As China expands its cyber espionage and sabotage operations, how will the Trump administration respond?

US President-elect Donald Trump has named most of the members of his proposed cabinet. However, he’s yet to reveal key appointees to America’s powerful cyber warfare and intelligence institutions.

These include positions like national cyber director^[1], director of the Cybersecurity and Infrastructure Security Agency^[2] (CISA), and National Security Council cyber lead. These figures will be vital in securing America’s cyber security at a crucial time.

We believe there are three flashpoints that could be particularly troublesome for the incoming administration:

• how Trump will balance his economic and security priorities
• how his administration can effectively deter Chinese digital disruption
• how it will address the suspicions among some MAGA supporters of the powers of the intelligence “deep state”.

Intensifying Chinese cyber espionage

Chinese electronic surveillance and espionage activities against the US have reached an all-time high in terms of level of effort and, most importantly, effectiveness.

These espionage activities have been successfully targeting:

• the key intellectual property that provides the US with an economic and national security advantage
• the personal communications of senior US government and military officials, and
• the personal data of tens of millions of Americans.

As has recently been reported^[3], the Chinese government has exploited vulnerabilities in America’s ageing telecommunications infrastructure to target secret government systems.

Hackers from the group “Salt Typhoon^[4]” were able to access the personal communications of high-ranking officials (including Trump) and expose the identities of US intelligence targets and sources in the US and overseas.

Salt Typhoon also appears to have extracted US telecommunications companies’ call data records. These detail the call history and associated phone numbers of all users of the network.

These sophisticated breaches follow years^[5] of brazen cyber operations to steal US intellectual property and state secrets concerning strategically significant technologies. These include artificial intelligence, next-generation aircraft, biotechnology and energy systems.

Indeed, researchers have found^[6] the majority of Chinese espionage activities against the US since 2000 have focused on stealing commercial technologies and information.

Alongside this, the US government believes Beijing is seeking to expand its ability to capture digital information on Americans.

The Biden administration responded to this threat with a number of measures to harden America’s technology ecosystem against Chinese-made devices and software that may contain backdoors or hidden surveillance features. The response included bans and restrictions^[7] on products made by Hikvision, Dahua and Hytera, as well as the social media platform Tiktok.

This all sets the scene for showdowns between Trump and China, as well as between Trump and America’s tech sector.

For example, the Trump administration will almost certainly have to compel telecommunications giants AT&T, Verizon, T-Mobile and others to address longtime deficiencies^[8] in their infrastructure. This includes the persistent use of unshielded components dating back to the 1970–80s.

Simultaneously, the personal targeting of Trump, his Cabinet, and senior government officials and their sources will require a forceful response to deter future operations.

But how much will the Trump administration be prepared to do in response to Chinese aggression?

President Joe Biden has hit back^[9] against China by targeting its semiconductor industry^[10] and curtailing its access to other strategic technologies. In any negotiations between Trump and Chinese leader Xi Jinping over trade and tariffs, Beijing is likely to seek to have these measures removed.

If it does, Trump’s desire for a better economic “deal” with China may come into conflict with national security concerns.

Cyber sabotage on critical infrastructure

Chinese agencies have also been infiltrating^[11] American and allied critical infrastructure (including the cyber security centres in the “Five Eyes” partners) for the purposes of sabotage.

The aim is to pre-position themselves in target networks, installing sophisticated malware that can be activated to disrupt and degrade essential systems. This includes in a time of war.

The most noteworthy of these efforts has come from Volt Typhoon^[12], a Chinese state-sponsored hacker group.

These efforts to infiltrate and cripple vital infrastructure are consistent with China’s long-standing doctrine^[13] of covert action intended to “win without fighting”.

These sabotage efforts are widely expected to intensify as we approach 2027. This is the crucial window^[14] when China’s People’s Liberation Army is expected to reach military readiness to attempt an invasion of Taiwan.

The greatest risk of this digital sabotage campaign is a possible escalation into a military conflict between the US and China.

If Chinese malware is used to target the celebrations for America’s 250th birthday^[15] in 2026 or the Los Angeles Olympics in 2028, for example, how much restraint would Trump have?

Renewing America’s cyber espionage law

The final flashpoint will be a legislative one.

The Foreign Intelligence Surveillance Act (FISA) has long been the subject of passionate debate in the US. Most of this centres on Section 702^[16], the basis for much of America’s cyber intelligence collection efforts on foreign targets.

This section allows US intelligence agencies to intercept phone calls, emails and other digital communications on non-Americans outside the US.

Congress has mandated these agencies to “minimise^[17]” the collateral collection of data on Americans. In practice, however, this has been difficult to achieve in the age of digital anonymity and transnational threats.

Bipartisan supporters of FISA consider it essential to national security agencies that are fighting to keep America and its allies safe. The MAGA-aligned House Freedom Caucus, however, has cast the act in a different light. They believe it empowers an unaccountable deep state^[18] intent on surveilling ordinary citizens.

Trump has at times aligned himself with this view. In April of this year, he posted^[19] that Congress should “kill FISA” due to allegations it enabled spying of his 2020 presidential campaign.

Section 702 will lapse^[20] in April 2026 unless Congress votes to authorise it again. While both houses of Congress will have Republican majorities, the disparate views within the party do not guarantee passage.

Raising the stakes further are the intensifying national security threats a second Trump administration will face.

Intelligence officials will argue the demand for FISA-sourced intelligence has never been higher. However, outsiders like Tulsi Gabbard^[21] (presumptive director of national intelligence), Kash Patel^[22] (presumptive FBI director), Pam Bondi (presumptive attorney-general) and Kristi Noem^[23] (presumptive secretary of homeland security) may oppose re-authorising the legislation.

Furthermore, America’s allies rely heavily on intelligence shared by US agencies using FISA warrants. Just as Trump looks set to demand NATO and other allies pay more for their own defence, he may well insist that Five Eyes and other intelligence partners do more of their own surveillance operations, too.

References

1. ^{^} national cyber director (cybermagazine.com)
2. ^{^} Cybersecurity and Infrastructure Security Agency (www.forbes.com)
3. ^{^} recently been reported (www.nytimes.com)
4. ^{^} Salt Typhoon (www.reuters.com)
5. ^{^} follow years (www.csis.org)
6. ^{^} have found (www.csis.org)
7. ^{^} bans and restrictions (www.securityinfowatch.com)
8. ^{^} address longtime deficiencies (urgentcomm.com)
9. ^{^} hit back (www.nytimes.com)
10. ^{^} semiconductor industry (www.theguardian.com)
11. ^{^} infiltrating (www.cisa.gov)
12. ^{^} Volt Typhoon (theconversation.com)
13. ^{^} long-standing doctrine (www.irsem.fr)
14. ^{^} crucial window (media.defense.gov)
15. ^{^} America’s 250th birthday (www.newsweek.com)
16. ^{^} Section 702 (www.intel.gov)
17. ^{^} minimise (www.brennancenter.org)
18. ^{^} unaccountable deep state (www.cato.org)
19. ^{^} posted (www.cato.org)
20. ^{^} lapse (cdt.org)
21. ^{^} Tulsi Gabbard (apnews.com)
22. ^{^} Kash Patel (abcnews.go.com)
23. ^{^} Kristi Noem (edition.cnn.com)