For the first time in history, the Norwegian Police Security Service (PST) has identified China as being responsible for a hack attack against the country's authorities.
In 2018, several public administration offices across the country, among others county governors in Oslo and Viken, were targeted in a comprehensive and advanced computer attack that prompted an investigation into espionage to steal state secrets, including defence plans and emergency preparedness, national broadcaster NRK reported.
According to PST, a total of 1.3 Gb of data, including employees' usernames and passwords, was extracted, but the extent to which national security was compromised remains questionable.
The head of PST's counter-intelligence unit, Hanne Blomberg, said data points "in a clear direction towards" APT31, which she described as a group "with links to China's state apparatus and intelligence services", also known by other names such as Zirconium, Bronze Vinewood, and Judgment Panda. NRK added that APT31 is known to have carried out computer attacks in Norway, Finland, and the US, including targeting employees of Joe Biden's 2020 presidential campaign, and elsewhere across the globe.
Senior researcher Karsten Friis at the Norwegian Institute of Foreign Policy (NUPI) emphasised that this is the first time China has been explicitly mentioned by the Norwegian authorities.
"There has been a growing concern about computer attacks over several years. Previously, there were more criminal actors, but now state actors have become a greater security challenge. They penetrate security institutions and democratic institutions. This is a trend we have seen in recent years", Friis said.
The Chinese Embassy in Norway refuted PST's information.
"China has never participated in or supported anyone in cyberattacks, and has always resolutely opposed and cracked down on such behaviour. We are strongly opposed to the unfounded allegations against China", it said, stressing that China's technological development is "not dependent on stealing or looting, but the result of our own hard work".
Yet, despite claims of evidence found, the case will be closed. PST admitted that it doesn't have sufficient data to take the case to court. PST police lawyer Kathrine Tonstad described it as an "advanced, professional, and sophisticatedly executed computer attack", but cited high evidential requirements in order to proceed.
