Threat Dynamics on the Seas

Threat Dynamics on the Seas

Speakers: John Mauger; Michael Sulmeyer, Professor of Practice, Georgetown University; Adam Segal, Ira Lipman Chair in Emerging Technologies and National Security, Director of the Digital and Cyberspace Policy Program, Council on Foreign Relations

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=HJYTMhbtKVU

Overview

This talk, sponsored by the Maritime Hacking Village at DEF CON, delves into the critical intersection of cybersecurity policy and geopolitical competition, specifically focusing on the Indo-Pacific region and the burgeoning influence of China. The discussion highlights the immense economic and national security stakes involved, with the maritime industry facilitating 90% of global goods movement and contributing $5.4 trillion annually to the US economy. The speakers, drawing from extensive backgrounds in national security, cyber policy, and foreign relations, provide a comprehensive analysis of China's strategic cyber ambitions, the US's evolving defense posture, and the implications for global maritime security.

The panel features Adam Segal, a leading expert on Chinese technology policy, who outlines China's transformation into a "super cyber power" under Xi Jinping. He details the reorganization of the People's Liberation Army (PLA) and the strategic integration of cyber warfare. Complementing this perspective, Michael Sulmeyer, former Assistant Secretary of Defense for Cyber Policy, elucidates the US military's approach to cyber defense, its core missions, and the cultural challenges within service branches like the Navy in adapting to modern cyber threats. The discussion underscores the dynamic nature of cyber conflict, from intellectual property theft to pre-positioning malware, and the imperative for proactive defense strategies in an increasingly interconnected and contested global environment.

Background

▶ Watch: Introduction: China, Indo-Pacific, and maritime industry (0:00)

The geopolitical landscape, particularly in the Indo-Pacific, is characterized by intense competition, with China aggressively pursuing its strategic objectives. As outlined by Adam Segal, China's transformation into a "super cyber power" began in 2012 under Xi Jinping, marked by significant domestic and military reforms. Domestically, China revised its cybersecurity and national security laws, while militarily, it reorganized the People's Liberation Army (PLA) to create the Strategic Support Forces. This reorganization aimed to integrate cyber warfare with electronic warfare, psychological warfare, space warfare, and information warfare, fostering a holistic approach to conflict. A key aspect of this strategy involved tapping into Chinese cybersecurity researchers, compelling them to disclose most vulnerabilities they discover to the state, thereby restricting their participation in international competitions and bolstering China's indigenous cyber capabilities, including access to zero-days.

China's cyber power development is primarily focused on two critical scenarios: a potential conflict over Taiwan and incidents in the South China Sea related to competing maritime interests (fishing, oil, natural gas). The PLA is reportedly preparing to take Taiwan by 2027, with anticipated actions ranging from blockades and quarantines to a full amphibious invasion. In such a scenario, China's cyber operations would target command and control systems and critical infrastructure in Taiwan, aiming to weaken resistance. Simultaneously, cyberattacks would be launched against countries likely to assist Taiwan, predominantly the United States, but also Japan and South Korea, where US forces are based. This preparatory activity is exemplified by Volt Typhoon, a Chinese state-sponsored actor observed pre-positioning malware on US critical infrastructure, not for espionage, but for potential disruption and societal chaos during a conflict.

In response to this evolving threat, the US military has structured its cyber forces around three core missions, as articulated by Michael Sulmeyer:

1. Defend its own networks: Ensuring the functionality of military communications and command and control systems (C2) to enable global response capabilities.
2. Generate offensive options: Developing cyber capabilities for use in various conflict scenarios, integrated with conventional military operations.
3. Defend the nation from significant cyberattacks: Supporting other government agencies (like DHS or FBI) by contributing Department of Defense expertise to counter malicious cyber activity that may not constitute an act of war but still poses a threat (e.g., ransomware on schools, intrusions into power grids).

A significant challenge identified, particularly within the Navy, is a cultural barrier in perceiving cyber threats. Traditionally, the Navy has viewed cyber issues as either IT problems (managed by CIOs or communications personnel, focused on availability) or intelligence functions (collecting information on adversaries). This perspective often overlooks cyber as a domain for power projection or a vector for information operations and spoofing, which are distinct from managing Office 365 licenses or troubleshooting network connectivity. Overcoming this cultural inertia is crucial for the Navy to effectively integrate cyber into its operational doctrine, especially in the vast Pacific theater.

