Chinese Regime Rushes to Destroy Files Overseas

Posted on August 19, 2020August 19, 2020 by Denise Simon

In part: The Chinese Communist Party (CCP) has directed certain overseas Party cells to destroy sensitive documents and safeguard Party secrets, in response to heightened scrutiny in the West of the regime’s covert activities abroad, an internal document obtained by The Epoch Times reveals.

A notice issued in August by China’s state-owned oil giant China National Petroleum Corporation (CNPC) instructed that the company’s overseas offices in more than ten countries, including Australia and Canada, must “urgently destroy or transfer sensitive documents” relating to “overseas Party-building activities.”

China National Petroleum Corporation - Barco source

Party-building activities overseas, according to New York-based China commentator Qin Peng, refers to the CCP’s efforts to expand its global influence. Under this program, Chinese consulates can instruct Chinese multinational companies to carry out tasks beyond their business operations, such as collecting intelligence, stealing sensitive information, and influencing local officials, he said.

The notice said that important documents that can’t be easily destroyed may be given to the Chinese embassy in Cambodia for safekeeping.

It also directs the company’s Party members not to divulge sensitive information to local law enforcement.

“When subject to foreign investigations, Party members and cadres must abide by [the principle of] ‘strictly guarding Party secrets,’” the document said. “This is an iron rule and discipline.”

The directive was a response to recent actions by the United States and other Western governments, the document said, citing an incident in Australia where authorities searched and seized mobile phones and computers of Chinese diplomatic personnel because they contained material relating to the CCP. It did not provide further detail about this incident.

The United States has in recent months escalated efforts in combating Chinese espionage and malign influence activities. The Trump administration in July ordered the closure of the Chinese consulate in Houston, saying the diplomatic outpost was a “hub of spying and intellectual property theft.” Federal agents also made a string of arrests of suspected undercover Chinese military officers studying in the country, who prosecutors say are part of a broader network spanning 50 U.S. cities.

The regime’s covert foreign influence operations have also come under the spotlight in many democracies, particularly in Australia, where the government has stepped up actions targeting Chinese influence in politics and university campuses.

Nicholas Eftimiades, a former senior U.S. intelligence official and author of the book “Chinese Intelligence Operations,” told The Epoch Times that the incident in Australia may have referred to an unreported seizure by border officials at the country’s ports of entry, or the recent raid of a Chinese-Australian’s home as part of an investigation into Chinese foreign interference.

Going Underground

The notice said the United States, the U.K., Australia, Canada, and New Zealand were “highly sensitive countries,” and directed staff in those countries to delete all Party-building materials from electronic devices and destroy physical files. Where documents can’t be destroyed, they should be “sealed and stored” in a secure location or handed over to the Chinese embassy in Cambodia, the document instructed.

In Australia and Canada, CNPC staff are to report to their local Chinese consulate the status of how they have dealt with “sensitive urgent information,” the notice said.

The document also demands that all the company’s overseas party organizations, particularly those located in Malaysia, Singapore, and Saudi Arabia, should “proactively accept the leadership role of the Party committee at Cambodia’s Chinese embassy.”

The instructions also emphasized limiting public exposure of overseas Party activities. It prohibited events from being promoted on Chinese social media such as Weibo and WeChat, and issuing public reports of such activities. Communications about Party members or organizations, and reports on Party-building activities should be sent via encrypted channels. Party members were also banned from raising the Chinese national flag, wearing the Party badge, and displaying the content of Party activities on notice boards.

Chinese diplomats return from Houston consulate shut by US ...

In addition, when holding Party-building activities, staff are not to disclose the identities of Party members and their Party positions, the notice said.

‘Damage Control’

Eftimiades said that it’s very likely this directive was issued to other state-owned enterprises. The notice, he said, revealed an “extraordinary global operation to protect information, to restrict activities so that they don’t come up on the radar of foreign governments.”

James Carafano, vice president of the Heritage Foundation’s institute for national security and foreign policy, said this move would not be surprising given that the regime is likely anticipating much more scrutiny from Western countries.

