 2001, however,

8/7/2019 PLA_NW_OPS

27/34

279

an authoritative Peoples Daily article rebuked bothWestern and Chinese hackers, calling activities by

both sides illegal. This signaled to the hackers thatthe state had withdrawn its sanction of their activities,and hacker activity quickly tapered off in response tothe warning.

A year later, patriotic hacker chat rooms werelled with discussion and planning for a rstanniversary hacker war. In late April 2002 on theeve of the proposed conict, Peoples Daily publishedanother unsigned editorial on the subject, decrying theloose talk about a hacker war and warning of seriousconsequences. Participants in the hacker chat roomsquickly recognized the signal, and the plans for a newhacker war were abandoned. In neither case couldthis dynamic be called control, but instead reects thepopulations keen sensitivity to the subtle messages in

government propaganda, which continues to createsuccessfully a Leninist climate of self-deterrence andself-censorship that is more powerful than active staterepression. As some groups move into white-hatpositions, however, the relationship might actuallytransition from a ruler-ruled dynamic to a partnershipmotivated by reasons ranging from nationalism tonaked self-interest. Script Kiddies vs. New Tool Development. Measuringthe PLAs CNO capability also involves the assessmentof a group or countrys ability to generate new attacktools or exploits. Outside analysts, many of whom areprogrammers themselves, tend to reify countries likeRussia that abound with highly talented programmers,and look down upon countries or individuals that

simply use off-the-shelf script kiddie tools likedistributed denial of service (DDOS) programs. DDOSis admittedly a blunt instrument, but a xation on

8/7/2019 PLA_NW_OPS

28/34

280

nding more sophisticated attacks, which reects thewidely-held but logically tenuous assumption that

state-sponsorship correlates with sophistication, maybe counterproductive. Instead, analysts should employa simple means-ends test. In the Chinese case, DDOS,despite its relatively simplicity, looks like the right toolfor the right mission. From the Chinese point of view,for example, hammering the NIPRNET and forcing itto be taken down for repairs would be considered anoperational success, since it could potentially delay ordegrade U.S. logistics deployments to Taiwan.

CONCLUSIONS AND IMPLICATIONS

The Chinese military views computer networkattack as an attractive asymmetric weapon against high-tech adversaries like the United States, particularly

given the latters dependence on unclassiedinformation systems for global power projection.These vulnerabilities offer enticing opportunitiesfor cyber espionage in peacetime and hold out theprospect of disrupting and even helping to deter U.S.military forces in wartime. Yet the large and growingPLA literature on information operations is alsobeset by a glaring omission: the refusal of Chinesemilitary analysts to acknowledge that Beijings owncommand, control, communications, computers,intelligence, surveillance, and reconnaissance (C4ISR)is paradoxically making China more vulnerable to thevery same asymmetric strategies. Indeed, a signicantpart of the policy answer to the U.S. cybersecuritycrisis vis--vis China may lay in offense rather than

defense. Simply relying on logs of intrusions againstunclassied networks is not sufcient to pierce the veilof the attribution problem, but leveraging offensive

8/7/2019 PLA_NW_OPS

29/34

281

capabilities in support of defense holds the promise ofboth better offense and better defense.

CHAPTER 8 - ENDNOTES

1. Key Western writings on the subject of PLA computernetwork operations include: Timothy L. Thomas, Cyber Bytes:Chinese Information-War Theory and Practice, Fort Leavenworth, KS:Foreign Military Studies Ofce, 2004; Timothy L. Thomas, Chineseand American Network Warfare, Joint Force Quarterly, No. 38,August 2005; Coping with the Dragon: Essays on PLA Transformation

and the U.S. Military, Washington, DC: Center for Technology andNational Security Policy, National Defense University, December2007; James Mulvenon, Chinese Information OperationsStrategies in a Taiwan Continegency, Testimony before the U.S.-China Economic and Security Review Commission, September15, 2005; Toshi Yoshihara, Chinese Information Warfare: A PhantomMenace or Emerging Threat? Carlisle, PA: Strategic Studies Institute,U.S. Army War College, November 2001; Timothy L. Thomas,Like Adding Wings to the Tiger: Chinese Information War Theory and

