Page:2020-06-09 PSI Staff Report - Threats to U.S. Communications Networks.pdf/70

This page has been proofread, but needs to be validated.

This incident affected traffic to and from U.S. government (".gov") and military ("mil") sites, including those for the Senate, the army, the navy, the marine corps, the air force, the office of secretary of Defense, the National Aeronautics and Space Administration, the Department of Commerce, the National Oceanic and Atmospheric Administration, and many others.[1]

The Commission also noted that the disruption could allow the carrier to "compromise the integrity of supposedly secure encrypted sessions."[2] There was no consensus, however, on the motives underlying the false routes. Some saw it as an unintentional error, while others concluded it was likely a "deliberated [sic] attempt to capture as much data as possible."[3]

Just a year later, new reports circulated about a similar incident in which AT&T and other U.S. carriers routed Facebook traffic through China.[4] The routing was allegedly the result of China Telecom advertising false routes for approximately nine hours.[5] Subsequent reports claimed that in December 2015, China Telecom hijacked traffic by advertising more than 300 false routes associated with Verizon's Asia Pacific ("APAC") region; the advertised routes were picked up by SK Broadband, a China Telecom transit partner.[6] SK Broadband then promoted those false routes to other carriers, including Telia, Tata, GTT, and Vodafone.[7] Networks around the world that accepted these routes inadvertently sent traffic to Verizon APAC through China Telecom.[8] Verizon informed the Subcommittee that its investigation into the alleged hijacking found no link to China Telecom, the Chinese government, or malicious activity.[9] Rather, it determined that the "hijack" was the result of human error by one of Verizon's peering partners.[10]


  1. U.S.-China Econ. & Sec. Review Comm'n, Report to Congress 1, 244 (2010).
  2. Id.
  3. Compare Toonk, supra note 121 (concluding that, given the short time frame and large number of announced routes, the hijack was likely the result of a configuration issue) with Diaz, supra note 121 ("Security expert Dmitri Alperovitch—VP of threat research at McAfee—says that this happens 'accidentally' a few times a year, but this time it was different: The China Telecom network absorbed all the data and returned it without any significant delay. Before, this kind of accident would have resulted in communication problems, which lead experts to believe this wasn't an accident but a deliberated attempt to capture as much data as possible.").
  4. Andree Toonk, Facebook's detour through China and Korea, BGPMon (Mar. 26, 2011), https://bgpmon.net/facebooks-detour-through-china-and-korea/.
  5. Id.
  6. Madory, supra note 121.
  7. Madory, supra note 121.
  8. Madory, supra note 121.
  9. Briefing with Verizon (Sept. 4, 2019).
  10. Id. The peering partner was not a Chinese carrier. Id.

66