“If there’s one thing they’re really good at, it’s covering up their tracks,” Carafano told The Epoch Times.

The notice also reveals the close cooperation between the regime and state-owned companies, Eftimiades said.

“A huge dimension of this is the role of the consulates in directing and coordinating the activities of state-owned enterprises abroad,” he said.

The Chinese regime also publicly reveals how Chinese consulates preside over overseas Chinese companies.

A document on “risk prevention guidelines” for overseas Chinese companies, found on the website of China’s Ministry of Foreign Affairs, points out that companies must register with their local consulates and accept their “guidance and management.”

In the event of sudden “safety-related incidents,” Chinese companies must do their public relations under the guidance of corresponding consulates and related Chinese agencies, to “positively guide the public opinion.”

In March 2019, Qi Yu, secretary of the Party committee at China’s Ministry of Foreign Affairs, held a meeting, during which the committee said Chinese consulates should “enhance their political understanding…in order to better serve” the Party.

While the document suggests the CCP has become more cautious, countries shouldn’t let up their guard, Qin warns, adding that as these activities go underground, the Chinese regime is likely to engage in more covert actions, and it’s a long-term threat that countries shouldn’t dismiss.

N. Korea has 60 Nuclear Bombs, 5000 tons of Chemical Weapons

Posted on August 19, 2020August 19, 2020 by Denise Simon

An Army report has the following information in part regarding North Korea:

A new assessment made by the United States Department of the Army estimates that the North Korean regime is in possession of massive amounts of conventional and non-conventional weapons that they are “highly likely” to use in specific circumstances, according to the Yonhap News Agency.

The assessment was published in a report entitled “North Korean Tactics,” and attributes North Korea’s huge armaments program to a desire to “prevent other countries from contemplating regime change.” Apparently, Kim Jong-un, the North Korean dictator, took note of what happened to his Libyan counterpart Muammar Gaddafi and “does not want something similar to happen” to him. (Gaddafi was killed by rebel Libyan forces, after a multi-national force including NATO countries attacked Libya with the stated goal of imposing an arms embargo, sanctions, and an assets freeze against regime leaders.)

According to the report, North Korea already has between 20 and 60 nuclear bombs and “the capacity to produce six new devices each year.” It also boasts the world’s third-largest stockpile of chemical weapons – between 2,500 and 5,000 tons of various substances – and is engaged in research into biological warfare as well. “Only one kilogram of anthrax could kill up to 50,000 people in Seoul,” the capital of South Korea, the report’s authors note.

Another ongoing source of concern is North Korea’s Cyber Warfare Guidance Unit, which employs over 6,000 computer hackers who “can successfully conduct invasive computer warfare activities from the safety of its own territory.” North Korean operatives are known to already be operating in several foreign countries including Belarus, China, India, Malaysia, and Russia.

Negotiations between the United States and North Korea broke down entirely following an unproductive summit between Kim Jong-un and US President Donald Trump in February, 2019.

Further details in the report to Congress includes:

North Korea’s military “uses tactics based on former Soviet or current Russian doctrine, Chinese developments, lessons learned, and observation of recent military actions,” according to a new US Army manual on the subject.

“While North Korea maintains large amounts of military equipment, much of it is outdated making it quantitatively superior to most armies but qualitatively inferior,” the new manual said. See North Korean Tactics, Army Techniques Publication (ATP) 7-100.2, 24 July 2020.

But North Korea has proved resourceful in other areas, including offensive cyber warfare.

“The primary organization responsible for computer warfare in North Korea is Bureau 121, which fielded at least 1,000 elite hackers in 2010 who focused on other countries’ computer systems. This number is likely much higher now” and includes “cyberspace teams [deployed] in foreign countries.”

And not least of all, “The country’s possession of a nuclear arsenal and its pursuit of missile technology are attempts to ensure that external powers do not interfere with its internal affairs for fear of a nuclear reprisal,” the Army manual said.

“North Korea is constantly adapting and evolving its capabilities,” the Army said.