Practice, Fort Leavenworth, KS: Foreign Military Studies Ofce,November 2000; Major (Ret.) Charles F. Hawkins, The PeoplesLiberation Army Looks to the Future, Joint Force Quarterly,Summer 2000, pp. 12-16; Michael Pillsbury, Chinese Views of FutureWarfare, Washington, DC: Institute for National Strategic Studies,National Defense University, 2000; Bates Gill and Lonnie Henley,China and the Revolution in Military Affairs, Carlisle, PA: StrategicStudies Institute, U.S. Army War College, May 1996.

2. Dai Qingmin, On Integrating Network Warfare andElectronic Warfare, Zhongguo junshi kexue, Vol. 1, February 2002,pp. 112-117.

3. Foreign Ministry Press Conference, September 4, 2007.

4. Wang Houqing, Zhang Xingye, The Science of MilitaryCampaigns [], Beijing, NDU Press, 2000, pp. 173-74.

5. Nu Li, Li Jiangzhou, and Xu Dehui, Strategies inInformation Operations: A Preliminary Discussion, MilitaryScience, April 2000.

8/7/2019 PLA_NW_OPS

30/34

282

6. The Science of Military Campaigns, p. 170.

7. Wei Jincheng, New Form of Peoples War,Jiefangjun bao,June 25, 1996, p. 6.

8. Mao Zedong, On Protracted War (May 1938), in SelectedWorks of Mao Zedong, Vol. II, Beijing, China: Foreign LanguagesPress, 1961, paragraph 83.

9. Lu Daohai, ed., Information Operations [], Beijing,China: PLA Arts and Literature Press, p. 288.

10. Information Operations, p. 296.

11. Lu Linzhi, Preemptive Strikes Crucial in Limited High-Tech Wars,Jiefangjun bao, February 14, 1996.

12. Ibid.

13. Ibid.

14. Ibid.

15. The Science of Military Campaigns , pp. 178-79.

16. Information Operations, p. 324.

17. Dai Qingmin, On Integrating Network Warfare andElectronic Warfare.

18. Ibid.

19. Ibid.

20. Ibid.

21. Among the rare examples, which perversely strengthenthe case for signicant counterintelligence concerns on Taiwan,are three military ofcers (Majors Pai Chin-yang, Tseng Chao-wen, and Chen Sui-chiung) arrested for spying and twoindividuals (Huang Cheng-an and his girlfriend) arrested for

8/7/2019 PLA_NW_OPS

31/34

283

transferring technology from the Chungshan Institute for Scienceand Technology to the mainland. See William Foreman, TaiwanArrests Military Ofcer On Spy ChargesThe Third Such Case InMonth,Associated Press, December 3, 2003; and Taiwan DetainsWoman Over Alleged Spying, South China Morning Post, January30, 2004. An earlier case also involved Yeh Yu-chen and ChenShih-liang and technology from the Chungshan Institute. SeeTaiwan Attempts Damage-Control After Alleged Chinese SpyRing,AFP, August 7, 2003.

22. Top PLA Ofcers Accused of Spying for Taiwan, StraitsTimes, April 16, 2004; Beijing Arrests Military Ofcers on SpyCharges, China Post, April 17, 2004.

23. The timing and propaganda exploitation of the arrests,which coincided with the Taiwan presidential campaign, suggeststhat the Chinese already had the individuals under surveillanceand chose to arrest them for maximum political effect. See PhilipPan, China Arrests 43 Alleged Spies; Move Increases Effort toUndermine Taiwanese President, Washington Post, December24, 2003; Chinese Mainland Smashes Taiwan Spy Ring, Xinhua,December 24, 2003; Espionage, Corruption Cases In China,December 2003-February 2004, BBC Monitoring InternationalReports, February 14, 2004; Joe McDonald, China ParadesAccused Taiwanese Spies In Front Of Cameras Amid TensionsWith Island, Associated Press, January 16, 2004; and TaiwanSpies Visited by Families, Xinhua, January 20, 2004.

