ON JUNE 1, 2009, emails with the heading ''China and Climate Change'' dropped into the inboxes of five US State Department officers.
The five officers, working in the Office of the Special Envoy for Climate Change, were involved in preparing for delicate bilateral climate change talks in Beijing in several days.
The email appeared to be from a respected economics columnist at a well-known US journal and contained information designed to be of particular and direct relevance to the five staff.
Attached to the email was a PDF file also titled ''China and Climate Change''. Unknown to the staff, lurking within the file was a piece of sophisticated malicious code (malware) known as Poison Ivy.
If the file was opened, Poison Ivy, a type of program known as a remote administration tool or RAT, would slip onto the target's computer and allow the sender nearly complete control over the system.
''The event appears to be a targeted spear-phishing attempt and may be indicative of efforts to gather intelligence on the US's position on climate change issues,'' an officer with the department's Cyber Threat Analysis Division wrote in a secret State Department cable sent three weeks later.
While that intrusion attempt was blocked, it provides a brief glimpse of a shadow war being waged in cyberspace between hundreds of countries, as they at once take advantage of the massive and anonymous reach of the internet, and find themselves besieged by it. The increasing regard the Western world is giving cyber threats was reinforced this week when Australia and the US announced they were adding cyber warfare to the 60-year-old ANZUS treaty.
And, as a series of classified US diplomatic cables released by WikiLeaks since last year show, China is leading the charge.
The revelations, in the ''cyber threat'' section of a regular State Department cable regarding security concerns during 2008 and 2009, reveal a previously unseen world of cyber spying and intrusion, all centred on one classical-sounding US code phrase.
''Byzantine Hades … a cover term for a series of related computer network intrusions with a believed nexus to China, has affected US and foreign governments as well as [security] cleared [defence] contractors since at least 2003,'' a cable on November 5, 2008, explains.
Professor Alan Dupont, one of Australia's leading strategic experts and the director of Sydney University's Centre for International Security Studies, says despite the refusal of government to discuss it publicly, China has clearly been a big player in the world of cyber espionage for some time.
''The broad international view, based on a fair bit of empirical evidence, is that China is one of the countries at the forefront of cyber attacks on other states, which it is doing for fairly obvious reasons - intelligence gathering, political and strategic advantage, and also for defensive purposes,'' he says.
Such reasons include political and strategic advantage, intelligence gathering and the need to control the internet which, as the Arab Spring has shown, can be a powerful tool of destabilisation.
Until the release of the State Department cables, however, the public was in an information void about China's activities.
In a November 2008 cable, a diplomat describes a recent conference held by the German domestic security agency, Bundesamt fuer Verfassungsschutz (BfV).
There the BfV briefed other countries on its analysis of the ''cyber threat posed by the People's Republic of China (PRC), which appears to mirror conclusions drawn by the US intelligence community'', the diplomat noted.
''The BfV surmises the intention of PRC actors is espionage, and the primary attack vector used in their malicious activity is socially engineered email messages containing malware attachments and/or embedded links to hostile websites.''
The BfV told its top-secret audience that in the 12 months to October 2007 it had discovered 500 such operations conducted against a range of targets including military, economic, science and technology, commercial, diplomatic, research and development, as well as high-level government systems.
''The socially engineered email messages delivered to German computer systems were spoofed to appear to come from trusted sources and contain information targeted specifically to the recipient's interests, duties, or current events,'' the diplomat noted.
Within the email, in an attachment or via a link to a website, lurked sophisticated malware.
Such code either ''hoovered up'' classified information directly or installed an unseen program which allowed remote control of the system by the hacker.
Of particular interest was the suggestion that a spike in such activity was noticed immediately before German government or private industry negotiations involving Chinese interests.
It is understood that Australian intelligence agencies have noticed similar spikes before delicate negotiations involving similar interests.
The cables reveal that such activity has been happening for many years, with a cable from the US embassy in The Hague in October 2005 discussing ''recent cyber operations originating from China'' that were targeting US logistics and defence acquisition programs.
Australia is not immune. Earlier this year it was revealed that spies - suspected to be Chinese - hacked into the parliamentary computers of at least 10 federal ministers, including the Prime Minister and the ministers of foreign affairs and defence.
The government has tried to keep it quiet, but the intrusions are understood to have led to several more incidents which have compromised several important systems.
Both the head of ASIO, Director-General of Security David Irvine, and the Attorney-General, Robert McClelland, have recently become more vocal about the cyber threat.
''It seems the more rocks we turn over in cyberspace, the more we find,'' Irvine told business leaders in a speech in July.
''Electronic intelligence gathering is now a huge industry. It is being used against Australia on a massive scale to extract confidential information from governments, the private sector and ordinary individuals.''
In comments provided to the Fairfax for this article, McClelland agrees with that assessment.
"Attacks are becoming increasingly more sophisticated and targeted. This ranges from your average email scam to full-blown cyber espionage and attacks on our systems,'' he says.
And though neither Irvine nor McClelland would admit it, it appears that knowledge of cyber espionage goes all the way to the top of the Chinese political system, according to a State Department cable from the Beijing embassy in January 2010.
