This interview with CISAC Affiliate Christopher Painter was originally produced by Jen Kirby. The complete article is available at Vox.

The frequency, scope and scale of ransomware attacks against public and private systems is accelerating. In the latest incident, the ransomware group REvil has demanded $70 million to unlock the systems of the software company Kaseya, an attack that affects not only Kaseya, but simultaneously exploits all of the company’s clients.

The REvil, JBS meatpacking and Colonial Pipeline attacks have abruptly raised the profile of ransomware from a malicious strand of criminality to a national security priority. These are issues that Christopher Painter, an affiliate at the Center for International Security and Cooperation (CISAC), has worked on at length during his tenures as a senior official at the Department of Justice, the FBI, the National Security Council and as the world's first top cyber diplomat at the State Department.

Jen Kirby, a reporter for Vox, interviewed Painter to discuss how cybercrimes are evolving and what governments should do to keep ransomware attacks from escalating geopolitical tensions online and off.

Jen Kirby:
I think a good place to start would be: What are “ransomware attacks”?

Christopher Painter:
It is largely criminal groups who are getting into computers through any number of potential vulnerabilities, and then they essentially lock the systems — they encrypt the data in a way that makes it impossible for you to see your files. And they demand ransom, they demand payment. In exchange for that payment, they will give you — or they claim, they don’t always do it — they claim they’ll give you the decryption keys, or the codes, that allow you to unlock your own files and have access to them again.

That is what traditionally we say is “ransomware.” That’s been going on for some time, but it’s gotten much more acute recently.

There is another half of that, which is that groups don’t just hold your files for ransom, they either leak or threaten to leak or expose your files and your information — your secrets and your emails, whatever you have — publicly, either in an attempt to embarrass you or to extort more money out of you, because you don’t want those things to happen. So it’s split now into two tracks, but they’re a combined method of getting money.

Jen Kirby:
We’ve recently had some high-profile ransomware attacks, including this recent REvil incident. Is it that we’re seeing a lot more of them, or they’re just bigger and bolder? How do you assess that ransomware attacks are becoming more acute?

Christopher Painter:
We’ve seen this going on for some time. I was one of the co-chairs of this Ransomware Task Force that issued a report recently. One of the reasons we did this report was we’re trying to call greater attention to this issue. Although governments and law enforcement were taking it seriously, it wasn’t being given the kind of national-level priority it deserved.

It was being treated as more of an ordinary cybercrime issue. Most governments’ attention is focused on big nation-state activity — like the SolarWinds hack [where suspected Russian government hackers breached US government departments], which are important, and we need to care about those. But we’re very worried about this, too.

It’s especially become more of an issue during the pandemic, when some of the ransomware actors were going after health care systems and health care providers.That combined with these big infrastructure attacks — the Colonial Pipeline clearly was one of them. Another one was the meat processing plants. Another one was hospital systems in Ireland. You also had the DC Police Department being victimized by ransomware. These things are very high-profile. When you’re lining up for gas because of a ransomware attack, and you can’t get your food because of a ransomware attack, that brings it home as a priority. And then, of course, you have what happened this past weekend. So ransomware has not abated, and it continues to get more serious and hit more organizations.

This essay was originally published in Foreign Affairs magazine.

Chinese leaders will continue to pay lip service to peaceful unification until the day the war breaks out, but their actions increasingly suggest that they have something else in mind. As tensions with the United States have heated up, China has accelerated its military operations in the vicinity of Taiwan, conducting 380 incursions into the island’s air defense identification zone in 2020 alone. In April of this year, China sent its largest-ever fleet, 25 fighters and bombers, into Taiwan’s air defense identification zone. Clearly, Xi is no longer trying to avoid escalation at all costs now that his military is capable of contesting the U.S. military presence in the region. Long gone are the days of the 1996 crisis over Taiwan, when the United States dispatched two aircraft carrier battle groups to sail near the strait and China backed off. Beijing did not like being deterred back then, and it spent the next 25 years modernizing its military so that it would not be so next time.  

