Data hacked from U.S. government dates back to 1985

It could boil down to having other intelligence fingering China, but the US doesn't want to expose and consequently draw attention to the source of the information.

If the US doesn't have some 99.9999% assurance it was China and they made a statement like that with egg still on their face from the breach, it's pretty sad. I don't rule it out, but the US probably has more common sense than that. From a technical perspective, it sure was a fast "investigation".

Its 100% politics.

Also this attack happened last December. The scope of the breach was not fully known until April when some deeper penetration was found then the reports in December initially indicated. The sad thing is this attack could have easily been prevented by using PGP signatures in emails (it was a phishing attack method) but the defense/government is incapable of implementing this

Based on the Snowden files, it seems completely plausible that the US has the capability to determine the origin of the hack. Of course, we all know that having a Chinese IP is not proof of origin, but what about network flows? The NSA has sensors all over the world analyzing traffic. They even have a limited history they can query. What if they could determine the endpoint of the data and see that there was nothing connected to that endpoint at the same time, sending the same amount of traffic (using it as a proxy). You might think this would be extremely hard, since there is so much data on the net, but if they had some implants on some routers watching a particular hotspot, they could reasonably make the determination that the attack originated from fingers on a keyboard there.

And let's talk about implants. The NSA has installed malware in China, we can agree on that, right? So if they can see that a known Chinese dumpsite has the stolen data, it's pretty obvious that China was involved somehow. Maybe they have hard drive firmware that constantly scans drives for particular strings and when found, it calls home. Inside the stolen data files were some of those strings.

With all the money spent on the NSA's infrastructure and the stakes involved in agitating a powerful nation, it stands to reason that they have made proper attribution a high priority. These guys aren't just looking at source IPs in a pcap and calling it a day.

This case would not be "99.9% of these cases." It is not quite the same as, for example, the attack on Sony. The main differences are: 1) attack targets intelligence, rather than IP 2) target is US government, rather than private sector company 3) attack targets government infrastructure, rather than corporate infrastructure. I think that in this case the US likely has more resources at its disposal for analyzing the attack than, for example, it could use after the Sony attack, so a quick response is predictable. I also see no reason to doubt China as a possible culprit, as they certainly have both the capability and motivation for this attack.

Anyone who has worked on cases involving APT from known foreign actors can identify common TTPs and attempt a best guess at the group involved.

I do. people predict it (this sort of timing), we all laugh it off, and then it happens anyway!

I do. Not only the timing of the Patriot Act expiration but also the recent NY Times/Snowden story (in which the government specifically cited state-sponsored cyber attacks as justification for mass surveillance). I read somewhere the actual breach was detected a month or two ago, so it doesn't seem that unreasonable they planned the announcement to coincide with the NY Times story and/or the Patriot Act end date.

Also on all the cyber crimes I have a hard time believing anything. Definitely China's attacking us and we're attacking them, but on specific instances, we're never shown any proof at all. What are we to believe? And then I hear people asking about when a cyber attack constitutes an act of war. My god, I hope we don't go to war again on evidence that is unverified. And hopefully the media learned to be more skeptical of government claims after that whole Iraq WMD story, but it doesn't seem like it.

I'm not clear how the Patriot Act (if that's the "something" you mention) has anything to do with a state-sponsored advanced persistent threat. Can you explain?

That's an SF-86. You fill that out for clearances as low as Secret. The bar for a Secret is roughly "Are you blackmailable? No? Here's your clearance.". You can ship Secret material through the USPS if you ship it as registered mail. There's no need to hand-carry it.

There are many, many things that are classified as Secret that are either overclassified, are classified as such to cover someone's ass or prevent embarrassment. Secret material can be sensitive stuff, but should never be serious spy shit. If it is, someone seriously fucked up their classification guide.