MIAMI (AP) – The cyber attack came just as finance officials from across Latin America were descending on Washington to commemorate the 60th anniversary of the Inter-American Development Bank.
On September 24, 2019, requests from more than 15,000 Internet addresses across China flooded the bank’s website, making part of it intermittent offline. To unblock the network, the bank has taken a drastic step to block all traffic in China.
But the attackers persisted, and as officials gathered for a day of conferences with famous athletes, academics and chefs, the bombing intensified.
Details of the attack, which were not previously reported, are contained in an internal IDB document revised by The Associated Press.
News of the attack comes as the bank’s new president, Mauricio Claver-Carone, tries to capitalize on his shaky views of China during his time in the Trump administration to overtake those in Washington and beyond. that he is still smoking his political election last year.
Claver-Carone, the former senior director for Western Hemisphere affairs of the former National Security Council, chaired his first annual IDB meeting in Colombia last week since he was elected last fall for the objections of Democrats and regional governments. -they complained that the old period violated the tradition of a Latin American being at the helm.
A geopolitical ideologue, Claver-Carone does not seem to be in a hurry to abandon his contempt for Beijing’s growing influence in the Washington court. In stark contrast to his predecessor, Luis Alberto Moreno of Colombia, who eagerly promoted Chinese investment in the region, Claver-Carone recently launched an opportunity to invite Taiwan, the island democracy claimed by the communist government in Beijing as part of its territory.
In reducing China’s influence, Claver-Carone seeks to favor Democrats who question his leadership but share his distrust of Beijing. If he succeeds, I can help him fulfill what was the main commitment of his unorthodox candidacy: US support for a capital increase so that the bank can help the region escape a pandemic-induced recession, which is the worst in May. more than a century.
There are early signs that it could progress. This month, a bipartisan group of five lawmakers led by Sen. Bob Menendez, head of the Senate Foreign Relations Committee, proposed legislation to authorize a $ 80 billion capital increase that would increase loans to the Washington-based bank. by 60%.
“People have to accept that it has won,” said Dan Runde, a former US Agency for International Development official in the George W. Bush administration and an expert on multilateral institutions at the Center for Strategic and International Studies. “Those who are not happy have not yet gone through the five stages of pain. They are stuck somewhere between denial and anger. “
But Senator Patrick Leahy, the powerful chairman of the Senate Credit Committee, has not yet signed, after warning last year that the election of Claver-Carone, a “polarizing American” to lead the IDB, would affect – not help – the case for a funding boost. There is also an expectation that some in the region who supported Claver-Carone when Trump was in office – such as Brazil and Colombia – could exchange loyalties to appeal to the city’s new sheriff: President Joe Biden.
“The argument that an underfunded bank is an opportunity for China is very convincing,” said Dan Restrepo, who served in the same National Security Council as Claver-Carone during the Obama administration. “But it doesn’t respond to how you adequately finance the bank and with what management.”
In terms of cyber disruptions, the attack on the IDB was too small to cause concern beyond the bank. Last year, more than 10 million similar denial of service (DDoS) attacks were reported worldwide, according to digital security firm NETSCOUT.
But in the midst of the IDB’s gala celebration, it was full of symbolism.
The Washington bash was hastily staged after the Trump administration, six months earlier, rallied allies to force the cancellation of the IDB meeting in the Chinese city of Chengdu, which was to be a breakout party for China a decade after joined the bank.
While the United States has been trying to derail the meeting for months, China’s denial of a visa to a representative of Venezuelan opposition leader Juan Guaidó has given it the opportunity to act decisively. While the IDB and most Latin American nations recognize Guaidó as Venezuela’s legitimate leader, China is a strong ally of President Nicolás Maduro
Claver-Carone was the US official who led the diplomatic confrontation with China at the IDB. As a senior White House official for Latin America, he was also the architect of “America Rising,” a program that sought to limit China’s attack on Latin America, where it moved the United States as its main partner. commercially in countries such as Argentina, Brazil and Chile.
According to the IDB document, on September 19, 2019, traffic to the IDB website increased to more than four times normal, forcing the main site and page of offline publications. At first, the bank defended itself by blocking individual IP addresses.
