Cyber Clash With China (NSC)

Fictional, set in the present day. Cyberspace is a new domain of conflict that has few accepted standards of behavior. Basic questions about it—including how countries should respond to cyberattacks—are still unresolved. In recent years, China has exerted authority over areas of the South China Sea also claimed by other Asian countries, leading to tension with the United States. Last week, following several near misses in the South China Sea between U.S. and Chinese military vessels and aircraft, as well as the theft of documents from U.S. military networks, the U.S. Air Force conducted a flight near a shoal claimed by China. Three days later, the Nasdaq stock market was hacked, which significantly harmed the U.S. economy. U.S. intelligence agencies believe some in the Chinese government knew about the attack, for which a Chinese hacker collective claimed credit. National Security Council members need to advise the president on the merits of a cyber response, economic sanctions, or military measures.

China, Brunei, Malaysia, the Philippines, Taiwan, and Vietnam have competing territorial claims in the South China Sea. In recent years, China has exerted authority over the area by increasing the size of existing islands or creating new ones. China has also constructed ports, military installations, and airstrips. The United States has promoted the right of military vessels to operate in China’s claimed two-hundred-mile exclusive economic zone. Furthermore, the United States has rejected China’s claim to a twelve-mile territorial zone around the artificial islands it has built. Since 2015, the United States has signaled its opposition by flying military aircraft and sending U.S. Navy ships near certain islands.

Last week, the U.S. Air Force conducted a flight near a shoal claimed by China in the South China Sea. Three days later, the Nasdaq Stock Market suffered a hack that damaged computers and forced the suspension of trading for two days. This imposed significant costs on various U.S. companies and dented confidence in the U.S. financial system. An underground hacker collective based in China known as the Zheng He Squadron has claimed responsibility for the hack. The group has known ties to the People’s Liberation Army, China’s military. U.S. intelligence agencies assess with 90 percent certainty that the hack occurred with the knowledge or support of parts of the Chinese government. Beijing claims no knowledge of the attack. The president has convened the National Security Council to discuss how the United States should respond. 

CFR Education extended simulations use a variety of pedagogical tools to create an effective, meaningful, and memorable learning experience for students that builds their global literacy. Students will develop crucial skills such as critical thinking, communication, collaboration, and creativity. Students will complete authentic assessments that feel relevant: instead of five-paragraph essays and book reports, students will write policy memos and participate in a role-play of a meeting of a foreign policy–making body. There are no right or wrong answers in actual policy deliberations, and there are none here, either; students will walk away from this experience with an appreciation for the complexity of policy questions.

In this simulation, students will learn about the National Security Council, as well as meeting these learning outcomes specific to this simulation:

Concepts

Issues

This section presents context, potential benefits and drawbacks, and other information about the policy options outlined in the case that you may find helpful as you guide the role-play and assess students. 

The United States has an interest in ensuring that China does not assert its sovereignty claims over the South China Sea by using force or intimidation. Washington has sought to secure this interest through freedom of navigation operations—sending ships or aircraft into areas that China claims but that the United States considers open to all—as well as increased military exercises with its allies in the region. The United States also has an interest in defining the rules of behavior for cyberspace. It has tried to strengthen deterrence by building up offensive capabilities. It has demonstrated its ability to attribute attacks, indicting foreign hackers, and levying sanctions. It has also promoted norms of behavior through bilateral agreements and multilateral forums. 

The principal policy options available in this case are discussed below. These responses are available individually, in combination, or all together.

Cyber Responses

The United States could pursue a proportionate response. The United States could try to disrupt critical networks within China, such as its banking system, for a limited period. The attacks could also be directed at a target that seems particularly valuable to the Chinese leadership. These attacks could be focused on the censorship technology that constitutes the so-called Great Firewall. The U.S. response should be accompanied by some level of attribution. This means that the United States would need to identify the attackers, and the attack would reveal some of the United States’ technical and intelligence capabilities.

