The latter.

Likely both. I'm no expert in this domain, but from my perspective, due to the nature of cyber warfare, it's all but impossible to have any kind of concrete evidence or smoking gun. Cyber security firms are deliberately very careful in levelling specific accusations with the lack of concrete evidence.

For example, researchers at Malwarebytes [1] say:

> "While this supports the thesis of APT10 being a government threat group, we caution defenders against associating any one piece of malware exclusively with one group. Countries maintain multiple threat groups, all of whom are fully capable of collaborating and sharing TTPs."

> "Variants of PlugX and Poison Ivy were developed and deployed by Chinese state-sponsored actors. They have since been sold and resold to individual threat actors across multiple nations. At time of writing, it is inappropriate to attribute an attack to Chinese threat actors based on PlugX or Poison Ivy deployment alone."

Likewise, the report put out by PwC and BAE [2] label APT10 only as a "China-based actor". They cite things like attacks occurring during Chinese timezones and CCP-interest aligned hacking as evidence. This is all great circumstantial evidence and while compelling, it is far from conclusive. The report does not mention the Chinese Ministry of State Security even once.

We can say how likely or unlikely something is, but the likelihood of something in the context of circumstantial evidence should not be taken as a full-on indictment. The most one could say conclusively is that it is likely to be state sponsored.

[1] https://blog.malwarebytes.com/cybercrime/2019/01/advanced-pe...

[2] https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report...

You’re making a distinction between cyber industrial espionage and cyber geopolitical espionage and I’m not. I would classify all of these actions under the broad umbrella of cyber warfare. In this context, the OP’s assertion that Europe and the U.S need to “join the hard line on China” is based on the fundamentally flawed assumption that the EU and the U.S are simply innocent victims of cyber attacks. It implies that they, as pure, liberal and democratic as they are, have never, and would never engage in such reprehensible and illegal activities as hacking, unlike the big bad evil Chinese. It is my view that this is an untenable and fundamentally flawed position.

> I can't think of anywhere else in the world where this is not only routine, but coordinated at massive scale. Can you inform me what I'm missing?

Why would you need me to inform you about something that I’ve never claimed? My claim is that nobody’s hands are clean when it comes to cyber warfare, not that China has never before engaged in the type of espionage you describe.

> Edit: I disagree with your last point too. There's been plenty of reporting on Chinese IP theft dating back years, it's only increased in prominence. Trump is waging the trade war partially because of the history of hacking. It was a point of contention throughout Obama's admin too, but Trump is handling it his way. (Obama's answer was TPP, but deployed too late)

I’ve addressed the industrial espionage point above. As far as the trade war: Trump is waging his trade war because of the trade imbalance between the U.S and China as he has repeated ad nauseam since day one. There was a particular point in time (probably around the time of the as-of-yet unsubstantiated and unretracted Bloomberg Supermicro story) where the hacking narrative was retroactively shoehorned in as a reason. I stand by my opinion that the timing of this report, along with the other recent mountains of anti-China mainstream media stories and social media posts, is highly suspect.

> I call these companies "state-controlled" because they are ultimately susceptible to the authoritarian central government's will.

If the companies are susceptible to the government's will, then attacks against the government would also be attacks on the companies. Defense and recovery against geopolitical espionage diverts resources away from those companies. Why is the drain on profit industrial espionage causes a problem while a drain on resources is acceptable?

Can anyone explain the popularity and persuasiveness of "whataboutism"?

If "To be fair, isn't this functionally equivalent to the NSA attacks on Huawei and Chinese aircraft manufacturers over the past decade" is indeed a logically valid comparison, is that not a perfectly valid rebuttal to ~scare mongering accusations of "state sponsored attacks" from China? It doesn't nullify it, but it puts it in accurate perspective, no? And should not accuracy be an important part of such conversations?