***

Formed in the late 1990s, Bureau 121 is unit 121 of the General Bureau of Reconnaissance in North Korea’s military. (now made up of 6000 hackers)

Part of the unit is sometimes known as the DarkSeoul Gang, according to a report by Reuters.

Despite being one of the poorest countries in the world, North Korea puts a lot of its cash into Bureau 121.

North Korea is still technically at war with South Korea and cyber-warfare is arguably its best weapon. Coming from a defector in 2015, more details were provided to the BBC.

There is an official training school for the younger hacking applicants.

North Korea's Bureau 21 cyber-warriors trained up for ... source

Students sent to the Military school after graduating from Geumseong Middle School in the capital. A report into the cyber threat written by US Major Steve Sin in 2009 revealed Unit 121 had a base in Chilbosan Hotel, in Shenyang, China, from where could launch its attacks.The 164-room three star hotel – which is jointly owned by the North Koreans and Chinese. More details here.

Hat tip to NSA FBI for Cracking Drovorub

Posted on August 14, 2020August 14, 2020 by Denise Simon

The National Security Agency and the FBI are jointly exposing malware that they say Russian military hackers use in cyber-espionage operations.

Hackers working for Russia’s General Staff Main Intelligence Directorate’s 85th Main Special Service Center, military unit 26165, use the malware, which the Russians themselves call “Drovorub,” to target Linux systems, the NSA and FBI said Thursday in a detailed report.

The hackers, also known as APT28 or Fancy Bear, allegedly hacked the Democratic National Committee in 2016 and frequently target defense, government, and aerospace entities. The Russian military agency is also known as the GRU.

FBI e NSA descobrem novo malware Linux chamado Drovorub ...

While the alert does not include specific details about Drovorub victims, U.S. officials did say they published the alert Thursday to raise awareness about state-sponsored Russian hacking and possible defense sector vulnerabilities. The disclosure comes just months before American voters will conduct a presidential election.

“Information in this Cybersecurity Advisory is being disclosed publicly to assist National Security System owners and the public to counter the capabilities of the GRU, an organization which continues to threaten the United States and U.S. allies as part of its rogue behavior, including their interference in the 2016 U.S. Presidential Election,” the NSA and FBI said in the report.

The U.S. intelligence community has assessed that multiple foreign governments may “seek to compromise our election infrastructure.” It was not clear if the Russian hackers were using Drovorub malware in any ongoing interference efforts related to the 2020 presidential elections.

The NSA and FBI urged national security personnel, including the U.S. Department of Defense, to be on the alert for Drovorub attacks.

“The malware represents a threat because Linux systems are used pervasively throughout National Security Systems, Department of Defense, and the Defense Industrial Base,” the statement said. “All stakeholders should take action as appropriate.”

The announcement comes nearly one year after the NSA stood up a new cybersecurity directorate aimed at sharing more adversary threat intelligence with the public, and in recent weeks the NSA has worked to expose a spate of Russian campaigns, including Russian hackers’ efforts to target coronavirus research.

Senior Vice President of Intelligence at CrowdStrike, Adam Meyers, told CyberScoop the release shows these hackers are not easily deterred.

“Most importantly it demonstrates that FANCY BEAR has more tools and capabilities that are still being identified. This actor didn’t pack up and go home, they still have tricks up their sleeve,” Meyers told CyberScoop, adding that the news should raise alarm bells about Linux security. “Another important take away is that Linux is an area that organizations need to keep in mind from a malware perspective, many have not invested in similar security tools for this platform as they have for user platforms.”

Attacks employing Drovorub may be linked with previous Russian military efforts against connected devices, according to the NSA and the FBI. An APT28 attack that Microsoft security researchers identified last year against devices such as an office printer or a VOIP phone, for instance, was linked with an IP address that has also been used to access the Drovorub command and control IP address, the NSA and FBI said.

In such attacks, the hackers appeared interested in exploiting so-called internet of things devices in order to gain access to broader networks, other insecure accounts, and sensitive data, according to Microsoft.

