MIAMI (AP) – The cyberattack erupted as finance officials from across Latin America descended on Washington to commemorate the 60th anniversary of the Inter-American Development Bank.
On September 24, 2019, requests from more than 15,000 internet addresses across China flooded the bank’s website, intermittently taking some offline. To decongest the network, the bank took the drastic decision to block all traffic from China.
But the attackers persisted, and as officials gathered for a day of lectures with athletes, academics and celebrity chefs, the bombardment intensified.
Details of the attack, which were not previously reported, are contained in an internal IDB document reviewed by the Associated Press.
News of the attack emerges just as the bank’s new president, Mauricio Claver-Carone, seeks to use his hawkish views on China since his time in the Trump administration to outsmart those in Washington and the United States. – beyond still furious at his politically charged election last year.
Claver-Carone, former senior director of the National Security Council for Western Hemisphere Affairs, chaired its first annual IDB meeting in Colombia last week since his election last fall over objections from Democrats and some regional governments who complained that it was breaking the long. tradition of a Latin American at the helm.
A geopolitical ideologist, Claver-Carone does not seem in a hurry to let go of his disdain for Beijing’s growing influence in Washington’s backyard. Unlike his predecessor, Luis Alberto Moreno of Colombia, who enthusiastically promoted Chinese investments in the region, Claver-Carone recently raised the possibility of inviting Taiwan, the island democracy claimed by the Communist government in Beijing to be part of his territory.
By reducing China’s influence, Claver-Carone seeks to win favor with Democrats who question his leadership but share his distrust of Beijing. If he succeeds, they can help him deliver on what was the main pledge of his unorthodox candidacy: US support for a capital raise so the bank can help the region emerge from a pandemic-induced recession. which is the worst in over a century.
There are early signs that he may be making progress. This month, a bipartisan group of five lawmakers led by Senator Bob Menendez, head of the Senate External Relations Committee, proposed legislation allowing an $ 80 billion capital raise that would increase loans by 60%. the Washington-based bank.
“People have to accept that he won,” said Dan Runde, former official with the US Agency for International Development under the George W. Bush administration and multilateral institutions expert at the Center for Strategic and International Studies. “Those who are not happy have not yet gone through the five stages of mourning. They are stuck somewhere between denial and anger.
But Senator Patrick Leahy, the powerful chairman of the Senate Appropriations Committee, is yet to sign after warning last year that choosing Claver-Carone, a “polarizing American,” to lead the IDB would be harmful – would not help – the case for an increase in funding. It is also expected that some in the region who supported Claver-Carone when Trump was in power – such as Brazil and Colombia – could switch allegiance to appeal to the city’s new sheriff: President Joe Biden. .
“The argument that an underfunded bank is an opportunity for China is very compelling,” said Dan Restrepo, who served in the same role on the National Security Council as Claver-Carone during the Obama administration. “But that doesn’t respond to how you adequately fund the bank and with what leadership.”
When it comes to cyber disruption, the attack on the IDB was too small to cause concern beyond the bank. Last year, more than 10 million similar distributed denial of service (DDoS) attacks were observed around the world, according to digital security company NETSCOUT.
But in the midst of the IDB’s gala celebration, it was loaded with symbolism.
The bash in Washington was hastily organized after the Trump administration six months earlier rallied its allies to force the cancellation of the IDB rally in the Chinese city of Chengdu, which was supposed to be of some sort of party. for China a decade after joining the bank. .
As the United States tried to derail the meeting for months, China’s refusal to grant a visa to a representative of Venezuelan opposition leader Juan Guaidó gave him the opportunity to act decisively . While the IDB and most Latin American countries recognize Guaidó as Venezuela’s legitimate leader, China is a staunch ally of President Nicolás Maduro
Claver-Carone was the US official leading the diplomatic standoff with China at the IDB. As a senior White House official for Latin America, he was also the architect of “America Rising,” a program that sought to curb China’s incursions into Latin America, where it replaced the United States. United as the first trading partner of countries like Argentina, Brazil and Chile.
According to the IDB document, on September 19, 2019, traffic to the IDB website reached more than four times normal levels, forcing the main website and the publications page offline. At first, the bank defended itself by blocking individual IP addresses.