With this option, the United States would essentially be responding in kind. This would keep the U.S.-China dispute in the domain (cyberspace) it is already in rather than extending it. Even if the conflict were to escalate, Washington could claim that it was not the instigator. The United States would likely be capable of mounting a targeted cyberattack that stood a good chance of producing the desired effect.

Nonetheless, a cyber response has costs and risks. A cyberattack could fail if the defender has already patched the vulnerability. Given China’s extensive connection with the global economy, malware used against China could also quickly spread to the rest of the world. This could infect U.S. allies and eventually make its way back to the United States. Although limited to one domain, cyberattacks could also escalate rapidly. If attacks damage Chinese defense networks, Beijing could fear that a conventional strike could soon follow. In this scenario, China could decide to launch conventional strikes on U.S. military assets as quickly as possible. Chinese economic retaliation—such as sanctions or tariffs—against the United States is also possible. In addition, other countries could find U.S. claims of China’s guilt unconvincing. Failing to convince others that the Chinese government was behind the attacks would not only limit support for the U.S. response but also undermine Washington’s efforts to develop international norms for behavior in cyberspace. 

Punitive Sanctions

In April 2015, Obama issued an executive order that laid the groundwork for economic sanctions. Declaring a national emergency to deal with the threat of “significant malicious cyber-enabled activities,” the order enabled the treasury secretary to sanction individuals and entities involved, directly or indirectly, in cyberattacks. Possible sanctions include freezing suspects’ financial assets and barring commercial transactions with them. In the current scenario, the White House could sanction high-level Chinese authorities who it believes ordered the attack and levy economic sanctions on government entities and state-owned enterprises deemed to be connected to the hacks. It could also expel Chinese diplomats from the United States. 

Another response would be to indict the individual hackers involved. Although these individuals are unlikely to ever be handed over to U.S. authorities for trial, their international travel would be limited, and the indictments could deter future Chinese hackers who wish to someday travel abroad. Punitive sanctions would involve identifying the attackers and revealing some U.S. technical and intelligence methods. 

It could take a while for economic sanctions to be imposed. However, it could take even longer for them to cause enough damage to affect the target’s behavior. Chinese firms could also skirt financial restrictions by trading with Russia or others, and China could retaliate against U.S. companies that heavily export to China. The U.S. response could appear weak, undermine deterrence, and embolden other cyberattackers. The United States would need to convince others that the Chinese government was behind the attacks. Otherwise, support for U.S. sanctions would be limited, possibly reducing their effectiveness. 

Military Responses

Washington could increase freedom of navigation operations and the U.S. military presence more broadly in the South China Sea. It could help small countries build maritime law enforcement and security capacity and in particular improve the Philippines’ long-term maritime capabilities. The United States could also expand military exercises with countries in the region.

Such a response is clear and well within the capability of the U.S. military and would also convey the United States’ resolve. Washington could announce that its military initiatives were in response to the Chinese cyberattacks. It could also refrain from doing so. Connecting the response to the attack publicly could be more escalatory. However, it would have the advantage of marking a clear response to the Chinese behavior, ideally leading Beijing to reduce or end this activity. Not making the connection public would be less provocative but could signal to potential attackers that cyberattacks such as the one against Nasdaq fall below the threshold for a forthright response. Regardless of whether the United States announces the connection, military steps could escalate Chinese reclamation behavior in the South China Sea. It could also lead to an incident that escalates into military conflict. Moreover, U.S. support could also embolden the smaller countries to push China harder than they would dare to alone.

CFR Education extended simulations are project-based learning activities. Project-based learning (PBL) leads to better learning outcomes and improves skills, and is more fun than traditional instructional methods. The website that students will navigate throughout the simulation is divided into several parts:

In the NSC Guide, students will learn about the National Security Council, the body they will be simulating. Included are details on its history, how it works, who its major players are, and more. There is also a video interview with experts who have served on the body.

In the Case Notes, students dive into the actual situation they will be trying to solve in their simulation. At the beginning is a clear decision point: the question that students will debate during the role-play. This is followed by detailed background material and a discussion of the role that the United States plays.

