On September 24, 2019, requests for more than 15,000 email addresses from across China flooded the bank’s portal, intermittently disabling parts of the service. To resolve the issue, the bank clamped down and blocked all traffic from China.
But the attackers persisted and as delegates gathered for a day of conferences with sportsmen, academics and television chefs, the bombardment intensified.
The details of the attack, which had not been disclosed until now, are contained in an internal IDB document accessed by the Associated Press.
The news of the attack circulates at a time when the new IDB president, Mauricio Claver-Carone, tries to use his tough stances towards China, which come from his time in the Donald Trump government, to contain those who have not yet digested his election last year in a very tense process.
Claver-Carone, former senior director of the Western Hemisphere affairs section of the National Security Council, led the IDB’s annual meeting last week for the first time since he was elected despite objections from Democrats and some governments upset that the tradition of appointing Latin American representatives to that position was ignored.
A geopolitical ideologue, Claver-Carone seems to have no inclination to stop fighting Beijing’s growing influence in Washington’s backyard.
Unlike his predecessor, Colombian Luis Alberto Moreno, who promoted Chinese investments in the region, Claver-Carone recently raised the possibility of inviting Taiwan, which Beijing considers part of its territory.
By resisting Chinese influence, Claver-Carone tries to win support among the Democratic Party, which questions his leadership but shares his distrust of Beijing.
If he succeeds, the Democrats can help him achieve the main goal of his unorthodox candidacy: America’s backing of an increase in the bank’s capital so that it can help the region emerge from the pandemic recession. of the coronavirus, which is the worst in more than a century.
There are some signs that you are making progress. This month, a group of lawmakers from both parties led by Senator Bob Menéndez, head of the Senate Foreign Relations Committee, proposed legislation authorizing a $80 billion capital increase, which would increase lending capacity by 60%. from the Washington-based bank.
“People have to accept that they won,” said Dan Runde, a former official at the Agency for International Development under the George W. Bush administration and an expert on multilateral institutions at the Center for Strategic and International Studies.
“Those who are not happy have not yet gone through the five stages of the duel. They are stranded between denial and anger.”
Senator Patrick Leahy, powerful chairman of the Senate Budget Appropriations Committee, has yet to endorse him. Last year he described Claver-Carone as a “divisive” figure and said his appointment would not help, but would harm, efforts to increase the bank’s lending capacity.
And there are those who believe that some who supported Claver-Carone when Trump was in the White House, such as Brazil and Colombia, could turn their backs on him to ingratiate themselves with the new Joe Biden government.
“The argument that a bank without sufficient funds represents an opportunity for China is strong,” said Dan Restrepo, who served as Claver-Carone at the CNS during the Barack Obama administration. “But that does not resolve the issue of how you adequately finance the bank, with that leadership.”
As for cyberattacks, the IDB was too small to generate alarm beyond the bank itself. Last year there were more than 10 million distributed denial of service (DDoS) attacks worldwide, according to digital security firm NETSCOUT.
But the fact that it occurred in the middle of the IDB celebration gave it a special symbolism.
The celebration in Washington was organized hastily, six months after the Trump administration gained enough support to cancel an IDB meeting in the Chinese city of Chengdu, which was to be a kind of Chinese launch party a decade after join the bank.
The United States spent months trying to derail that meeting and the Chinese decision to deny a visa to a representative of the Venezuelan opposition leader Juan Guaidó gave him the opportunity he needed.
The IDB, like the United States and a good part of the Latin American countries, recognizes Guaidó as the legitimate leader of Venezuela, while China firmly supports the government of Nicolás Maduro.
Claver-Carone was the US official who handled relations with China at the IDB. He was also the main link of the White House with Latin America and the architect of “America Crece”, a program that sought to contain Chinese advances in Latin America, where China displaced the United States as a main trading partner in countries such as Argentina, Brazil and Chili.
According to the IDB document, on September 19, 2019, traffic on the IDB portal more than quadrupled, disabling the main page and the publications page. The bank initially responded by disabling individual IP addresses.
