How US got China to scale back cyber espionage in 2015 by publicly charging Chinese hackers, arresting a spy in Canada, and taking a firm stance in negotiations
For years, China has systematically looted American trade secrets. Here's the messy inside story of how DC got Beijing to clean up its act for a while.
Context & Ripple Effects
The 2015 story sits at the hinge of a decade-long arc: after years of systematic looting of American trade secrets, Washington combined a bilateral cyber-theft deal with unprecedented public indictments of Chinese hackers and an arrest on Canadian soil — coercion and diplomacy in the same play. The tactic visibly worked for a window: FireEye documented a sharp drop-off in Chinese attacks on US targets over the following two years.
What makes the retrospective worth reading now is how the restraint unraveled. US officials later confirmed the espionage picked up again in 2017 and accelerated, while intelligence agencies admit they have spent the past decade one step behind China's hackers — and experts argue there is still no clear response to trade-secret theft today.
First-order effects
- Chinese state-linked hacking units pulled back from US commercial targets immediately after the indictments, the Canadian arrest, and the firm negotiating stance — the first measurable pause in years of trade-secret looting.
Second-order effects
- Once Beijing judged the costs had faded, espionage resumed and accelerated, leaving US intelligence chasing an adversary it concedes it has been a step behind for a decade — and Chinese tech firms including Alibaba and Baidu were enlisted to process stolen US data for spy agencies.
Third-order effects
- If the pattern holds, public attribution and arrests function as episodic deterrence: they buy temporary restraint but erode without sustained enforcement, which is exactly the gap experts cite in the current failure to mount a clear response to Chinese trade-secret theft.
The trend: US-China cyber deterrence is cyclical rather than durable — public charges and arrests produce measurable pauses in espionage that decay once enforcement pressure lifts.