Key Findings

▶ Watch: Xi Jinping's vision for China as a 'super cyber power' (2:55)

The talk reveals several key findings concerning the evolving cyber threat landscape, particularly China's strategic advancements and the corresponding US defense adaptations:

Firstly, China's cyber capabilities have undergone a significant evolution in phases. Initially characterized by "sloppy, mass hacking" primarily for intellectual property (IP) theft, often attributed to the PLA and likened to a "drunk burglar," this phase saw a shift after a 2015 US-China agreement. The subsequent phase involved reorganization, with some activities moving from the PLA to the Ministry of State Security, leading to more sophisticated and directed attacks, such as Cloud Hopper, targeting IT services. The current, third phase, exemplified by Volt Typhoon, focuses on pre-positioning malware on critical infrastructure for future disruptive or destructive effects, marking a strategic shift from espionage to potential conflict preparation. This highlights China's growing sophistication and strategic intent in cyberspace.

Secondly, the talk underscores China's strategic intent to achieve technological self-sufficiency and competitive advantage. While traditional IP theft contributed, the primary drivers of China's innovation are massive investments in Research & Development (R&D) (budgets doubled over two decades) and the return of tens of thousands of Chinese students and professors who studied abroad, bringing back expertise to establish advanced labs. China has explicitly identified critical technologies where it aims to be competitive, pouring resources into these areas. This has resulted in Chinese AI models, for instance, being as competitive, if not more so, than US models, closing the technological gap.

Thirdly, the US has significantly adapted its cyber defense posture through the adoption of "defend forward" or "persistent engagement". This represents a marked shift from a reactive "clean up on aisle 7" approach to a proactive strategy of disrupting malicious activity before it reaches the homeland. This policy, enabled by modified laws and defense department policies post-2018, allows the military to operate more assertively below the level of armed conflict. The 2018 midterm elections served as the first operational test for these new authorities, demonstrating the imperative for continuous, proactive engagement against persistent and growing threats.

Fourthly, the intertwining of insider threats with cyber and information security is identified as a critical vulnerability. The speakers emphasize that insider threats, often perceived as physical security issues, increasingly leverage cyber means such as thumb drives or abuse authorized network access due to poor network segmentation. This blending of intrusion methods requires a more integrated security approach, challenging traditional organizational structures where physical and cyber security teams operate distinctly. China and other adversaries are highly skilled at exploiting these blended methods, necessitating a unified defense.

Finally, China's Belt and Road Initiative (BRI) has evolved to include a significant digital infrastructure component, impacting global maritime choke points. While the initial BRI focused on physical infrastructure like ports and rail lines, there's been a shift towards digital infrastructure, including satellite networks, fiber optics, and 5G build-outs. This digital expansion is seen as a strategy to gain "similar control of choke points" as the US has historically enjoyed through its tech companies, leveraging weaponized interdependence to exert influence and potentially gain access to data and networks in partner countries. This represents a long-term strategic play for digital dominance and control over critical global information flows.

Technical Deep Dive

▶ Watch: China's cyber focus on Taiwan and South China Sea (4:00)

While the talk is primarily policy-focused, it touches upon several technical concepts and operational methods that underpin the geopolitical competition in cyberspace. The core of China's strategy, as detailed by Adam Segal, involves a sophisticated integration of various forms of warfare within the PLA's Strategic Support Forces. This means that cyber warfare is not an isolated domain but is deeply interwoven with electronic warfare (disrupting enemy communications and sensors), psychological warfare (manipulating perceptions), space warfare (targeting satellites and space-based assets), and information warfare (controlling narratives and data). This holistic approach implies a coordinated effort where cyber operations might precede or run concurrently with other forms of attack, for instance, using cyber means to disable air defenses before a conventional strike.