The joint NSA and FBI release also has the effect of alerting the Russian government that U.S. officials are capable of tracking some of their work. The 780th Military Intelligence Brigade, which currently works with the Pentagon’s offensive cyber arm, Cyber Command, tweeted information out about the malware, and tagged a state-funded media outlet, RT, to flag the news for them.

The Drovorub malware consists of several components, the NSA and the FBI said, including an implant, a kernel module rootlet, a file transfer tool, and an attacker-controlled command and control server.

“When deployed on a victim machine, the Drovorub implant (client) provides the capability for direct communications with actor-controlled C2 infrastructure; file download and upload capabilities; execution of arbitrary commands as ‘root’; and port forwarding of network traffic to other hosts on the network,” the NSA and FBI said.

More detail for zdnet:

“Technical details released today by the NSA and FBI on APT28’s Drovorub toolset are highly valuable to cyber defenders across the United States.”

To prevent attacks, the agency recommends that US organizations update any Linux system to a version running kernel version 3.7 or later, “in order to take full advantage of kernel signing enforcement,” a security feature that would prevent APT28 hackers from installing Drovorub’s rootkit.

The joint security alert [PDF] contains guidance for running Volatility, probing for file hiding behavior, Snort rules, and Yara rules — all helpful for deploying proper detection measures.

Some interesting details we gathered from the 45-page-long security alert:

The name Drovorub is the name that APT28 uses for the malware, and not one assigned by the NSA or FBI.
The name comes from drovo [дрово], which translates to “firewood”, or “wood” and rub [руб], which translates to “to fell”, or “to chop.”
The FBI and NSA said they were able to link Drovorub to APT28 after the Russian hackers reused servers across different operations. For example, the two agencies claim Drovorub connected to a C&C server that was previously used in the past for APT28 operations targeting IoT devices in the spring of 2019. The IP address had been previously documented by Microsoft.

Seizure of Three Terror Finance Cyber-Enabled Campaigns

Posted on August 13, 2020August 13, 2020 by Denise Simon

Global Disruption of Three Terror Finance Cyber-Enabled Campaigns

Largest Ever Seizure of Terrorist Organizations’ Cryptocurrency Accounts

The Justice Department today announced the dismantling of three terrorist financing cyber-enabled campaigns, involving the al-Qassam Brigades, Hamas’s military wing, al-Qaeda, and Islamic State of Iraq and the Levant (ISIS). This coordinated operation is detailed in three forfeiture complaints and a criminal complaint unsealed today in the District of Columbia. These actions represent the government’s largest-ever seizure of cryptocurrency in the terrorism context.

These three terror finance campaigns all relied on sophisticated cyber-tools, including the solicitation of cryptocurrency donations from around the world. The action demonstrates how different terrorist groups have similarly adapted their terror finance activities to the cyber age. Each group used cryptocurrency and social media to garner attention and raise funds for their terror campaigns. Pursuant to judicially-authorized warrants, U.S. authorities seized millions of dollars, over 300 cryptocurrency accounts, four websites, and four Facebook pages all related to the criminal enterprise.

Funds successfully forfeited with a connection to a state sponsor of terrorism may in whole or in part be directed to the United States Victims of State Sponsored Terrorism Fund (http://www.usvsst.com/) after the conclusion of the case.

“It should not surprise anyone that our enemies use modern technology, social media platforms and cryptocurrency to facilitate their evil and violent agendas,” said Attorney General William P. Barr. “The Department of Justice will employ all available resources to protect the lives and safety of the American public from terrorist groups. We will prosecute their money laundering, terrorist financing and violent illegal activities wherever we find them. And, as announced today, we will seize the funds and the instrumentalities that provide a lifeline for their operations whenever possible. I want to thank the investigators from the Internal Revenue Service, Department of Homeland Security, Federal Bureau of Investigation, and the prosecutors from the D.C. United States Attorney’s Office and National Security Division for their hard and innovative work in attacking the networks that allow these terrorists to recruit for and fund their dangerous actions.”

