China Is the Leading Suspect in OPM Hack, US Says

Director of National Intelligence James Clapper arrives on Capitol Hill in Washington, Thursday, Feb. 26, 2015.

J. Scott Applewhite/AP

AA Font size + Print

Director of National Intelligence James Clapper arrives on Capitol Hill in Washington, Thursday, Feb. 26, 2015.

The intelligence community thinks they know who stole the data. That doesn’t change much.

China is the “leading suspect” in the hack at the Office of Personnel Management, or OPM, says James Clapper, the Director of National Intelligence. He spoke one day after Adm. Michael Rogers, who leads U.S. Cyber Command and the National Security Agency, warned the world not to “assume” China was to blame. The strange back-and-forth reveals a rising certainty that China is the party responsible — and an uncertainty about what to do about it.

OPM-style hacks will likely continue, Clapper told an audience at the GEOINT Symposium in Washington, D.C., “until such time as there is some sort of penalty for whatever behavior we may find reprehensible or onerous.” Such penalties would be part of a “psychology of deterrence,” that the United States should foster to keep actors like China from breaking into U.S. government servers.

So what kind of penalty is appropriate for the OPM attack? The answer from some national security leaders seems to be: a muted one at best.

Earlier in the day, Rep. Adam Schiff, D-Calif., who serves on the House Permanent Select Committee Intelligence, suggested that intelligence-gathering, the purported purpose of the OPM hack, would not necessarily constitute an action worthy of cyber retaliation. On the other hand, “an attack that does damage,” such as last November’s Sony hack that actually destroyed data, might “merit a response.”

Clapper seemed to agree that a cyber attack would only rise to the level answerable “when it’s physically destructive.” But he said the subject remains a matter of some debate within the intelligence community.

In response to reports about Clapper’s statement, White House press secretary Josh Earnest said that the White House and investigating authorities would reveal suspects if and when it actually serves the investigation. He added, “If there is a response, it is not one we are likely to telegraph in advance.”

If the United States chooses to retaliate against China — or whomever it ultimately blames — for the OPM hack, it might have a number of secret cyber weapons at its disposal. Or it might not. Unlike fighter jets, cyber weapons don’t make it into budget lines. They’re not subject to the same level of public scrutiny, and, even when they are used, it may not be apparent that the U.S. has struck — as the OPM case makes clear. Rogers has previously said that the U.S. would deploy cyber weapons under conventional laws of combat — albeit in secret.

“Don’t take this the wrong way,” Clapper urged the audience at one point. “You have to kinda salute the Chinese for what they did.”

Molly O’Toole contributed to this story.

Close [ x ] More from DefenseOne

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Software-Defined Networking

    So many demands are being placed on federal information technology networks, which must handle vast amounts of data, accommodate voice and video, and cope with a multitude of highly connected devices while keeping government information secure from cyber threats. This issue brief discusses the state of SDN in the federal government and the path forward.

  • Military Readiness: Ensuring Readiness with Analytic Insight

    To determine military readiness, decision makers in defense organizations must develop an understanding of complex inter-relationships among readiness variables. For example, how will an anticipated change in a readiness input really impact readiness at the unit level and, equally important, how will it impact readiness outside of the unit? Learn how to form a more sophisticated and accurate understanding of readiness and make decisions in a timely and cost-effective manner.

  • Cyber Risk Report: Cybercrime Trends from 2016

    In our first half 2016 cyber trends report, SurfWatch Labs threat intelligence analysts noted one key theme – the interconnected nature of cybercrime – and the second half of the year saw organizations continuing to struggle with that reality. The number of potential cyber threats, the pool of already compromised information, and the ease of finding increasingly sophisticated cybercriminal tools continued to snowball throughout the year.

  • A New Security Architecture for Federal Networks

    Federal government networks are under constant attack, and the number of those attacks is increasing. This issue brief discusses today's threats and a new model for the future.

  • Information Operations: Retaking the High Ground

    Today's threats are fluent in rapidly evolving areas of the Internet, especially social media. Learn how military organizations can secure an advantage in this developing arena.


When you download a report, your information may be shared with the underwriters of that document.