Role of the United States

Cyber Responses

The United States could pursue a proportionate response. The United States could try to disrupt critical networks within China, such as its banking system, for a limited period. The attacks could also be directed at a target that seems particularly valuable to the Chinese leadership. These attacks could be focused on the censorship technology that constitutes the so-called Great Firewall. The U.S. response should be accompanied by some level of attribution. This means that the United States would need to identify the attackers, and the attack would reveal some of the United States’ technical and intelligence capabilities.

With this option, the United States would essentially be responding in kind. This would keep the U.S.-China dispute in the domain (cyberspace) it is already in rather than extending it. Even if the conflict were to escalate, Washington could claim that it was not the instigator. The United States would likely be capable of mounting a targeted cyberattack that stood a good chance of producing the desired effect.

Nonetheless, a cyber response has costs and risks. A cyberattack could fail if the defender has already patched the vulnerability. Given China’s extensive connection with the global economy, malware used against China could also quickly spread to the rest of the world. This could infect U.S. allies and eventually make its way back to the United States. Although limited to one domain, cyberattacks could also escalate rapidly. If attacks damage Chinese defense networks, Beijing could fear that a conventional strike could soon follow. In this scenario, China could decide to launch conventional strikes on U.S. military assets as quickly as possible. Chinese economic retaliation—such as sanctions or tariffs—against the United States is also possible. In addition, other countries could find U.S. claims of China’s guilt unconvincing. Failing to convince others that the Chinese government was behind the attacks would not only limit support for the U.S. response but also undermine Washington’s efforts to develop international norms for behavior in cyberspace. 

Punitive Sanctions

In April 2015, Obama issued an executive order that laid the groundwork for economic sanctions. Declaring a national emergency to deal with the threat of “significant malicious cyber-enabled activities,” the order enabled the treasury secretary to sanction individuals and entities involved, directly or indirectly, in cyberattacks. Possible sanctions include freezing suspects’ financial assets and barring commercial transactions with them. In the current scenario, the White House could sanction high-level Chinese authorities who it believes ordered the attack and levy economic sanctions on government entities and state-owned enterprises deemed to be connected to the hacks. It could also expel Chinese diplomats from the United States. 

Another response would be to indict the individual hackers involved. Although these individuals are unlikely to ever be handed over to U.S. authorities for trial, their international travel would be limited, and the indictments could deter future Chinese hackers who wish to someday travel abroad. Punitive sanctions would involve identifying the attackers and revealing some U.S. technical and intelligence methods. 

It could take a while for economic sanctions to be imposed. However, it could take even longer for them to cause enough damage to affect the target’s behavior. Chinese firms could also skirt financial restrictions by trading with Russia or others, and China could retaliate against U.S. companies that heavily export to China. The U.S. response could appear weak, undermine deterrence, and embolden other cyberattackers. The United States would need to convince others that the Chinese government was behind the attacks. Otherwise, support for U.S. sanctions would be limited, possibly reducing their effectiveness. 

Military Responses

Washington could increase freedom of navigation operations and the U.S. military presence more broadly in the South China Sea. It could help small countries build maritime law enforcement and security capacity and in particular improve the Philippines’ long-term maritime capabilities. The United States could also expand military exercises with countries in the region.

Such a response is clear and well within the capability of the U.S. military and would also convey the United States’ resolve. Washington could announce that its military initiatives were in response to the Chinese cyberattacks. It could also refrain from doing so. Connecting the response to the attack publicly could be more escalatory. However, it would have the advantage of marking a clear response to the Chinese behavior, ideally leading Beijing to reduce or end this activity. Not making the connection public would be less provocative but could signal to potential attackers that cyberattacks such as the one against Nasdaq fall below the threshold for a forthright response. Regardless of whether the United States announces the connection, military steps could escalate Chinese reclamation behavior in the South China Sea. It could also lead to an incident that escalates into military conflict. Moreover, U.S. support could also embolden the smaller countries to push China harder than they would dare to alone.