Much of that modernization, including updates to hardware, organization, force structure, and training, was designed to enable the People’s Liberation Army to invade and occupy Taiwan. Xi expanded the military’s capabilities further, undertaking the most ambitious restructuring of the PLA since its founding, aimed specifically at enabling Chinese forces to conduct joint operations in which the air force, the navy, the army, and the strategic rocket force fight seamlessly together, whether during an amphibious landing, a blockade, or a missile attack—exactly the kinds of operations needed for armed unification. Xi urgently pushed these risky reforms, many unpopular with the military, to ensure that the PLA could fight and win wars by 2020.

The voices in Beijing arguing that it is time to use these newfound military capabilities against Taiwan have grown louder, a telling development in an era of greater censorship. Several retired military officers have argued publicly that the longer China waits, the harder it will be to take control of Taiwan. Articles in state-run news outlets and on popular websites have likewise urged China to act swiftly. And if public opinion polls are to be believed, the Chinese people agree that the time has come to resolve the Taiwan issue once and for all. According to a survey by the state-run Global Times, 70 percent of mainlanders strongly support using force to unify Taiwan with the mainland, and 37 percent think it would be best if the war occurred in three to five years. 

The Chinese analysts and officials I have spoken to have revealed similar sentiments. Even moderate voices have admitted that not only are calls for armed unification proliferating within the CCP but also they themselves have recommended military action to senior Chinese leadership. Others in Beijing dismiss concerns about a Chinese invasion as overblown, but in the same breath, they acknowledge that Xi is surrounded by military advisers who tell him with confidence that China can now regain Taiwan by force at an acceptable cost. 

Battle Ready

Unless the United States or Taiwan moves first to alter the status quo, Xi will likely consider initiating armed unification only if he is confident that his military can successfully gain control of the island. Can it? 

The answer is a matter of debate, and it depends on what it would take to compel Taiwan’s capitulation. Beijing is preparing for four main campaigns that its military planners believe could be necessary to take control of the island. The first consists of joint PLA missile and airstrikes to disarm Taiwanese targets—initially military and government, then civilian—and thereby force Taipei’s submission to Chinese demands. The second is a blockade operation in which China would attempt to cut the island off from the outside world with everything from naval raids to cyberattacks. The third involves missile and airstrikes against U.S. forces deployed nearby, with the aim of making it difficult for the United States to come to Taiwan’s aid in the initial stages of the conflict. The fourth and final campaign is an island landing effort in which China would launch an amphibious assault on Taiwan—perhaps taking its offshore islands first as part of a phased invasion or carpet bombing them as the navy, the army, and the air force focused on Taiwan proper. 

Among defense experts, there is little debate about China’s ability to pull off the first three of these campaigns—the joint strike, the blockade, and the counterintervention mission. Neither U.S. efforts to make its regional bases more resilient nor Taiwanese missile defense systems are any match for China’s ballistic and cruise missiles, which are the most advanced in the world. China could quickly destroy Taiwan’s key infrastructure, block its oil imports, and cut off its Internet access—and sustain such a blockade indefinitely. According to Lonnie Henley, a retired U.S. intelligence officer and China specialist, “U.S. forces could probably push through a trickle of relief supplies, but not much more.” And because China has such a sophisticated air defense system, the United States would have little hope of regaining air or naval superiority by attacking Chinese missile transporters, fighters, or ships. 

But China’s fourth and final campaign—an amphibious assault on the island itself—is far from guaranteed to succeed. According to a 2020 U.S. Department of Defense report, “China continues to build capabilities that would contribute to a full-scale invasion,” but “an attempt to invade Taiwan would likely strain China’s armed forces and invite international intervention.” The then commander of U.S. Indo-Pacific Command, Philip Davidson, said in March that China will have the ability to successfully invade Taiwan in six years. Other observers think it will take longer, perhaps until around 2030 or 2035. 

What everyone agrees is that China has made significant strides in its ability to conduct joint operations in recent years and that the United States needs adequate warning to mount a successful defense. As Beijing hones its spoofing and jamming technologies, it may be able to scramble U.S. early warning systems and thereby keep U.S. forces in the dark in the early hours of an attack. Xi’s military reforms have improved China’s cyberwarfare and electronic warfare capabilities, which could be trained on civilian, as well as military, targets. As Dan Coats, then the U.S. director of national intelligence, testified in 2019, Beijing is capable of offensive cyberattacks against the United States that would cause “localized, temporary disruptive effects on critical infrastructure.” China’s offensive weaponry, including ballistic and cruise missiles, could also destroy U.S. bases in the western Pacific in a matter of days.

