In October 2011, in a report to Con

In October 2011, in a report to Congress by the Office of the National Counterintelligence
Executive, national security officials concluded that foreign collectors of sensitive economic
information are able to operate in cyberspace with relatively little risk of detection by their
private sector targets. The proliferation of malicious software, prevalence of cybertool
sharing, use of hackers as proxies, and routing of operations through third countries make
it difficult to attribute responsibility for computer network intrusions. Cybertools have
enhanced the economic espionage threat, and the Intelligence Community (IC) judges the
use of such tools is already a larger threat than more traditional espionage methods.

The threat comes from adversaries as well as partners. Allegedly, according to American
and European media and governments, Chinese actors are the world’s most active and
persistent perpetrators of economic espionage. U.S. private sector firms and cybersecurity
specialists have reported an onslaught of computer network intrusions that have originated
in China, but the intelligence community cannot definitively confirm who is responsible
because of the possibility that the attacks originate elsewhere but use compromised
Chinese computers to implement the attacks. Russia’s intelligence services come in second
place. They are also conducting a range of activities to collect economic information and
technology from U.S. targets. In addition, some U.S. allies and partners use their broad
access to U.S. institutions to acquire sensitive U.S. economic and technology information,
primarily through aggressive elicitation and other human intelligence (HUMINT) tactics.