Can Washington Afford to Deter Chinese Cyber Activity?

The United States Cannot Deter China in Cyberspace

By using this website, you agree to our use of cookies. This use includes personalization of content and ads, and traffic analytics. Review our Privacy Policy for more information.

Foreign Policy Get analysis and alerts more quickly in the mobile app.

Install

Back to Foreign Policy Magazine home page

Evening roundup with our editors’ favorite stories of the day

World Brief

Your guide to the most important world stories of the day

China Brief

The latest news, analysis, and data from the country each week

Situation Report

Weekly update on what’s driving U.S. national security policy

FP Weekend

A curation of our best book reviews, deep dives, and other reads

Africa Brief

Essential analysis of the stories shaping geopolitics on the continent

South Asia Brief

Weekly update on developments in India and its neighbors

The Reading List

Curated guides on geopolitics and current affairs

FP Bookshelf

A monthly guide to FP’s book reviews, excerpts, and reading recommendations

Latin America Brief

One-stop digest of politics, economics, and culture

Southeast Asia Brief

A weekly dispatch with news from the region’s 11 countries

The New Geopolitics

A five-part masterclass in IR theory with Harvard Professor Stephen M. Walt

View All Newsletters

Subscribe Subscribe Team access Team access

Analysis: Can Washington Afford to Deter Chinese Cyber Activity?

1. Create an FP account to save articles to read later.

Sign Up

ALREADY AN FP SUBSCRIBER? LOGIN

PDF

1. **Downloadable PDFs** are a benefit of an FP subscription.

ALREADY AN FP SUBSCRIBER? LOGIN

Gift

1. Gifting articles is a subscriber benefit.

ALREADY AN FP SUBSCRIBER? LOGIN

2. This article is an Insider exclusive.

Contact us at [email protected] to learn about upgrade options, unlocking the ability to gift this article.

Analysis

Can Washington Afford to Deter Chinese Cyber Activity?

Costly signaling to Beijing could hurt the U.S. economy.

By **Ahana Datta Fasel**, the author of *Full Stack Spies: Cyber Espionage in the Age of US-China Competition* (Hurst).

*A meeting taking place in an ornate, high-ceilinged room beneath a large crystal chandelier, where officials in suits sit around a U-shaped conference table backed by American flags, facing an audience seated in the foreground.*

U.S. President Donald Trump hosts a roundtable discussion on cybercrime in the White House in Washington on Oct. 21. Alex Wong/Getty Images

My FP: Follow topics and authors to get straight to what you like. Exclusively for FP subscribers. Subscribe Now | Log In

In August, the U.S. Justice Department and the FBI dismantled the online infrastructure behind two hacking platforms operated by a Chinese state-sponsored group. It had been targeting sensitive U.S. government networks since at least 2018. In October, the agencies seized hacking tools used by another such group whose operations the U.S. government had previously disrupted in 2024.

Washington can deny Beijing’s hackers access to harmful capabilities. But the longevity and resurgence of the hackers’ campaigns raise a hard truth: Disruption alone cannot reverse the strategic advantages generated by years of Chinese cyber activity.

In August, the U.S. Justice Department and the FBI dismantled the online infrastructure behind two hacking platforms operated by a Chinese state-sponsored group. It had been targeting sensitive U.S. government networks since at least 2018. In October, the agencies seized hacking tools used by another such group whose operations the U.S. government had previously disrupted in 2024.

Washington can deny Beijing’s hackers access to harmful capabilities. But the longevity and resurgence of the hackers’ campaigns raise a hard truth: Disruption alone cannot reverse the strategic advantages generated by years of Chinese cyber activity.

The conventional U.S. approach to cyber deterrence has treated Chinese operations as individual security incidents. But to deter China from accruing advantages through cyber activity, the United States must change the incentives of a vast hacking ecosystem built around the Chinese state in order to counteract its impacts on the United States’ military, technology, and trade.

A shift is now underway in Washington. In March, the U.S. government’s 2026 Cyber Strategy promised sustained and aggressive action through public-private partnerships, which would combine offensive and defensive capabilities with economic and legal countermeasures. Recent reports from the Council on Foreign Relations (CFR) and Britain’s Royal United Services Institute similarly advocate for coordinating cyber operations with other instruments of state power.

Such proposals appear to recognize that disrupting individual operations has not changed China’s broader cyber behavior. But while combining instruments may help disrupt individual operations and parts of the ecosystem, they may still fail to credibly deter the broader pattern of activity that generates cumulative advantage.

Therein lies the more troubling possibility: that the United States cannot credibly deter the broad pattern of Chinese cyber activity at a price that it is prepared—or willing—to sustain.

China’s recent cyber campaigns have advantages beyond individual intrusions. In 2023, for example, the Volt Typhoon campaign secured access to U.S. infrastructure in Guam that would be critical for U.S. operations in a future Taiwan contingency. While the United States removed some of the original footholds, the Justice Department has warned that the target infrastructure is still vulnerable; in early 2025, security analysts found that a Volt Typhoon-linked group had steadily penetrated U.S. utilities through that year. Disrupting individual intrusions had not prevented China from prepositioning for future disruption.

The year after the Guam intrusion, a campaign attributed to the Salt Typhoon hacker network compromised U.S. telecommunications networks, allowing Chinese actors to collect sensitive information from surveillance systems. More than a year after the intrusion was first disclosed, the campaign was discovered to be surveilling congressional staffers’ communications. It is still unclear whether Salt Typhoon infrastructure has been removed from the affected networks or whether it continues to accumulate intelligence.

A broad campaign of deterrence has proved to be largely ineffective, but it was once possible to think in narrower terms. In 2015, then-U.S. President Barack Obama and Chinese President Xi Jinping agreed that neither side would conduct or knowingly support cyber-enabled theft of intellectual property for commercial advantage. Security firms subsequently reported a decline in detected Chinese intrusions against U.S. companies (although the decline had begun before the agreement, and its causes re