US diplomats spoke to several well-placed sources who revealed that persistent intrusions into Google's Chinese servers in 2009, dubbed Operation Aurora, had been overseen by two members of the Politburo Standing Committee, the most powerful decision-making body in China.
''[The source] stated that PRC operations against Google were 'one hundred per cent' political in nature,'' the cable stated.
One of those Politburo members, Li Changchun, had entered his own name in Google's worldwide site and found results critical of him. As a result ''Li believes Google is a 'tool' of the [US] being used to 'foment peaceful revolution in China'."
Another facet of the Chinese use of cyber espionage is the way it has co-opted its private sector into such activity. In a cable on June 29, 2009, a Beijing-based State Department cyber security officer discussed the role of Chinese digital security mogul He Weidong in China's cyber regime.
He owns the digital security company Tianrongxin, commonly known as TOPSEC. The company is a big player in the Chinese market and has been given access to Microsoft's source code through the Chinese digital security certification program.
But the cable revealed that when TOPSEC was established in 1995 half of its seed money came from the government and it also undertook research and development work for the government.
At the end of cable the State Department officer noted: ''[This] illustrates the PRC's use of its 'private sector' in support of governmental information warfare objectives, especially in its ability to gather, process, and exploit information.
''As evidenced with TOPSEC, there is a strong possibility the PRC is harvesting the talents of its private sector in order to bolster offensive and defensive computer network operations capabilities.''
Despite such mounting evidence linking China to state-sponsored cyber espionage, it maintains it plays no role in such acts.
When Fairfax recently asked the Chinese embassy in Canberra about the allegations of cyber espionage, an embassy spokeswoman replied via email that the Chinese government attached great importance to cyber security.
''The Chinese government staunchly opposes and fights in accordance with law any criminal activity including hacking that may cause damage to the internet and computer networks,'' she said.
''Hacker attack is an international issue, to which China also falls victim. The allegation that China is behind the hacker attack is a complete fabrication out of ulterior motives.''
But it would shortchange hardworking cyber spies the world over to suggest the Chinese are the only ones involved in the latest iteration of the Great Game.
''All states are engaged in cyber activities for both defensive and offensive reasons, and China is no different,'' Dupont says. ''If you're asking who has the best cyber security capabilities, I would rank the United States, Britain, Israel, Russia ahead of China at this stage.''
Dupont points to an important article in Foreign Affairs last year by the US Deputy Secretary of Defence, William Lynn. He wrote that more than 100 foreign intelligence agencies were trying to hack US networks.
As internet use grows - it has soared from about 360 million people in 2000 to more than 2 billion last year - so does its usefulness to a whole range of countries and groups seeking to influence world events.
The events surrounding WikiLeaks's release of the US diplomatic cables themselves are proof of the growing ubiquity of the web, and how it is becoming increasingly fundamental to all manner of state control and individual dissent.
''The speed at which this morphed from a nuisance to a strategic threat has been staggering. It has really happened at warp speed, in a very brief period of time - probably during the last five years,'' Dupont says.
''Even experts are finding it difficult to keep up with the rate of change in the diversity and sophistication of cyber attacks.''
A powerful example of Western intelligence agencies' involvement in such action was the sabotage last year of Iran's Natantz uranium enrichment plant, part of a program whose ultimate aim, the West believes, is acquiring nuclear weapons.
Following reports that the plant's uranium production had significantly dropped, in June 2010 security experts uncovered elements of a worm which had infiltrated the plant's command and control system and caused significant damage.
Named Stuxnet, it has since been labelled a ''game changer''. It is believed to have taken as long as a year to create, relied on impressive technical expertise and high-level intelligence gathering, and was even rumoured to have been tested in a mocked-up version of the Natantz facility.
All these things suggested it could not have been the work of the usual patriotic hackers - Stuxnet was clearly the product of a technically sophisticated nation.
Ralph Langner, a German computer security consultant and the first expert to assert that Stuxnet was designed to attack Natantz, said in September 2010 that the fingerprints of Israel's spy agency, Mossad, were all over its code.
If that wasn't significant enough, five months later and after further examination of the code, he told a conference that Mossad did not appear to have been the ''leading force'' behind Stuxnet.
''The leading force behind that is the cyber superpower. There is only one, and that's the United States,'' he said, before adding, ''fortunately, fortunately. Because otherwise, our problems would even be bigger.''
Another example of Western cyber espionage occurred in June last year, when al-Qaeda's Yemeni offshoot released onto the internet its new English-language magazine Inspire.
Designed to appeal to Muslims living in Western countries, it included an article titled ''How to make a bomb in the kitchen of your mum'', which included details and ingredients needed to make a bomb.
But when would-be jihadis downloaded the article magazine they discovered a series of recipes for "The Best Cupcakes in America" published by the Ellen DeGeneres chat show.
It emerged the British spy agency MI6 was behind the hack, and that the Pentagon had considered a similar operation, but abandoned it after the CIA objected, saying it would expose sources and deny them an important source of intelligence.
And with the rapid rise of the cyber threat, there'll soon be cupcakes enough for everyone.