But then “the attackers changed tactics and began sending requests from more than 15,000 IP addresses across China,” according to the internal document. “By Tuesday night, the 24th, all revenue traffic in China was blocked, a decision allowed us to go back online.”
Unhindered, the attackers pivoted again, this time relying on 180,000 IP addresses in countries, including Singapore and Japan. In total, the attack lasted for months, but was effectively restrained after three weeks, when the bank turned to Amazon to build a more robust firewall.
Although there is no indication that the site has been breached, “downtime has affected our digital presence and has had a negative impact on various communication efforts,” the document said. “It also made our vulnerabilities explicit to third parties, which could target new attacks and impact the IDB’s brand reputation.”
However, it is impossible to know who was behind the attack.
While China has some of the most skilled hackers in the world, security experts say that this does not necessarily mean that it is behind the attacks. Poorly protected computers can be hijacked and fixed from anywhere in the world and turned into a botnet to trigger DDoS attacks.
“A long-targeted attack has an obvious financial or political motive – you don’t troll for three weeks,” said Tord Lundstrom, a digital security expert at Qurium, a Swedish non-profit organization. “But whether China has been behind it or whether someone is just trying to make it look like that is very difficult to determine without additional digital forensic information.”
China’s foreign ministry did not directly answer questions about whether the government knew about the IDB incident or was involved, but said in a statement that it strongly opposed cyber attacks.
“Direct connection of cyber attacks to a government is an extremely sensitive political issue,” the ministry said in a statement. “All parties should jointly resolve the issue of hacking through dialogue and cooperation and avoid politicizing the issue.”
Claver-Carone declined to be interviewed, while the IDB said it did not comment on internal cybersecurity issues. However, three people at the bank told the PA that they remember that China was openly blamed for the attack in 2019 briefings to discuss the consequences. People spoke with the PA on condition of anonymity to discuss internal deliberations.
On paper, China has a tiny 0.004% of the IDB’s voting shares, the smallest of any of the bank’s 48 members. But membership has been a cheap way for China to expand its coverage in Latin America. Chinese companies are able to bid for IDB-funded projects, look at political leaders, and capture valuable economic information that would be harder to obtain on their own.
China is also the second largest non-lending shareholder in IDB Invest, the bank’s private lending arm, with nearly 6% of the shares, thanks to a 2015 reorganization when the Obama administration refused to use additional resources. and saw the US stake diluted to 13%.
The IDB also manages a $ 2 billion fund made entirely of contributions from China. Over the years, the IDB has also hosted more than a dozen business summits that link Latin American entrepreneurs to Chinese investors.
“For too long, the IDB has been too friendly with the Chinese Communist Party,” Runde said. “The bank and its shareholders did not blame China for destroying the IDB’s 60th anniversary. This too comfortable relationship needs to change. ”
China has not hidden its strained relationship with Claver-Carone. In a symbolic rebuke, Yi Gang, head of China’s central bank, abstained from voting at last year’s special meeting when Claver-Carone was elected, according to a person who attended the meeting on condition of anonymity to discuss the closed door. . discussion.
Rebecca Ray, an economist at Boston University who is looking at China’s investment in the region, said the delicate policy around China could be a double-edged sword. While Claver-Carone’s attempts to isolate Beijing may play out well in the US Congress and help it secure additional funding, it could end up undermining the IDB’s mission at a time of much-needed funding to build infrastructure, improve infrastructure. health care and poverty reduction in the region.
She noted that as the IDB delayed other multilateral institutions in securing more funding, three Latin American countries – Brazil, Ecuador and Uruguay – joined the Asian Infrastructure Investment Bank, China’s response to the World Bank, and one against which the United States opposes.
“China’s development could end up limiting China’s willingness to continue to play an active role, which would not be popular in the region,” Ray said. “As long as the need for funding remains high, countries will continue to turn to China because that’s where the money is.”
___
Associated Press writer Joe McDonald of Beijing contributed to the report.
__
Joshua Goodman on Twitter: @APJoshGoodman
___
Contact the global AP investigation team at [email protected]