China Wants Your Data — And May Already Have It

Feb 24, 2021
Originally published on February 24, 2021 3:16 pm

As COVID cases began to rise a year ago, a Chinese company contacted several U.S. states and offered to set up testing labs. As a byproduct, the Chinese firm, Beijing Genomics Institute, would likely gain access to the DNA of those tested.

The offer was tempting for states struggling to set up their own testing facilities for a new virus on short notice. But U.S. national security officials urged the states to reject the offer, citing concerns about how China might use personal data collected on Americans.

"We certainly reached out to our partners and the community to make sure people were aware that the Chinese were pushing out these tests, informing them of what the risks were and really asking them not to take these tests," said Mike Orlando, the head of the National Counterintelligence and Security Center, which is part of the Office of the Director of National Intelligence.

"As far as I know, they all turned them down," Orlando added.

Meanwhile, Beijing Genomics Institute, a major global player in the world of genomics research, reportedly set up labs in at least 18 other countries, and provided COVID testing kits to 180 nations, including the U.S. The U.S. officials stressed that their main concern was preventing the establishment of full-service labs. The officials do not consider the testing kits to pose a serious risk.

Biotech companies in China, the U.S. and elsewhere routinely collect DNA data and use it to help guide the development of cutting-edge medicines that can benefit people worldwide. And BGI says it abides by all the laws in countries where it operates.

However, human rights groups say the Chinese government uses DNA testing for security purposes — such as identifying and tracking Uigher Muslims, the ethnic and religious minority whose members are being held in detention camps, in huge numbers, in western China.

Chinese police are also working to gather DNA samples from the country's male population — numbering roughly 700 million — to help keep tabs on the half of the population most likely to commit crimes, The New York Times reported last year.

A sweeping effort

U.S. officials add that DNA collection by Chinese companies, even when done openly and legally, should be seen as part of a comprehensive effort to vacuum up millions and millions of records on U.S. citizens. And many Chinese efforts violate U.S. law, the officials say.

"Most Americans have probably had their data compromised by the cyber intelligence units of the Chinese government and Chinese military intelligence," said April Falcon Doss who worked at the National Security Agency and wrote the book Cyber Privacy:Who Has Your Data And Why You Should Care.

Falcon Doss said China is collecting detailed personal information on a massive scale for multiple reasons: to boost its economy, advance its technology and to support its espionage efforts.

"China has really set as one of its strategic goals, trying to achieve dominance in artificial intelligence," she said. "What you need to feed artificial intelligence algorithms is lots and lots and lots of data."

The U.S. and China both spy aggressively on each other. In recent years, one striking feature of this rivalry is China's pursuit of personal data on Americans.

Since 2014, China's been blamed for a series of huge data thefts. They include individual records taken from the credit agency Equifax (145 million records), the hotel chain Marriott (400 million), the health insurer Anthem (78 million), and the U.S. Office of Personnel Management (21 million), which stores sensitive files on government workers, including fingerprints and information on security clearances.

The Justice Department has filed charges against Chinese citizens in these and other cases, though most remain in China and beyond the reach of U.S. law enforcement. Some of those accused are serving in the Chinese military.

China's aim

China denies responsibility for these hacks. Still, Beijing acknowledges it wants to be a world leader in gathering big data, and using artificial intelligence to sort through it.

"If you look at the cyber hacks of our credit information, our travel information, and then you layer in the DNA information, it creates an incredible targeting tool for how the Chinese could surveil us, manipulate us and extort us," said Orlando, whose office keeps watch over attempts by foreign countries to spy on the U.S.

U.S. officials, past and present, say it's difficult to tell exactly how the Chinese may be using the hacked data. But they say the possibilities are limitless.

"It gives them tremendous access into who we are," said retired Army Gen. Keith Alexander, who led the National Security Agency under President Barack Obama.

The files from the Office of Personnel Management would help China identify U.S. intelligence officers.

Credit information from Equifax could flag people who have money problems and might be susceptible to spying for China in exchange for financial help.

Alexander said China could cross-reference the data to send a highly personalized phishing email to a person in a key U.S. tech industry that China hopes to exploit.

"So it says in a email that China sends to a specific individual, 'You have Type 2 diabetes. Here's a new Type 2 diabetes solution. Click here,'" said Alexander, who is now the president of the private firm IronNet Cybersecurity.