A critical technical element of China's cyber power is its aggressive stance on vulnerability disclosure. Chinese cybersecurity researchers are reportedly compelled to provide most of the zero-day vulnerabilities they discover directly to the Chinese state. This policy effectively funnels advanced exploit capabilities into state hands, denying them to international markets or defensive efforts by other nations. The acquisition and hoarding of such vulnerabilities provide China with a potent arsenal for offensive operations against a wide range of targets, from critical infrastructure to military systems.

The most salient technical example discussed is Volt Typhoon, a Chinese state-sponsored actor engaged in pre-positioning malware on critical infrastructure in the United States. This is a technically distinct operation from traditional espionage. Instead of exfiltrating data, the objective is to implant persistent, dormant malware that can be activated at a later date to cause disruption, degradation, or destruction. This malware is designed to reside deep within target networks, potentially in operational technology (OT) or industrial control systems (ICS), to maximize impact during a conflict. The implication is a long-term, patient campaign to establish footholds that could lead to widespread societal chaos by impacting essential services such like power grids or water treatment facilities.

From the US perspective, Michael Sulmeyer outlines the technical imperatives for military cyber forces. The first mission, defending military networks, involves robust network defense architectures, advanced intrusion detection systems (IDS), and security information and event management (SIEM) solutions to protect sensitive communications and C2 systems. The second mission, generating offensive options, requires highly skilled cyber operators capable of developing custom exploits, conducting computer network exploitation (CNE), and performing computer network attack (CNA) against adversary systems. The third mission, defending the nation, involves capabilities for threat intelligence sharing, malware analysis, and providing expert assistance to civilian agencies, potentially involving incident response and forensic analysis.

The discussion also highlighted the evolving nature of insider threats. While traditionally viewed as a physical security concern, modern insider threats are increasingly cyber-enabled. This means an insider might use a USB drive to exfiltrate data, exploit authorized access to compromise systems due to poor network segmentation, or bypass security controls through social engineering. The technical challenge here is to integrate physical security measures with cybersecurity controls, implementing least privilege principles, robust access controls, and continuous monitoring for anomalous behavior across both digital and physical domains.

Finally, China's expansion of digital infrastructure through the Belt and Road Initiative has significant technical implications. The construction of fiber optic networks, deployment of 5G cellular technology, and development of satellite communication infrastructure in partner countries creates potential avenues for intelligence collection, data manipulation, and network control. This strategy, leveraging weaponized interdependence, aims to create a technological ecosystem where China has inherent advantages, similar to how the US has historically benefited from its dominant tech companies. This could involve backdoors in network equipment, strategic data routing, or control over critical digital nodes, giving China leverage over information flows and national infrastructure in these regions.

Demo / Proof of Concept

▶ Watch: Understanding Volt Typhoon: Chinese malware pre-positioning (6:30)

The talk itself did not feature a live demonstration or a detailed proof of concept of any specific cyberattack or defense mechanism. The speakers engaged in a high-level policy discussion concerning geopolitical cyber dynamics. However, the moderator, John Mauger, did encourage the audience to visit the Maritime Hacking Village and "spend some time not only talking with our policy experts but getting on keyboard and helping us to secure this industry." This suggests that practical demonstrations and hands-on activities related to maritime cybersecurity were available elsewhere at the conference, though not part of this specific panel discussion.

Defensive Implications

▶ Watch: US Cyber Command's approach to force training and generation (7:45)

The insights from this talk carry significant defensive implications for both government agencies and critical infrastructure operators, particularly in the maritime domain. Understanding China's evolving cyber strategy and the US's response is crucial for developing robust and adaptive defenses.

Firstly, the revelation of Volt Typhoon's pre-positioning strategy necessitates a proactive and deep defense approach for critical infrastructure. Defenders must move beyond perimeter security and focus on threat hunting within their networks, specifically looking for dormant malware or persistent access points that could be activated during a conflict. This requires advanced endpoint detection and response (EDR), network traffic analysis, and security orchestration, automation, and response (SOAR) capabilities to identify and eradicate sophisticated, low-and-slow intrusions. Regular red team exercises simulating nation-state pre-positioning tactics are also vital.

Secondly, the US military's "defend forward" or "persistent engagement" strategy implies a need for closer information sharing and collaboration between the military, intelligence community, and critical infrastructure owners. Defenders in the private sector should leverage threat intelligence from government sources to understand adversary Tactics, Techniques, and Procedures (TTPs) and adapt their defenses accordingly. This also underscores the importance of collective defense, where disrupting an adversary's activity abroad benefits domestic security.