In light of these enhanced capabilities, many U.S. experts worry that China could take control of Taiwan before the United States even had a chance to react. Recent war games conducted by the Pentagon and the RAND Corporation have shown that a military clash between the United States and China over Taiwan would likely result in a U.S. defeat, with China completing an all-out invasion in just days or weeks.

Ultimately, on the question of whether China will use force, Chinese leaders’ perceptions of their chances of victory will matter more than their actual chances of victory. For that reason, it is bad news that Chinese analysts and officials increasingly express confidence that the PLA is well prepared for a military confrontation with the United States over Taiwan. Although Chinese strategists acknowledge the United States’ general military superiority, many have come to believe that because China is closer to Taiwan and cares about it more, the local balance of power tips in Beijing’s favor. 

As U.S.-Chinese tensions have risen, China’s state-sponsored media outlets have grown more vocal in their praise for the country’s military capabilities. In April, the Global Times described an unnamed military expert saying that “the PLA exercises are not only warnings, but also show real capabilities and pragmatically practicing reunifying the island if it comes to that.” If China chooses to invade, the analyst added, the Taiwanese military “won’t stand a chance.”

Go Fast, Go Slow

Once China has the military capabilities to finally solve its Taiwan problem, Xi could find it politically untenable not to do so, given the heightened nationalism of both the CCP and the public. At this point, Beijing will likely work its way up to a large-scale military campaign, beginning with “gray zone” tactics, such as increased air and naval patrols, and continuing on to coercive diplomacy aimed at forcing Taipei to negotiate a political resolution. 

Psychological warfare will also be part of Beijing’s playbook. Chinese exercises around Taiwan not only help train the PLA but also wear down Taiwan’s military and demonstrate to the world that the United States cannot protect the island. The PLA wants to make its presence in the Taiwan Strait routine. The more common its activities there become, the harder it will be for the United States to determine when a Chinese attack is imminent, making it easier for the PLA to present the world with a fait accompli.

At the same time that it ramps up its military activities in the strait, China will continue its broader diplomatic campaign to eliminate international constraints on its ability to use force, privileging economic rights over political ones in its relations with other countries and within international bodies, downplaying human rights, and, above all, promoting the norms of sovereignty and noninterference in internal affairs. Its goal is to create the narrative that any use of force against Taiwan would be defensive and justified given Taipei’s and Washington’s provocations. All these coercive and diplomatic efforts will move China closer to unification, but they won’t get it all the way there. Taiwan is not some unoccupied atoll in the South China Sea that China can successfully claim so long as other countries do not respond militarily. China needs Taiwan’s complete capitulation, and that will likely require a significant show of force. 

If Beijing decides to initiate a campaign to forcibly bring Taiwan under Chinese sovereignty, it will try to calibrate its actions to discourage U.S. intervention. It might, for example, begin with low-cost military options, such as joint missile and airstrikes, and only escalate to a blockade, a seizure of offshore islands, and, finally, a full-blown invasion if its earlier actions fail to compel Taiwan to capitulate. Conducted slowly over the course of many months, such a gradual approach to armed unification would make it difficult for the United States to mount a strong response, especially if U.S. allies and partners in the region wish to avoid a war at all costs. A gradual, coercive approach would also force Washington to initiate direct hostilities between the two powers. And if China has not fired a shot at U.S. forces, the United States would find it harder to make the case at home and in Asian capitals for a U.S. military intervention to turn back a slow-motion Chinese invasion. An incremental approach would have domestic political benefits for Beijing, as well. If China received more international pushback than expected or became embroiled in a campaign against the United States that started to go badly, it would have more opportunities to pull back and claim “mission accomplished.”  

But China could decide to escalate much more rapidly if it concluded that the United States was likely to intervene militarily regardless of whether Beijing moved swiftly or gradually. Chinese military strategists believe that if they give the United States time to mobilize and amass firepower in the vicinity of the Taiwan Strait, China’s chances of victory will decrease substantially. As a result, they could decide to preemptively hit U.S. bases in the region, crippling Washington’s ability to respond.

