Lack of awareness towards cybersecurity calls for education reforms, expansion of insider threats protocols, and an increase of cyber defense investment.

In order to have a baseline defense against Chinese IP theft, the following must happen: create a sense of urgency, educate individuals, expand insider threat protocols, invest more in cyber defense, and issue harsher sentences for those that participate in intellectual property theft.

First and foremost, a sense of urgency within the U.S. populous needs to exist in order for change to occur. While the conducted survey data indicates that the average American citizen has a somewhat decent grasp on espionage efforts in the U.S., and who presents the largest threat in this realm, there is no immediate sense of urgency in regards to preparing for cyberattacks. When it comes to cyber threats, individuals tend to brush them off as the attack feels less personal, and the impacts are less explicit than a kinetic attack. This reality is amplified by how hard catching cyberattacks can be, especially for an employee working outside of cyber security. One might say that until a cyberattack financially hurts an individual, they will not care about cyber threats, or think that they could become the victim of such threats. Even though the survey data states that 59% of Americans believe cyber is the biggest national security risk, the average citizen brushes off their pertinence because their impacts are not imminent or grotesque. In reality, all Americans face cyber threats routinely, and this lackadaisical approach only emboldens China’s IP theft endeavors.

Through education, this lackadaisical mindset can be shifted away from complacency. These education efforts need to be presented through various channels, ranging from traditional education to information campaigns. As seen in numerous countries, cyber security needs to be taught as a core curriculum, and “volunteer cyber reservists” should be propped up around the United States. Teaching basic cyber security principles in traditional education can help mold future generations, and push back against Chinese IP theft. As emphasized, many Chinese IP theft tactics are rudimentary or rely on human error. Creating a sense of awareness around such tactics will enable the standard American to prevent such attacks if they ever face one themselves, and create fortified networks across the United States. Through so-called volunteer cyber reservists, individuals can come together to harden cyber security measures in their community, and places of employment. These volunteers would be educated by private corporations and government agencies alike, and take their newly acquired cyber security skills back to the areas that matter the most to them. By teaching every day Americans how to prepare for, defend, and recover from cyberattacks, the U.S. will become more resilient in the cyber warfare domain. This volunteer technique has been seen across Eastern European nations, and has yielded significant results.143

Thwarting insider threats is imperative in the IP theft fight. Data transferred through insider threats is likely the largest vector for American IP ending up in the hands of the CCP. Through bribes, or embedded spies, the CCP is able to syphon away desired data that insider threats hand over. Through proper, thorough, and thought-provoking insider threat training and policy, American corporations and institutions can decrease the likeliness of IP theft occurring at their corporation or institution. This would require thorough background checks, easy ways for reporting suspicious insider threat activity, systems of checks and balances, strongly worded and enforced standard operating procedures, and AI that can detect data moving illegally through computer systems.

Pragmatic policy is also needed to curb IP theft. The ramifications for those caught stealing intellectual property or conducting espionage activity is often far too small. Sentences of one to three years does not suffice when arbitrating the impacts of stolen military assets. Often, foreign nationals, serve short sentences and are sent back to their home country. Those caught stealing American military IP and American critical infrastructure IP should be adequately punished by the U.S. penal system to serve as a form of deterrence and proper punishment. As it currently stands, the incentives and bribes behind IP theft encourage insider threats, whereas the ramifications are not harsh enough to deter such actions.

Lastly, the U.S. must harden its cyber security through investment and budgetary allocation. The Department of Defense and the United States’ civilian agencies have copious amounts of money for such investments. The cyber domain is a neglected warfare domain in the United States. While this domain does not produce explosions or land invasions, it is an invaluable domain that adversaries such as the CCP exploit. By investing in cyber security across the board, the desired targets the Chinese intend to attack will be hardened and more impervious to such attacks. This concept is just as, or even more applicable to private corporations that the CCP has interests in. The points of entry for Chinese cyberattacks in private corporations is often ubiquitous, leaving holes in U.S. national security, and damaging the American economy. Companies neglecting cyber security investments, including training, must make improvements for the betterment of U.S. national security.