China Is the Leading Suspect in OPM Hack, US Says

Director of National Intelligence James Clapper arrives on Capitol Hill in Washington, Thursday, Feb. 26, 2015.

J. Scott Applewhite/AP

AA Font size + Print

Director of National Intelligence James Clapper arrives on Capitol Hill in Washington, Thursday, Feb. 26, 2015.

The intelligence community thinks they know who stole the data. That doesn’t change much.

China is the “leading suspect” in the hack at the Office of Personnel Management, or OPM, says James Clapper, the Director of National Intelligence. He spoke one day after Adm. Michael Rogers, who leads U.S. Cyber Command and the National Security Agency, warned the world not to “assume” China was to blame. The strange back-and-forth reveals a rising certainty that China is the party responsible — and an uncertainty about what to do about it.

OPM-style hacks will likely continue, Clapper told an audience at the GEOINT Symposium in Washington, D.C., “until such time as there is some sort of penalty for whatever behavior we may find reprehensible or onerous.” Such penalties would be part of a “psychology of deterrence,” that the United States should foster to keep actors like China from breaking into U.S. government servers.

So what kind of penalty is appropriate for the OPM attack? The answer from some national security leaders seems to be: a muted one at best.

Earlier in the day, Rep. Adam Schiff, D-Calif., who serves on the House Permanent Select Committee Intelligence, suggested that intelligence-gathering, the purported purpose of the OPM hack, would not necessarily constitute an action worthy of cyber retaliation. On the other hand, “an attack that does damage,” such as last November’s Sony hack that actually destroyed data, might “merit a response.”

Clapper seemed to agree that a cyber attack would only rise to the level answerable “when it’s physically destructive.” But he said the subject remains a matter of some debate within the intelligence community.

In response to reports about Clapper’s statement, White House press secretary Josh Earnest said that the White House and investigating authorities would reveal suspects if and when it actually serves the investigation. He added, “If there is a response, it is not one we are likely to telegraph in advance.”

If the United States chooses to retaliate against China — or whomever it ultimately blames — for the OPM hack, it might have a number of secret cyber weapons at its disposal. Or it might not. Unlike fighter jets, cyber weapons don’t make it into budget lines. They’re not subject to the same level of public scrutiny, and, even when they are used, it may not be apparent that the U.S. has struck — as the OPM case makes clear. Rogers has previously said that the U.S. would deploy cyber weapons under conventional laws of combat — albeit in secret.

“Don’t take this the wrong way,” Clapper urged the audience at one point. “You have to kinda salute the Chinese for what they did.”

Molly O’Toole contributed to this story.

Close [ x ] More from DefenseOne

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Ongoing Efforts in Veterans Health Care Modernization

    This report discusses the current state of veterans health care

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

  • Top 5 Findings: Security of Internet of Things To Be Mission-Critical

    As federal agencies increasingly leverage these capabilities, government security stakeholders now must manage and secure a growing number of devices, including those being used remotely at the “edge” of networks in a variety of locations. With such security concerns in mind, Government Business Council undertook an indepth research study of federal government leaders in January 2017. Here are five of the key takeaways below which, taken together, paint a portrait of a government that is increasingly cognizant and concerned for the future security of IoT.

  • Coordinating Incident Response on Posts, Camps and Stations

    Effective incident response on posts, camps, and stations is an increasingly complex challenge. An effective response calls for seamless conversations between multiple stakeholders on the base and beyond its borders with civilian law enforcement and emergency services personnel. This whitepaper discusses what a modern dispatch solution looks like -- one that brings together diverse channels and media, simplifies the dispatch environment and addresses technical integration challenges to ensure next generation safety and response on Department of Defense posts, camps and stations.

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation


When you download a report, your information may be shared with the underwriters of that document.