“Terrorist networks have adapted to technology, conducting complex financial transactions in the digital world, including through cryptocurrencies. IRS-CI special agents in the DC cybercrimes unit work diligently to unravel these financial networks,” said Secretary of the Treasury Steven T. Mnuchin. “Today’s actions demonstrate our ongoing commitment to holding malign actors accountable for their crimes.”

“The Department of Homeland Security was born after the September 11, 2001 terrorist attacks and, nearly 20 years later, we remain steadfast in executing our critical mission to safeguard the American people, our homeland, and our values,” said Acting Secretary of Homeland Security Chad F. Wolf. “Today’s announcement detailing these enforcement actions targeting foreign terrorist organizations is yet another example of the Department’s commitment to our mission. After launching investigations that identified suspected online payments being funneled to and in support of terrorist networks, Homeland Security Investigations skillfully leveraged their cyber, financial, and trade investigative expertise to disrupt and dismantle cyber-criminal networks that sought to fund acts of terrorism against the United States and our allies. Together with our federal law enforcement partners, the Department will utilize every resource available to ensure that our Homeland is and remains secure.”

“These important cases reflect the resolve of the D.C. United States Attorney’s Office to target and dismantle these sophisticated cyber-terrorism and money laundering actors across the globe,” stated Acting United States Attorney Michael R. Sherwin. “While these individuals believe they operate anonymously in the digital space, we have the skill and resolve to find, fix and prosecute these actors under the full extent of the law.”

“IRS-CI’s ability to trace funds used by terrorist groups to their source and dismantle these radical group’s communication and financial networks directly prevents them from wreaking havoc throughout the world,” said Don Fort, Chief, IRS Criminal Investigation. “Today the world is a safer place.”

“As the primary law enforcement agency charged with defeating terrorism, the FBI will continue to combat illicit terrorist financing regardless of platform or method employed by our adversaries,” said FBI Director Christopher Wray. “As demonstrated by this recent operation, the FBI remains committed to cutting off the financial lifeblood of these organizations that seek to harm Americans at home and abroad.”

“Homeland Security Investigations continues to demonstrate their investigative expertise with these enforcement actions,” said ICE Deputy Director and Senior Official Performing the Duties of the Director Matthew T. Albence. “Together with law enforcement partners, HSI has utilized their unique authorities to bring to justice those cyber-criminal networks who would do us harm.”

Al-Qassam Brigades Campaign

The first action involves the al-Qassam Brigades and its online cryptocurrency fundraising efforts. In the beginning of 2019, the al-Qassam Brigades posted a call on its social media page for bitcoin donations to fund its campaign of terror. The al-Qassam Brigades then moved this request to its official websites, alqassam.net, alqassam.ps, and qassam.ps.

The al-Qassam Brigades boasted that bitcoin donations were untraceable and would be used for violent causes. Their websites offered video instruction on how to anonymously make donations, in part by using unique bitcoin addresses generated for each individual donor.

However, such donations were not anonymous. Working together, IRS, HSI, and FBI agents tracked and seized all 150 cryptocurrency accounts that laundered funds to and from the al-Qassam Brigades’ accounts. Simultaneously, law enforcement executed criminal search warrants relating to United States-based subjects who donated to the terrorist campaign.

With judicial authorization, law enforcement seized the infrastructure of the al-Qassam Brigades websites and subsequently covertly operated alqassam.net. During that covert operation, the website received funds from persons seeking to provide material support to the terrorist organization, however, they instead donated the funds bitcoin wallets controlled by the United States.

The United States Attorney’s Office for the District of Columbia also unsealed criminal charges for two Turkish individuals, Mehmet Akti and Hüsamettin Karataş, who acted as related money launderers while operating an unlicensed money transmitting business.

Al-Qaeda Campaign

The second cyber-enabled terror finance campaign involves a scheme by al-Qaeda and affiliated terrorist groups, largely based out of Syria. As the forfeiture complaint details, these terrorist organizations operated a bitcoin money laundering network using Telegram channels and other social media platforms to solicit cryptocurrency donations to further their terrorist goals. In some instances, they purported to act as charities when, in fact, they were openly and explicitly soliciting funds for violent terrorist attacks. For example, one post from a charity sought donations to equip terrorists in Syria with weapons:

Undercover HSI agents communicated with the administrator of Reminder for Syria, a related charity that was seeking to finance terrorism via bitcoin donations. The administrator stated that he hoped for the destruction of the United States, discussed the price for funding surface-to air missles, and warned about possible criminal consequences from carrying out a jihad in the United States.

