Hacker News Reader

Comment by Jerry2 | Hacker News Reader

From the article:

>The nine-count indictment alleges that Wu Zhiyong (吴志勇), Wang Qian (王乾), Xu Ke(许可) and Liu Lei (刘磊) were members of the PLA’s 54th Research Institute, a component of the Chinese military.

How were they identified exactly? I'm always fascinated with these DOJ indictments of foreign state actors but I'm always left wondering how they managed to narrow it down to a small group of people. I'm guessing that "PLA’s 54th Research Institute" employs thousands of people so how does the FBI/DOJ identify the culprits so precisely? Is it through CIA/NSA spying and moles inside the PLA?

You don't see foreign governments identifying individual NSA employees when the NSA hacks into something... so how does the DOJ do it?

View on HN

> How were they identified exactly? I'm always fascinated with these DOJ indictments of foreign state actors but I'm always left wondering how they managed to narrow it down to a small group of people.

My guess is they counter-hacked the PLA’s 54th Research Institute to identify the culprits, then used parallel construction for the indictment.

IIRC, the public intelligence report on the Russian 2016 election influence campaign revealed that the US had counter-hacked some of the Russian groups involved, and used the information gained from that as evidence to attribute the overall campaign to the Russians.

They've just named some names. These people might be associated with that "institute", but they're just as likely to be custodians or secretaries as hackers.

You didn't read the previous GRU indictments very closely. They got actual surveillance footage of individuals in the building.

On the "surveillance footage", were they mopping and sweeping? I wonder whether such "footage" constitutes prima facie evidence for an indictment going the opposite direction...

I remember your user name, you popped up in another thread about US/China, talked baseless anti-US conspiracies then left. Is there a reason you spend time out of your day to do this?

We rarely get to learn about sources and methods but here is a recent case where cameras in buildings were hacked.

https://nos.nl/nieuwsuur/artikel/2213767-dutch-intelligence-...

They are guessing.

The case will never go to court. The DOJ knows it so they don't have to have actual evidence.

The indicment is being publicised for political reasons.

You are guessing that they are guessing, and don't in fact know that. Your opinion has the right to exist, but I'll choose to believe that they identified actual military intelligence officers using methods they're not going to tell us about, to send a strong message to China (whether these specific officers are guilty of these specific offences is immaterial, the outing itself is the message).

Other than potentially exposing sources and methods what do they gain exactly? They aren't going to Beijing to arrest them, and only legal indictments aren't(and haven't) going to scare off China.

I am pretty sure this one is for domestic consumption.

The Chinese are a bogeyman comparable to the Russians. Being tough on them and have the other party being in bed with them is something that is surely useful in a coming election campaign.

As for the ability to trace back traffic sent through 30+ computers placed around the world including China; just think of what surveillance and logging that would entail. It is not really possible.

>You don't see foreign governments identifying individual NSA employees when the NSA hacks into something...

See my mysteriously flagged comment demonstrating exactly this https://news.ycombinator.com/item?id=22290767

Of course, we don’t know who TSB were. But it’s not like individual NSA hackers have gone unidentified.

Your flagged comment can't be read by anyone but you and the moderators: https://i.imgur.com/L7tL23M.png

Go to your profile, set “showdead” to yes.

Its an allegation not a conviction. It’s not like anyone from China’s going to appear in US court to make a defense.

What if China says “we’re sending you a plane with the four individuals you are after. We insist on their innocence and want to see a fair and public trial”

Then DOJ would have to reveal their sources, wouldn’t they?

If Iran made such an accusation against 4 NSA employees, that were actually innocent, do you think that those 4 people would ever be handcuffed, and put on a flight to Iran?

Of course not, that would be idiotic, and horrible for morale. You don't give your own people up, regardless of whether or not they are innocent or guilty.

As such, this is a spherical cow thought experiment. To address it - it's quite likely that the sources would not be revealed in an open trial, due to the catch-all of national security. For a helping of double irony, the sources are likely the product of... Espionage (Digital or otherwise).

Sure, but the US can actually try foreign military officers somewhat fairly. Almost no country in the world can accomplish that, other than perhaps the UK and Canada.

How about Germany, France, Belgium, The Netherlands, etc?

Why would you claim that? If anyone can try them fairly, that would be a neutral third party, maybe Switzerland.

Also consider how US treats 'threats to national security' - Chelsea manning, indefinite detention in Guantanamo bay, etc.

It doesn't matter if the trial is going to be fair or not. Doing this is the worst kind of betrayal that a military can commit against a soldier.

This is also why the US is not even a signatory of the ICC. It, by principle, opposes the sheer notion of Americans facing international trials for war crimes, even in impartial, third party courts. There's no way in hell it would extradite its spies to face trials for computer crimes.

It's arguments for not participating in the ICC are that the trials would be political, and not impartial. That's a stick with two ends.

Given that almost none have ever tried, what would you base your opinion on. As in, what facts?

Or drop charges. This is clearly a what-if that's been taken into account, the implication being that these people either are in fact military intelligence or otherwise very valuable, or don't exist at all.

What they've done in the past [0], is continually to delay the actual trial. The idea is to force the defendants either to avoid setting foot in the jurisdiction or to spend their entire net worth on defense attorneys.

[0] https://www.law.com/nationallawjournal/2019/09/16/were-now-o...

My first thought was that American spies must have infiltrated the PLA's 54th Research Institute, or infiltrated some branch of the chinese government that was privy to that information at least.

Which is pretty ironic, really. Whoever did the hacking for the US could be charged by China for basically the same thing the DOJ just charged the Chinese hackers for.

The military is a much more legitimate target than a credit agency

I imagine the process is similar to how these guys [1] exposed Chinese APT hackers but with access to better tools and intelligence.

[1] https://twitter.com/intrusion_truth

Forensics. Attackers use and sometime re-use domains, ips and code to recon, attack and exfil data. Those items may have been used before. All the attributes related to each of those items are cross referenced. You might find a server in this breach was associated with an email address that was used to register a domain in the current breach. That email now loosely ties the two breaches and actors together.

I don't know about where you work, but the people who register domains aren't typically the people who use them.

Did the DOJ just indict a bunch of procurement people? ;-)

Read this: https://intrusiontruth.wordpress.com/

How were they identified exactly?

If they made it public, they could never do it again.

You don't see foreign governments identifying individual NSA employees when the NSA hacks into something...

I suspect that it does happen, but most people don't know about it because that requires knowing another language, and then regularly keeping up with the media of another country in that language.

I'm guessing part of the reason they're willing to ID them is because the DOJ knows this will never actually get to court where they'd have to explain how they found them.

Seems likely. I wouldn't be suprised if it was done as a way to get them put on watchlists in all western countries without having to officially reveal any sources or methods.

Reply on news.ycombinator.com