China Is the Leading Suspect in OPM Hack, US Says

China is the “leading suspect” in the hack at the Office of Personnel Management, or OPM, says James Clapper, the Director of National Intelligence. He spoke one day after Adm. Michael Rogers, who leads U.S. Cyber Command and the National Security Agency, warned the world not to “assume” China was to blame. The strange back-and-forth reveals a rising certainty that China is the party responsible — and an uncertainty about what to do about it.

OPM-style hacks will likely continue, Clapper told an audience at the GEOINT Symposium in Washington, D.C., “until such time as there is some sort of penalty for whatever behavior we may find reprehensible or onerous.” Such penalties would be part of a “psychology of deterrence,” that the United States should foster to keep actors like China from breaking into U.S. government servers.

So what kind of penalty is appropriate for the OPM attack? The answer from some national security leaders seems to be: a muted one at best.

Earlier in the day, Rep. Adam Schiff, D-Calif., who serves on the House Permanent Select Committee Intelligence, suggested that intelligence-gathering, the purported purpose of the OPM hack, would not necessarily constitute an action worthy of cyber retaliation. On the other hand, “an attack that does damage,” such as last November’s Sony hack that actually destroyed data, might “merit a response.”

Clapper seemed to agree that a cyber attack would only rise to the level answerable “when it’s physically destructive.” But he said the subject remains a matter of some debate within the intelligence community.

In response to reports about Clapper’s statement, White House press secretary Josh Earnest said that the White House and investigating authorities would reveal suspects if and when it actually serves the investigation. He added, “If there is a response, it is not one we are likely to telegraph in advance.”

If the United States chooses to retaliate against China — or whomever it ultimately blames — for the OPM hack, it might have a number of secret cyber weapons at its disposal. Or it might not. Unlike fighter jets, cyber weapons don’t make it into budget lines. They’re not subject to the same level of public scrutiny, and, even when they are used, it may not be apparent that the U.S. has struck — as the OPM case makes clear. Rogers has previously said that the U.S. would deploy cyber weapons under conventional laws of combat — albeit in secret.

“Don’t take this the wrong way,” Clapper urged the audience at one point. “You have to kinda salute the Chinese for what they did.”

Molly O’Toole contributed to this story.