Preparation and Role-Play includes details on the various roles students could take on, guidelines for the memorandum they will write (the student playing the role of president has a slightly different task), as well as an outline of how the discussion will flow during the role-play.

The Wrap-Up is an important part of the project and includes reflection questions and guidelines for reflecting in a class discussion and in a second memorandum. For historical cases, this section also includes a short description of how the decision point was addressed by policymakers in real life.

The simulation also includes Student Resources, which include a reading list to support research, additional directions and exemplars for writing assignments, and other tips students may find helpful.

Once students have read the simulation and prepared their position memos, here is how we recommend structuring the role-play:

Tips for the National Security Advisor
In Round 1, call on everyone for their opening statements, keeping to a strict time limit—if students have more to say, they can say it in Round 2. The president doesn’t have a specific time limit, but you should keep things moving by not letting the president get bogged down on one issue or policy option.

In Round 2, students do not need to follow a prescribed speaking order; you can call on them as they raise their placards. Work to include everyone and prevent anyone from dominating. As debate goes on, remind students they can change their minds. If it will help move things along, help students see when they are agreeing with each other without realizing it. Feel free to pose questions or propose discussion topics if you feel that certain issues are not receiving adequate consideration. Ultimately, it’s up to you to judge when Round 2 has run its course and it is time to move on to Round 3. You will want to move on when all policy options have been discussed and all of the president’s questions have been answered. The room does not need to come to a consensus—every option just needs to have a fair airing.

In Round 3, ask students to make a final case for their positions. If, during the course of the discussion, some students seem to have coalesced into blocs, you could ask one student to present on behalf of the bloc. If consensus seems possible, you could work toward it; if not, just make sure each option has been clearly presented to the president. Remember, the NSC is not democratic and is an advisory, not decision-making, body. There is no vote, and the president does not need to choose the most popular option.

Tips for the President
Before Round 1, review all the position memos, if you can. During Round 1, as students are presenting their opening statements, you can ask questions to clarify or help draw out the differences between one policy option and another. Try not to get too deep in the weeds, though—that is what Round 2 will be for.

In Round 2, you can take a more active role. If you have concerns about a policy option, ask questions; if some policy options seem stronger than others, say so. If an element of the issue is not being discussed, raise it.

In Round 3, once you have heard all the policy options, it is all down to you. You should choose whichever policy option you think is best, or combine the strongest elements of several different options. Remember, the NSC is not democratic and is an advisory, not decision-making, body. There is no vote, and you do not need to choose the most popular option. Your decision must be made and announced before the wrap-up discussion, although the written presidential directive can come later.

Tips for Online Classes

We suggest conducting the role-play in three rounds, and that three-round structure is a helpful way to approach chunking the role-play for online learning as well. You can conduct each round synchronously or asynchronously.

In round one, participants present their positions.

In round two, participants debate the various policy options.

In round three, debate begins to coalesce around the policy options that the president favors.

To add spice or challenge to the role-play, partway through the discussion throw in one of the following flashpoints—additional hypothetical developments that fit within the case’s existing decision point—or create your own. 

After introducing a flashpoint, you might want to help students refocus their discussion by considering critical questions such as these:

Each CFR Education extended simulation involves writing assignments that help students think through policy options and reflect on their learning experience.

In NSC cases, there are three types of writing assignments.

Simulations (on the student-facing side) have instructions for written assignments, and samples for each of these writing exercises. You can also find sample rubrics below.

Samples:

Below are sample rubrics for your use in assessing the writing students will do as part of this extended simulation.

These are single-point rubrics. Jennifer Gonzalez, who writes the blog Cult of Pedagogy, has a great explainer, but the bottom line is that single-point rubrics are relatively easy for students to digest but still have all the advantages of giving structure to instructors’ feedback.

NSC Position Memo Rubric

NSC Presidential Directive Rubric

NSC Written Reflection Rubric

Downloadable rubrics are available here: