China’s Cyber Crisis Management
Illustration by Nate Christenson

China’s Cyber Crisis Management

by Adam Segal
September 26, 2023

This chapter defines three types of cyber crisis that pose risks to China and assesses the agencies, authorities, and procedures that Chinese policymakers have developed to manage such crises.



China’s increasing dependence on and presence in cyberspace raises the risk of three types of cyber crisis for Beijing. First, like all modern states, China must defend, detect, contain, and respond to a domestic cyberattack that could have widespread destructive or disruptive effects on its economy and society. Second, it must prepare and respond to a potential diplomatic and foreign policy crisis created by reactions to Chinese cyberoperations that fall below the threshold for the use of force or armed attack. Third, during any border or maritime crisis, Chinese cyberoperations will be conducted to collect intelligence and possibly to signal, coerce, and deter adversaries. Chinese policymakers must manage the use of cyber tools during any military or diplomatic crisis and ensure that they do not inadvertently lead to escalation or loss of control. China has been developing institutions, regulations, and processes that should improve its ability to manage these three types of crisis.

  • While China has many new institutions and procedures to manage a domestic cyber crisis, the system’s effectiveness during a cyber crisis remains unknown. Analogous experiences of crisis management suggest that China will struggle with the informal information flows and the public-private partnerships essential in the first stages of response.
  • The worsening of the Sino-U.S. relationship makes the management of a political crisis provoked by Chinese cyberindustrial espionage significantly more difficult to control, but also less likely to happen. Both sides can be expected to accept cyberespionage as a constant in the relationship and are therefore less likely to react to the other’s complaints or criticism of cyberoperations.
  • China can be expected to conduct cyber intelligence operations during a crisis and may use more disruptive or destructive attacks for signaling, coercion, or deterrence. The nature of cyberspace and Chinese approaches to cyber complicate signaling and raise the risk that cyberoperations could exacerbate a crisis and provoke a kinetic response.

Adam Segal is a Senior Advisor in the Bureau of Cyberspace and Digital Policy at the U.S. Department of State.

The views expressed do not represent the U.S. Department of State or its policies, or those of the U.S. government.