China is seeking ways to disrupt daily American life should a conflict erupt, Pentagon’s IT leader says

BALTIMORE–The Defense Department’s IT agency is shoring up the military’s infrastructure to better withstand attacks as China looks for ways to disrupt everyday life in the United States during a conflict, Lt. Gen. Robert Skinner said Wednesday. 

“That is a key objective for the PRC: to make sure that they can disrupt our day-to-day life,” said Skinner, who leads the Defense Information Systems Agency. “They will want to look at: ‘How can we disrupt, not just militarily, but from an information standpoint, and from our day-to-day lives?’ To see: ‘Is the will there, as a nation, to continue on with whatever kind of conflict is going?’”

Skinner said that China’s “risk tolerance continues to change”—meaning that Beijing is willing to go further in its offensive cyber and space operations. 

He echoed other government leaders and China experts, who have pointed to the Volt Typhoon campaign aimed at critical infrastructure around the world. Similarly, a new report from cybersecurity group Recorded Future and Sentinel Labs notes that China is launching more ransomware attacks at infrastructure and civilian entities, an escalation from past years’ espionage and data theft efforts. Another new report, from RAND, says China is likely to launch riskier attacks on space communications and other areas as well. 

One reason Chinese leaders are willing to take more risks is that their space-sensing capabilities are growing, enabling them to keep a closer eye on U.S. military and other forces, the RAND report said.

“The PLA of 2020 and beyond is more likely to undertake coercive activities and accept the risk of escalation with the United States than it was a decade prior. Although this more risk-accepting mindset was most visible in domains other than space, future PLA space operations could follow the same trend, particularly as Chinese space capabilities evolve,” the report said. 

Skinner said China is carefully watching DISA  to see how the agency strengthens the military’s IT infrastructure.  As evidence, he displayed a slide from a DISA presentation on new network architecture schemes that had been translated into Chinese “for internal use,” but kept the same graphic. 

He said the agency is trying to improve Pentagon defenses by using data from across the department.

Much of the Pentagon’s plans to improve its network defenses rest on the move to cloud services, such as Amazon Web Services, Google, and Microsoft Azure. The thinking is that enterprise cloud gives network administrators a much better window into what’s going on with every computer in the network. 

But enterprise cloud, and the companies that provide it, aren’t perfect—as shown in an April report from the Cyber Safety Review Board that called Microsoft’s security culture “inadequate” and said the company “deprioritized both enterprise security investments and rigorous risk management,” producing “avoidable errors.”

Skinner did not address the report directly upon being asked. But he did say “going to enterprise cloud does provide greater security opportunity and greater safety.”

Still, “at the end of the day, it still has to be configured correctly, still has to be operated, maintained correctly…So some things that we're working through with [enterprise cloud providers] is first and foremost is on contracts, making sure that the contracts identify the specific standards and know and make sure that they meet and also that the contracts identify and allow us to have visibility into their cybersecurity posture,” he said. “The third piece is making sure we continue to highlight to the vendors and commercial companies that they do need to take it seriously, from the CEO on down to the person who's doing the actual changing of configurations or designing the capabilities.”