Chinese hackers stole Mekong River data from Cambodian ministry, say sources

The accusations, which China has said were fabricated and politically motivated, were outlined in a 30-page US court indictment about the activities of what it said was a front company run by Chinese state security in Hainan.

According to the indictment, Chinese hackers obtained data from the Cambodian ministry on the same day Cambodia hosted the China-backed Lancang-Mekong Cooperation (LMC) leaders summit with China, Laos, Myanmar, Thailand, and Vietnam in Phnom Penh on Jan. 10, 2018. (Pixabay)

Buried in a long US indictment accusing China of a global cyberespionage campaign was a curious detail: Among the governments targeted by Chinese hackers was Cambodia, one of Beijing's most loyal Asian allies. The target of the hack, which two sources with knowledge of the indictment said was Cambodia's foreign ministry, was also revealing: discussions between China and Cambodia over the use of the Mekong River, a new battleground for US and Chinese influence in Southeast Asia.

Four Chinese nationals - three security officials and a contract hacker - have been charged for attacks aimed at dozens of companies, universities and government agencies in the United States and abroad, the US Justice Department said on Monday. Reaction from the defendants named in the indictment was not immediately available.

The accusations, which China has said were fabricated and politically motivated, were outlined in a 30-page US court indictment about the activities of what it said was a front company run by Chinese state security in Hainan, a Chinese island province near Southeast Asia. Among the hackers' targets was "Cambodian Government Ministry A", according to the indictment, from which they "stole data pertaining to discussions between the Governments of China and Cambodia over the use of the Mekong River" in January 2018.

That ministry was Cambodia's Ministry of Foreign Affairs, two sources with direct knowledge of the indictment told Reuters. China's embassy in Cambodia did not respond to a request from Reuters for comment. The Chinese foreign ministry did not immediately respond to a faxed request for comment. A Cambodian foreign ministry spokesperson referred questions to the telecommunications ministry, which declined to comment. Cambodian government spokesperson Phay Siphan declined to comment.

Secrets and data

The 4,350 km (2,700-mile) long Mekong, known as the Lancang in its upper reaches, flows from China along the borders of Myanmar, Laos, and Thailand through Cambodia and Vietnam, where it has supported farming and fishing communities for millennia. Like the South China Sea, the Mekong River has become a front in US-China rivalry, with Beijing overtaking Washington in both spending and influence over downstream countries at the mercy of its control of the river's waters.

According to the indictment, Chinese hackers obtained data from the Cambodian ministry on the same day Cambodia hosted the China-backed Lancang-Mekong Cooperation (LMC) leaders summit with China, Laos, Myanmar, Thailand, and Vietnam in Phnom Penh on Jan. 10, 2018.

The data obtained by the hackers pertained to those discussions, the indictment said, without elaborating. On the same day, the hackers hid and transmitted "trade secrets and proprietary hydroacoustic data" within digital images of a koala bear and former US President Donald Trump, according to the indictment. It said the material was sent to an online account controlled by hackers.

It was not clear if the hydroacoustic data - data collected by sonar and used to monitor underwater features - was of the Mekong River area.

Last week, US Secretary of State Antony Blinken told Southeast Asian foreign ministers the US supported a "free and open Mekong region" under the Washington-backed Mekong-US Partnership.