Xi Jinping, China's president and former U.S. President Barack Obama shake hands during a ceremony on the South Lawn of the White House in Washington, D.C., U.S., on Friday, Sept. 25, 2015. |

Chinese hacking of U.S. companies for intellectual property (IP) purposes has largely dropped since a 2015 agreement with the U.S. government. However, according to cybersecurity company FireEye Inc., cyberattacks from the Chinese government related to other business activities are on the rise, and law firms and general counsel are among the targets.

An April 2018 report from FireEye Inc. concluded that while Chinese IP theft “declined significantly” upon the September 2015 “Obama-Xi Agreement,” there has been an uptick in cybertheft of information related to contracts, mergers and acquisitions (M&As), and company bid prices. The report, which tracked global incident response investigations between 2016 and late 2017, also noted “a surge in cyber espionage campaigns” against law firms.

“For the Chinese, if you get access to a large, well-regarded law firm with a lot of sensitive clients, it's one operation you can do that results in access to many companies,” said Christopher Porter, chief intelligence strategist at FireEye. “A law firm is somewhere they can target that would allow them to remain in compliance with [the Obama-Xi agreement] but still get other types of intelligence.”

As to how the attacks are traced to the Chinese government, Porter, a former CIA agent, explained that attackers have “access to the quality of tools that the Chinese nation-state could buy” and are stealing information beneficial to the Chinese government.

“If a group compromises a law firm, we might also see them compromising a defense contractor in Japan, we might also see them collecting political intelligence in Taiwan. So when you can see the whole world of activity, it becomes a lot easier to say, 'Well, there's really only one actor who's interested in all those things,'” he added.

The report didn't disclose the identities or number of attacked entities, nor did it specify the percent increase in attacks. However, attacks on law firms are well documented. In late 2016, federal charges were brought against three Chinese nationals for allegedly hacking into two U.S. firms for trade information on then-imminent M&A deals. What's more, IT security group LogicForce reported hacking attempts on over 200 U.S. law firms between 2016 and 2017, with about 10,000 network intrusions attempted on them daily.

LogicForce CEO John Sweeney told Legaltech News that Chinese hacking of law firms is “not something we're frequently seeing,” though he added that he doesn't doubt FireEye's findings.

Law firms prove lucrative targets for their access to their clients' general counsel, which Porter identified as among the “top targets” in hacks for sensitive company information, such as the M&A and contract data sought by Chinese hackers. Typically, GCs “have to see everything” and typically “don't have as much security” as officers like the CEO, he explained.

“The executives at the company might not even personally read their own emails. They might have an executive assistant who's opening it. But the general counsel is not only going to be reading her own email, she's going to be accepting attachments from people. That's an infection vector,” he said.

FireEye said the Chinese government is stealing this information to give local companies a leg up in international deals, and that technology companies are among those targeted. The Chinese government for its part denied in a March press conference partaking in cyberattacks against U.S. companies, with Foreign Minister Spokesperson Lu Kang reaffirming state efforts to comply with the 2015 “cybersecurity consensus” between the U.S. and China.

Ryan Logan, counsel in Hunton & Williams' privacy and information practice, told LTN that companies undergoing the M&A process are specific targets for hackers. As to how it impacts the deal, he said “some companies get spooked,” though noted that it depend on whether “they've had similar instances in the past.”

Logan counted China as “one of the players” among nation-states hacking organizations for such information, noting that these actors are “much more likely to be interested in the information for the value of the information in and of itself rather than as a profit source,” such as data sold on the black market.

As to why such information is particularly sought by Chinese hackers, Porter said that the Obama-Xi agreement only prevents state-sponsored hackers from stealing IP. “Anything that's not that whole phrase doesn't count,” he added.