24. China Detains Two More Taiwanese Suspected ofEspionage,AFP, February 13, 2004, citing Chinese state media.

25. Chongqing Ribao, August 8, 2003, p. 1.

26.AFP, September 2, 2003, p. 1.

27. Brian Hsu, Taiwan Naval Ofcer Gets Life For Espionage,Taipei Times, December 18, 2002.

28. John Pomfret, Taiwanese Mistake Led To 3 SpiesExecutions, Washington Post, February 20, 2000.

29. Peoples Daily article in August 1999, cited in Pomfret,Taiwanese Mistake.

8/7/2019 PLA_NW_OPS

32/34

284

30. Sichuan television report in October 1999, cited in Pomfret,Taiwanese Mistake.

31. Former Taiwan Spy Chief Denies Leaking Secrets DuringHis Four Years In China, Taiwan News, April 14, 2004.

32. Michael Gordon, Secret U.S. Study Concludes TaiwanNeeds New Arms, New York Times, April 1, 2001.

33. US to Share Early-Warning Missile Data With Taiwan,AFP, October 8, 2002.

34. Wendell Minnick, Taiwan-USA Link Up on SIGINT,Janes Defense Review, January 23, 2001; Wendell Minnick, SpookMountain: How US Spies on China, Asia Times Online, March6, 2003; and Wendell Minnick, Challenge to Update TaiwansSIGINT,Janes Intelligence Review, February 1, 2004.

35. Lu Linzhi, Preemptive Strikes.

36. Information Operations, p. 293.

37. DoDs revised web site administration guidance,which can be found at www.defenselink.mil/webmasters/policy/dod_web_policy_12071998_with_amendments_and_corrections.html, specically prohibits the following: 3.5.3.2. Reference tounclassied information that would reveal sensitive movementsof military assets or the location of units, installations, or personnelwhere uncertainty regarding location is an element of a militaryplan or program.

38. Ma Jinsheng, Canmou junguan zhanshi yewu zhinan(Guidebook for Staff Ofcers Professional Work in Wartime), Beijing,China: Academy of Military Sciences, August 1997.

39. Dai Qingmin, Min Zongguang and Chen Kelin, Introductionto Information Warfare, Beijing, China: PLA Press, 2001.

40. Dai Qingmin, Information Warfare Review, Beijing, China:PLA Press, 1999.

8/7/2019 PLA_NW_OPS

33/34

285

41. Dai Qingmin, On Four Abilities for InformationizedWarfare,Jiefangjun bao, July 1 2003, p. 6.

42. Dai Qingmin, Innovating and Developing Views onInformation Operations, Zhongguo junshi kexue, August 20, 2000,pp. 72-77.

43. Dai Qingmin, Xinxizhan gainian (Information War Concepts),Beijing, China: PLA Publishing House, 2001.

44. Dai Qingmin, On the Development of ArmyInformationization and Information Warfare, Zhongguo junshikexue, December 20, 2002, pp. 66-70.

45. Dai Qingmin, On Integrating Network Warfare andElectronic Warfare, pp. 112-117; and Xu Xiaoyan, A Concept fora Strategy of Development in which Informationization DrivesMechanization, Zhongguo junshi kexue, February 1, 2002, pp. 107-111.

46. This section draws heavily from the excellent work ofKevin Pollpeter on command and control in the warzone.

47. Interview, August 10, 2000.

48. A good summary of WCCA can be found at baike.baidu.com/view/1521221.htm .

49. Long Zequn, Using Hi-Tech to Develop Hear-AllDevices, the Communications Command Academy Sets MultipleRecords, Hubei ribao, May 4, 2002.

50. Sun Haicheng, Yang Jie, and Zhang Guoyu, LetInformation Warfare Training Rule the Training Sites:Practice andReections from the First All-Army CollectiveTraining Sessionfor Division and Brigade Chiefs of Staff in Information WarfareTheory,Jiefangjun bao, July 13, 1999, p. 6.

51. Lei Yuanshen, New Breakthrough in Study of Informa-tion Warfare,Jiefangjun bao, July 21, 1998, p. 6.

8/7/2019 PLA_NW_OPS

34/34