But then, “the attackers changed their tactics and started making requests from more than 15,000 IP addresses spread across China,” according to the internal document. “On Tuesday evening, 24th, all revenue traffic from China was blocked, a decision allowed us to come back online.”
Unstoppable, the attackers pivoted again, this time relying on 180,000 IP addresses from countries like Singapore and Japan. In all, the attack lasted for months but was effectively contained after three weeks when the bank turned to Amazon to build a more robust firewall.
While there is no indication that the site was breached, “the downtime affected our digital presence and negatively impacted various communication attempts,” the document says. “It also made our vulnerabilities explicit to third parties, which could potentially make us the target of further attacks and impact the reputation of the IDB brand.”
Yet it is impossible to know who was behind the attack.
While China has some of the most skilled hackers in the world, security experts say that doesn’t necessarily mean it’s behind the attacks. Poorly protected computers can be hijacked and gathered from anywhere in the world and turned into botnets to trigger DDoS attacks.
“Such a long targeted attack has an obvious financial or political motive: you don’t hang around for three weeks,” said Tord Lundstrom, digital security expert at Qurium, a Swedish non-profit organization. “But it’s very difficult to determine if China is behind this, or if someone is just trying to make it look like it is, without additional digital forensic information.”
The Chinese Foreign Ministry did not directly answer questions about whether the government was aware of the incident or was involved in the IDB, but said in a statement that it strongly opposed cyberattacks.
“Tying cyber attacks directly to a government is an extremely sensitive political issue,” the ministry statement said. “All parties should jointly solve the problem of piracy through dialogue and cooperation and avoid politicizing the problem.”
Claver-Carone declined to be interviewed while the IDB said it did not comment on internal cybersecurity issues. Nonetheless, three people from the bank told the PA they recalled that China was openly blamed for the attack during briefings in 2019 to discuss the fallout. People spoke to the AP on condition of anonymity to discuss internal deliberations.
On paper, China owns a tiny 0.004% of the IDB’s voting shares, the smallest stake of any of the bank’s 48 members. But membership has been a cheap way for China to expand its reach in Latin America. Chinese companies are able to bid on IDB-funded projects, rub shoulders with political leaders, and gain valuable economic information that would be more difficult to acquire on their own.
China is also the second largest non-borrowing shareholder of IDB Invest, the bank’s private lending arm, with nearly 6% of the shares, thanks to a reorganization in 2015 when the Obama administration refused to mobilize additional resources and shut down. having regard to the participation of the United States. diluted to 13%.
The IDB also manages a $ 2 billion fund made up entirely of contributions from China. Over the years, the IDB has also hosted more than a dozen trade summits connecting Latin American entrepreneurs and Chinese investors.
“For too long, the IDB was too friendly with the Chinese Communist Party,” Runde said. “The Bank and its shareholders did not hold China responsible when it ruined the IDB’s 60th anniversary. This overly warm relationship must change. “
China has made no secret of its strained relationship with Claver-Carone. In a symbolic rebuke, Yi Gang, the head of China’s central bank, abstained from voting at last year’s special meeting during Claver-Carone’s election, according to a person who attended the meeting. on condition of anonymity to discuss the closed session. discussion.
Rebecca Ray, a Boston University economist who tracks China’s investments in the region, said the delicate politics around China could be a double-edged sword. While Claver-Carone’s attempts to isolate Beijing may play well in the US Congress and help it secure additional funds, they could end up undermining the IDB’s mission at a time when the need for financing is great to build. infrastructure, improve health care and reduce poverty in the country. Region.
She noted that as the IDB is lagging behind other multilateral institutions in securing more financing, three Latin American countries – Brazil, Ecuador and Uruguay – have joined the Asian Infrastructure Investment Bank. , China’s response to the World Bank and which the United States opposes.
“Sidelining China could end up limiting China’s willingness to continue playing an active role, which would not be popular in the region,” Ray said. “As long as the need for financing remains high, countries will continue to look to China because that’s where the money is.”
Associated Press writer Joe McDonald in Beijing contributed to this report.
Joshua Goodman sur Twitter: @APJoshGoodman
Contact the AP Global Investigation Team at [email protected]