In other words, U.S. deterrence—to the extent that it is based on a credible threat to intervene militarily to protect Taiwan—could actually incentivize an attack on U.S. forces once Beijing has decided to act. The more credible the American threat to intervene, the more likely China would be to hit U.S. forces in the region in its opening salvo. But if China thought the United States might stay out of the conflict, it would decline to attack U.S. forces in the region, since doing so would inevitably bring the United States into the war. 

Wishful Thinking

What might dissuade Xi from pursuing armed unification, if not U.S. military might? Most Western analysts believe that Xi’s devotion to his signature plan to achieve the “Chinese dream” of “national rejuvenation,” which requires him to maintain economic growth and improve China’s international standing, will deter him from using military force and risking derailing his agenda. They argue that the economic costs of a military campaign against Taiwan would be too high, that China would be left completely isolated internationally, and that Chinese occupation of the island would tie up Beijing for decades to come. 

But these arguments about the cost of armed unification are based more on American projections and wishful thinking than on fact. A protracted, high-intensity conflict would indeed be costly for China, but Chinese war planners have set out to avoid this scenario; China is unlikely to attack Taiwan unless it is confident that it can achieve a quick victory, ideally before the United States can even respond. 

Even if China found itself in a protracted war with the United States, however, Chinese leaders may believe they have social and economic advantages that would enable them to outlast the Americans. They see the Chinese people as more willing to make sacrifices for the cause of Taiwan than the American people. Some argue, too, that China’s large domestic market makes it less reliant on international trade than many other countries. (The more China economically decouples from the United States and the closer it gets to technological self-sufficiency, the greater this advantage will be.) Chinese leaders could also take comfort in their ability to quickly transition to an industrial wartime footing. The United States has no such ability to rapidly produce military equipment.

International isolation and coordinated punishment of Beijing might seem like a greater threat to Xi’s great Chinese experiment. Eight of China’s top ten trading partners are democracies, and nearly 60 percent of China’s exports go to the United States and its allies. If these countries responded to a Chinese assault on Taiwan by severing trade ties with China, the economic costs could threaten the developmental components of Xi’s rejuvenation plan.

But Chinese leaders have good reason to suspect that international isolation and opprobrium would be relatively mild. When China began to cultivate strategic partnerships in the mid-1990s, it required other countries and organizations, including the European Union, to sign long-term agreements to prioritize these relationships and proactively manage any tensions or disruptions. All these agreements mention trade, investment, economic cooperation, and working together in the United Nations. Most include provisions in support of Beijing’s position on Taiwan. (Since 1996, China has convinced more than a dozen countries to switch their diplomatic recognition to Beijing, leaving Taiwan with only 15 remaining allies.) In other words, many of China’s most important trading partners have already sent a strong signal that they will not let Taiwan derail their relationships with Beijing. 

Whether compelling airlines to take Taiwan off their maps or pressuring Paramount Pictures to remove the Taiwanese flag from the Top Gun hero Maverick’s jacket, China has largely succeeded in convincing many countries that Taiwan is an internal matter that they should stay out of. Australia has been cautious about expanding its military cooperation with the United States and reluctant even to consider joint contingency planning over Taiwan (although the tide seems to be shifting in Canberra). Opinion polls show that most Europeans value their economic ties with China and the United States roughly the same and don’t want to be caught in the middle. Southeast Asia feels similarly, with polls showing that the majority of policymakers and thought leaders from member states of the Association of Southeast Asian Nations believe the best approach to U.S.-Chinese sparring is for the association to “enhance its own resilience and unity to fend off their pressures.” One South Korean official put it more memorably in an interview with The Atlantic, comparing the need to pick sides in the U.S.-Chinese dispute to “asking a child whether you like your dad or your mom.” Such attitudes suggest that the United States would struggle to convince its allies to isolate China. And if the international reaction to Beijing’s crackdowns in Hong Kong and Xinjiang is any indication, the most China can expect after an invasion of Taiwan are some symbolic sanctions and words of criticism. 