Posts from another Syrian charity similarly explicitly referenced weapons and extremist activities:

Al-Qaeda and the affiliated terrorist groups together created these posts and used complicated obfuscation techniques, uncovered by law enforcement, to layer their transactions so to conceal their actions. Today’s complaint seeks forfeiture of the 155 virtual currency assets tied to this terrorist campaign.

ISIS Campaign

The final complaint combines the Department’s initiatives of combatting COVID-19 related fraud with combatting terrorism financing. The complaint highlights a scheme by Murat Cakar, an ISIS facilitator who is responsible for managing select ISIS hacking operations, to sell fake personal protective equipment via FaceMaskCenter.com (displayed below)

The website claimed to sell FDA approved N95 respirator masks, when in fact the items were not FDA approved. Site administrators claimed to have near unlimited supplies of the masks, in spite of such items being officially-designated as scarce. The site administrators offered to sell these items to customers across the globe, including a customer in the United States who sought to purchase N95 masks and other protective equipment for hospitals, nursing homes, and fire departments.

The unsealed forfeiture complaint seized Cakar’s website as well as four related Facebook pages used to facilitate the scheme. With this third action, the United States has averted the further victimization of those seeking COVID-19 protective gear, and disrupted the continued funding of ISIS.

The claims made in these three complaints are only allegations and do not constitute a determination of liability. The burden to prove forfeitability in a civil forfeiture proceeding is upon the government. Further, charges contained in criminal complaint are merely allegations, and the defendants are presumed innocent unless and until proven guilty beyond a reasonable doubt in a court of law.

IRS-CI Cyber Crimes Unit (Washington, D.C.), HSI’s Philadelphia Office, and FBI’s Washington D.C., New York, and Los Angeles field offices are investigating the case. Assistant U.S Attorneys Jessi Camille Brooks and Zia M. Faruqui, and National Security Division Trial Attorneys Danielle Rosborough and Alexandra Hughes are litigating the case, with assistance from Paralegal Specialists Brian Rickers and Bria Cunningham, and Legal Assistant Jessica McCormick. Additional assistance has been provided by Chainalysis and Excygent.

Looming Military Conflict in S China Sea?

Posted on August 13, 2020August 13, 2020 by Denise Simon

Chinese military journalists are publicly urging the People’s Liberation Army (PLA) to prepare immediately for an attack by U.S. forces in the South China Sea. One expert at Zhejiang University’s National Institute for South China Sea Studies, Shi Xiaoqin, claims that the U.S. is deliberately trying to provoke China. They also suggest the regime reinforce Chinese installations on reefs claimed by China.

If this analysis gains traction by Chinese political and military leaders, U.S. military commanders in the South China Sea should plan for the possibility that China might initiate hostilities in keeping with its doctrine of preemptive retaliation, a seeming attempt falsely to claim “self-defense.”

One writer suggests that the PLA should immediately move fighter aircraft to Chinese air bases in the Spratly Islands at Fiery Cross, Subi Reef, and Mischief Reef. He also boldly claims that the augmented presence of U.S. naval and air assets in the South China Sea is no longer just a show of force by America.

Chen Hu, a Chinese military journalist, also asserts that the U.S. is now intent on provoking a conflict and is preparing for battle. Chen claims that the return of B1 bombers to Guam and continued deployment of two U.S. aircraft carrier groups in the South China Sea, despite the conclusion of military exercises, is supposedly a sign of Washington’s aggressive intent. Chen suggests that recent U.S. “Freedom of Navigation” maneuvers and the high number of U.S. surveillance collection missions along the Chinese coast is additional proof of American attack planning. Former PLA officer Wang Yunfei and naval equipment expert suggests that flights by American RC-135, E-8c, and RC-12X surveillance aircraft equate to “pre-battle strategic technical surveillance.” As the joke goes from the children’s playground: “It all started when he hit me back.”