After gaining access to that person's email account, hackers could look for sensitive personal or company information.

The U.S. and China signed a 2015 agreement that said neither government would seek to steal intellectual property from private companies in the other nation. But Alexander said it had only a brief and limited impact on the Chinese hacking of U.S. companies. He said the ongoing theft of American technology and data has given China a huge economic lift, and inflicted great damage on the U.S.

"The Chinese need access to intellectual property to fuel that economic engine," he said. "That theft is the greatest transfer of wealth in history."

Greg Myre is an NPR national security correspondent. Follow him @gregmyre1.

Copyright 2021 NPR. To see more, visit https://www.npr.org.

MARY LOUISE KELLY, HOST:

When COVID hit last year, a Chinese company offered to set up testing labs in several U.S. states. U.S. officials urged the states to reject that offer, calling it part of a Chinese effort to build a DNA database on Americans. The U.S. says China is still pressing ahead with long-term plans in ways open and clandestine to collect personal data about Americans on a mass scale. NPR's Greg Myre has our story.

GREG MYRE, BYLINE: To put this simply, China wants your data.

APRIL FALCON DOSS: Most Americans have probably had their data compromised by the cyber intelligence units of the Chinese government and Chinese military intelligence.

MYRE: April Falcon Doss worked at the National Security Agency and wrote the book "Cyber Privacy." She says China is collecting detailed personal information on a massive scale to boost its economy, advance its technology and support its espionage efforts.

FALCON DOSS: China has really set as one of its strategic goals, trying to achieve dominance in artificial intelligence. And what you need to feed artificial intelligence algorithms is lots and lots and lots of data.

MYRE: In some instances, China pursues this strategy openly. With COVID cases on the rise last March, a company called Beijing Genomics Institute contacted several U.S. states. The company offered to set up COVID testing labs and as a byproduct, would get access to the DNA of those tested. Mike Orlando is head of the National Counterintelligence And Security Center.

MIKE ORLANDO: We certainly reached out to our partners and to the communities to make sure people were aware that the Chinese government were pushing out these tests, informing them of what the risks were and really ask them not to take these tests. As far as I know, they all turned them down.

MYRE: So it never happened. And it's important to note that biotech companies in both China and the U.S. routinely use DNA to work on cutting-edge medicines that can benefit people worldwide. However, human rights groups say China also uses DNA testing for security purposes, such as identifying and tracking Uighur Muslims, the minority group whose members are detained in camps in huge numbers in western China. And U.S. officials say any Chinese DNA collection should be seen as part of a comprehensive effort to vacuum up millions of personal records on U.S. citizens. Again, Mike Orlando.

ORLANDO: If you look at the cyber hacks of our credit information, our travel information and then you layer in the DNA information, it creates an incredible targeting tool from how the Chinese could surveil us, manipulate us and extort us.

MYRE: The U.S. and China both spy aggressively on each other. And in recent years, China's been blamed for a series of huge data thefts at the Marriott hotel chain, the Equifax credit agency and the Office Of Personnel Management, which stores sensitive files on government workers. China denies responsibility for these hacks. U.S. officials past and present say it's difficult to tell exactly how the Chinese may be using the hacked data, but they say the possibilities are limitless.

KEITH ALEXANDER: It gives them tremendous access to who we are.

MYRE: Retired Army General Keith Alexander led the National Security Agency under President Obama. Those files at the Office Of Personnel Management would help China identify U.S. intelligence officers. Credit information from Equifax could flag people who have money problems and might be susceptible to spying for China in exchange for cash. Alexander says China could cross-reference the data and send a highly personalized phishing email to a person in a key tech industry.

ALEXANDER: So that it says in a email that China sends to a specific individual, you have Type 2 diabetes. Here's a new Type 2 diabetes solution - click here.

MYRE: After gaining access, Chinese hackers could look for sensitive personal or company information. Alexander says the theft of American technology has given China a huge economic lift and inflicted great damage on the U.S.

ALEXANDER: They need access to intellectual property to fuel that economic engine. That theft is the greatest transfer of wealth in history.

MYRE: He says that theft is still taking place.

Greg Myre, NPR News, Washington. Transcript provided by NPR, Copyright NPR.