But “the attackers changed tactics and began sending requests for more than 15,000 IP addresses from all over China,” according to the internal document. “By the night of Tuesday the 24th, all Chinese traffic had been blocked, a decision that allowed us to restore the bank’s online service.”
The attackers insisted, this time using 180,000 IP addresses from different countries, including Japan and Singapore. In total, the attack lasted for months, but was brought under control after three weeks, when the bank turned to Amazon to build a stronger firewall.
Although there is no indication that the system was penetrated, “the time disabled affected our digital presence and had a negative impact on different communication activities,” the document stated. “It also revealed our vulnerabilities to third parties, which could make us the target of further attacks and affect the IDB’s reputation.”
It is impossible to know who was behind the attacks.
China has some of the best hackers in the world, but security experts say that doesn’t mean it is behind the attacks. Computers that are not well protected can be controlled from anywhere in the world and turned into botnets that launch DDoS attacks.
“Such a prolonged attack is obviously financially or politically motivated. You don’t trolle for three weeks,” said Tord Lundstrom, a digital security expert at Qurium, a Swedish non-profit organization.
“But without additional digital forensic information, it is difficult to determine whether China was behind it, or was it someone who wanted to create the impression that it was.”
The Chinese foreign ministry did not respond to questions about whether the government was aware of what happened to the IDB or whether it had been involved, but said in a statement that it strongly opposes cyberattacks.
“Connecting cyberattacks directly with a government is a very sensitive political issue,” the statement said. “All parties should jointly resolve the hacking issue, through dialogue and cooperation, and avoid politicizing the issue.”
Claver-Carone withdrew from being interviewed and the IDB said it does not comment on internal cybersecurity issues.
However, three people from the bank told the AP they recall that China was openly held responsible for the attacks at a 2019 meeting about the repercussions of those efforts. People spoke on condition of not being identified to comment on internal deliberations.
China has just 0.004% of the voting shares in the IDB, the smallest percentage among the bank’s 48 members. But its admission is a cheap way to expand its presence in Latin America.
Chinese firms were able to participate in bids for IDB-financed projects, rub shoulders with political leaders, and obtain valuable economic information that would have been difficult to obtain through other means.
China, on the other hand, is the second largest non-credit shareholder of IDB Invest, the bank’s arm that offers private loans, with almost 6% of the shares, thanks to a 2015 reorganization, in which the Obama administration was It declined to offer additional resources and the US share was reduced to 13%.
The IDB also manages a fund of 2 billion dollars, the product entirely of contributions from China. Over the years the IDB has organized more than a dozen business meetings to connect Latin American firms with Chinese investors.
“Too long the IDB has had very cordial relations with the Chinese Communist Party,” Runde said. “The bank and its shareholders did not hold China to account when it ruined the IDB’s 60th anniversary. This close relationship has to end ”.
China does not hide its strained relationship with Claver-Carone. In a symbolic rejection, Yi Gang, the head of the Chinese central bank, abstained from voting at last year’s special meeting in which Claver-Carone was elected, according to a person who participated in the meeting and asked not to be identified as being commenting on a meeting behind closed doors.
Rebecca Ray, an economist at Boston University who studies Chinese investments in the region, said the China issue can be a double-edged sword. While Claver-Carone’s efforts to isolate Beijing may sit well with the US Congress and help it secure more funding, at the same time they may end up undermining the IDB’s mission at a time when a lot of help is needed to finance infrastructure construction. , improve health systems and reduce poverty in the region.
He highlighted that the IDB is behind other multilateral organizations when it comes to fundraising and that three South American countries – Brazil, Ecuador and Uruguay – had joined the Asian Infrastructure Investment Bank, the Chinese response to the World Bank, which the United States opposes.
“China’s marginalization may affect the willingness of the Chinese to play an active role, something that would be frowned upon in the region,” Ray said. “As long as funding is needed, countries are going to keep turning to China because that’s where the money is.”