Thirdly, addressing the cultural barriers within organizations, particularly the Navy's historical view of cyber as merely an IT or intelligence problem, is paramount. Cybersecurity must be recognized as a power projection domain and a core operational capability. This requires cybersecurity awareness training across all levels of an organization, from leadership to operational personnel, to foster a holistic understanding of cyber risks and capabilities. Investment in specialized cyber talent development and career pathways that retain skilled personnel is also critical to build a robust cyber workforce.

Fourthly, the blending of insider threats with cyber intrusion methods demands an integrated security strategy. Organizations must break down silos between physical security, HR, and cybersecurity teams. Implementing comprehensive insider threat programs that monitor user behavior, enforce least privilege access, and conduct regular background checks is essential. Technical controls such as data loss prevention (DLP), network segmentation, and rigorous access control management can mitigate the impact of compromised insiders.

Finally, the expansion of China's digital infrastructure through the Belt and Road Initiative, including 5G, fiber optics, and satellite networks, highlights the need for supply chain security. Organizations procuring technology or services from regions influenced by China must conduct thorough due diligence to assess potential risks of backdoors, surveillance, or data manipulation. Diversifying technology providers and investing in open-source intelligence (OSINT) to track geopolitical tech developments can help mitigate these long-term strategic vulnerabilities. The concept of weaponized interdependence suggests that reliance on any single nation's technology infrastructure can be exploited, necessitating a diversified and resilient digital ecosystem.

Key Takeaways

• China's Evolving Cyber Strategy: Under Xi Jinping, China has transformed into a "super cyber power," integrating cyber warfare into its military doctrine (Strategic Support Forces) and shifting from IP theft to sophisticated malware pre-positioning (e.g., Volt Typhoon) on critical infrastructure for potential future conflict.
• US "Defend Forward" Posture: The US military has adopted a proactive "defend forward" or "persistent engagement" strategy, aiming to disrupt malicious cyber activity abroad before it impacts the homeland, moving beyond reactive cleanup operations.
• Cultural Barriers in Cyber Defense: Service branches, particularly the Navy, have historically struggled to view cyber as a domain for power projection, often relegating it to IT management or intelligence functions, hindering effective integration into operational strategy.
• Blended Threat Landscape: Adversaries are adept at combining different intrusion methods, notably blending insider threats with cyber techniques, requiring integrated physical and cybersecurity defenses and a holistic approach to security.
• Digital Infrastructure as a Geopolitical Tool: China's Belt and Road Initiative includes significant digital infrastructure build-out (5G, fiber optics, satellites), leveraging "weaponized interdependence" to gain strategic control over global information flows and exert influence.
• Imperatives for Defense: Effective defense requires rapid generation of threat insights, agile hardening of networks (in hours, not months), swift development of offensive options, robust talent management to retain skilled cyber personnel, and strategic partnerships that yield tangible operational outcomes.

About the Speaker(s)

John Mauger served as the moderator for this panel. He has a distinguished career spanning many decades in the Coast Guard. He previously held a critical role at United States Cyber Command as the J7, responsible for the training and force generation of military cyber forces, overseeing how the different military branches develop their cyber talent.

Dr. Michael Sulmeyer is currently starting as a Professor of Practice at Georgetown University's Foreign Service Security Studies Program. He is widely recognized for his tenure as the first Assistant Secretary of Defense for Cyber Policy and as the Principal Cyber Adviser to the Secretary of Defense. His background provides deep insight into the organization of the US government's military power, domestic, and homeland security forces in the cyber realm.

Adam Segal holds the Ira Lipman Chair in Emerging Technologies and National Security and serves as the Director of the Digital and Cyberspace Policy Program at the Council on Foreign Relations. He has dedicated over two decades to studying China, Chinese technology policy, and initiatives, and is the author of several books on the topic. Notably, he recently spent time in the Department of State, where he was instrumental in developing the international cyberspace and digital policy for the US government, bringing a wealth of recent insight and perspective to the discussion.