Wang further warns that U.S. President Donald J. Trump is likely to initiate a military conflict in the South China Sea region before the November 3 U.S. presidential election, speculating that “stirring up external frictions, especially military conflicts with China, will help the incumbent president for his re-election campaign.”

The leaders of China’s Communist Party (CCP) also see that nothing was done by anyone, including the U.S., to stop China’s grab of Hong Kong this year — 27 years early. This paralysis of the West must have looked to the CCP like a green light to keep on grabbing.

Wang even lays out his analysis on particular avenues of approach by which U.S. bombers might attack their Chinese targets. Wang, now a Chinese naval specialist, writes that the U.S. will probably ship-launch Tomahawk Cruise against Chinese bases in the South China Sea. He further specifies that the PLA should deploy China’s own aircraft carriers in the south central region of the sea, as the best strategy to counter any U.S. assault. He adds that China must also deploy fighter jets and air defense missiles on various Chinese reefs.

Scarborough Shoal could become a flashpoint for a South ...

Wang singled out the Scarborough Shoal in the South China Sea’s Paracel Island Chain as the most likely initial piece of real estate that the U.S. might seek to seize. The Scarborough (Huangyan) Shoal/Reef is claimed by both China and the Republic of the Philippines. Perhaps one reason why China might expect that Scarborough Shoal is a likely target is that the U.S. wants to re-cement military agreements with the Philippines that would allow American military assets access to Clark Air Force Base, Subic Bay Naval Base and other newer facilities. U.S. support for Manila’s claim to the Scarborough Shoal against China’s might be sufficient to convince the mercurial president of the Philippines, Rodrigo Duterte, to patch up relations with the U.S.

Chinese writer Zheng Hao, who assesses that it is possible that U.S.-Chinese tensions in the South China Sea could escalate into a “hot war,” cites U.S. Secretary of State Mike Pompeo’s July 13 statement that the South China Sea is “not China’s maritime empire” as indicative of the Trump Administration’s hostile intent. Zheng appears to be especially concerned about the July 7 U.S.-Japan naval exercise, which included an operation by the U.S. aircraft carrier Ronald Reagan and two warships of the Japanese Maritime Defense Forces. Zheng laments that the 2018 draft of the Code of Conduct in the South China Sea has not yet been signed by the Association of South East Asian Nations (ASEAN) and China.

One hope to avoid or at least postpone an imminent clash in the South China Sea is for China and the U.S. to activate the crisis prevention apparatus established in November 2014. This diplomatic device includes a Memorandum of Understanding on notification of military activities and rules of behavior designed to keep air and naval encounters peaceful. So far, there is no public acknowledgement that either China or the U.S. is employing the crisis prevention mechanism. One recent sign of efforts by both sides to avoid a military incident was the Pentagon’s August 7 announcement that U.S. Secretary of Defense Mark Esper and his Chinese counterpart, Minister of Defense Wei Fenghe, held a 90-minute teleconference last week.

China, however, has been the party with the hostile intent, not only with Hong Kong, but also with an attack on northern India, an extensive military base build-up in the South China Sea, an attempted appropriation of the Japan-administered Senkaku Islands and a “fishing fleet” of 250 vessels showing up near the Galapagos Islands, off Ecuador. Another recent move from Beijing was to conduct live-fire targeting drills in the South China Sea from July 25 through August 2. The announcement of this exercise was promulgated by the PLA and not, as is usual, by the Chinese government’s maritime administration. If China continues its aggressive posture toward the U.S.-allied free states of Asia, especially Taiwan, a direct confrontation between the Chinese and U.S. militaries in the South China may indeed be necessary.

Author: Dr. Lawrence A. Franklin was the Iran Desk Officer for Secretary of Defense Rumsfeld. He also served on active duty with the U.S. Army and as a Colonel in the Air Force Reserve.