The risk that a bloody insurgency in Taiwan will drag on for years and drain Beijing of resources is no more of a deterrent—and the idea that it would be says more about the United States’ scars from Afghanistan and Iraq than about likely scenarios for Taiwan. The PLA’s military textbooks assume the need for a significant campaign to consolidate power after its troops have landed and broken through Taiwan’s coastal defenses, but they do not express much concern about it. This may be because although the PLA has not fought a war since 1979, China has ample experience with internal repression and dedicates more resources to that mission than to its military. The People’s Armed Police boasts at least 1.5 million members, whose primary mission is suppressing opposition. Compared with the military task of invading and seizing Taiwan in the first place, occupying it probably looks like a piece of cake.

For all these reasons, Xi may believe he can regain control of Taiwan without jeopardizing his Chinese dream. It is telling that in the flood of commentary on Taiwan that has come out of China in recent months, few articles have mentioned the costs of war or the potential reaction from the international community. As one retired high-level military officer explained to me recently, China’s main concern isn’t the costs; it’s sovereignty. Chinese leaders will always fight for what is theirs. And if China defeats the United States along the way, it will become the new dominant power in the Asia-Pacific. The prospects are tantalizing. The worst-case scenario, moreover, is that the United States reacts more quickly and effectively than expected, forcing China to declare victory after limited gains and go home. Beijing would live to capture Taiwan another day. 

No Exit

These realities make it very difficult for the United States to alter China’s calculus on Taiwan. Richard Haass and David Sacks of the Council on Foreign Relations have argued in Foreign Affairs that the United States could improve cross-strait deterrence by ending its long-standing policy of “strategic ambiguity”—that is, declining to state specifically whether and how it would come to Taiwan’s defense. But the main problem is not U.S. resolve, since Chinese leaders already assume the United States will intervene. What matters to Xi and other top Chinese leaders is whether they think the PLA can prevail even in the face of U.S. intervention. For that reason, successful deterrence requires convincing China that the United States can prevent it from achieving its military objectives in Taiwan, a difficult undertaking that would come with its own downsides and potential risks. 

One way to convince Beijing would be to develop the capabilities to physically stop it from taking Taiwan—deterrence by denial. This would involve positioning missile launchers and armed drones near Taiwan and more long-range munitions, especially antiship weapons, in places such as Guam, Japan, and the Philippines. These weapons would help repel a Chinese amphibious and air assault in the initial stages of an attack. If Chinese leaders knew their forces could not physically make it across the strait, they would not consider trying unless Taiwan took the truly unacceptable step of declaring independence. 

The United States would also need to invest heavily in intelligence, surveillance, and reconnaissance in the region. The attractiveness of a full-on invasion from China’s perspective lies in the possibility of surprise: the United States may not be able to respond militarily until after Beijing has taken control of the island and the war is over. Leaving aside the operational challenges of such a response, it would be politically difficult for any U.S. president to authorize an attack on China when no shots were being fired at the time. 

An enhanced U.S. military and intelligence presence in the Indo-Pacific would be sufficient to deter most forms of armed unification, but it wouldn’t prevent China from using force altogether. Beijing could still try to use missile strikes to convince Taiwan to bend to its will. To deter all Chinese military aggression, the United States would therefore need to be prepared to destroy China’s missile batteries—which would involve U.S. strikes on the Chinese mainland. Even if U.S. intelligence capabilities improve, the United States would risk mistaking Chinese military exercises for preparations for an invasion—and igniting a war by mistake. China knows this and may conclude the United States would not take the chance. 

The most effective way to deter Chinese leaders from attacking Taiwan is also the most difficult: to convince them that armed unification would cost China its rejuvenation. And the United States cannot do this alone. Washington would need to persuade a large coalition of allies to commit to a coordinated economic, political, and military response to any Chinese aggression. And that, unfortunately, remains a remote possibility, since many countries are unwilling to risk their economic prospects, let alone a major-power war, in order to defend a small democratic island. 

Ultimately, then, there is no quick and easy fix to the escalating tensions across the strait. The only way the United States can ensure Taiwan’s security is to make an invasion impossible for Beijing or to convince Chinese leaders that using force will cause them to be pariahs. For the last 25 years, however, Beijing has sought to prevent Washington from doing either. Unfortunately for Taiwan, only now is the United States waking up to the new reality.