China's Health Sector Ambitions and Info Needs

China's Health Sector Ambitions and Info Needs

Speakers: Amelia Shapiro, Margin Research

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=bp4E9ri5Xd4

Overview

In this compelling DEF CON presentation, Amelia Shapiro of Margin Research delivered a critical analysis of the People's Republic of China's (PRC) strategic motivations for targeting US medical big data through cyber attacks. Shapiro's research, funded by ARPA, posits that China's national security and economic objectives are increasingly intertwined with the acquisition of foreign medical and genetic information, making the US healthcare sector a prime target for state-sponsored espionage. The talk systematically unpacks the underlying policy documents and strategic frameworks driving this interest, culminating in a stark prediction about the future of cyber threats to US medical infrastructure.

Shapiro argues that the seemingly academic or commercial nature of medical research and economic development belies a profound national security dimension for China. This military-civil fusion doctrine effectively elevates medical data to a strategic asset, justifying state-backed cyber operations. The presentation not only details China's long-term ambitions in biotechnology but also highlights a pivotal shift in how these ambitions are likely to be pursued. With recent US regulations aiming to restrict the legal export of sensitive genetic and proteomic data to China, Shapiro forecasts a significant uptick in cyber attacks as Beijing seeks alternative, illicit means to satisfy its insatiable demand for this critical information.

The implications of Shapiro's findings are profound for cybersecurity defenders across the healthcare and biotechnology sectors. By dissecting China's strategic playbook and identifying specific data types and technologies of interest, the talk provides a crucial early warning. It challenges conventional notions of cyber attack success, suggesting that an increase in detected intrusions into US medical data could paradoxically signal the effectiveness of new US export controls, while a lack of such activity might indicate successful, stealthy compromise and regulatory failure. This research serves as an urgent call to action for organizations holding valuable medical data to bolster their defenses in anticipation of an intensified threat landscape.

Background

▶ Watch: Introduction and talk objective (0:00)

The premise of China's interest in US medical data as a target for state-sponsored cyber attacks might initially appear counterintuitive, given the academic and commercial outputs typically associated with medical research. However, Amelia Shapiro meticulously deconstructs this perception by grounding her analysis in China's overarching national strategy of military-civil fusion. This doctrine dictates that commercial and academic endeavors, when aligned with national security goals, become legitimate targets for state-backed infrastructure, including cyber operations. This phenomenon has been observed across various sectors, from shipbuilding and semiconductors to vaccine development, demonstrating a consistent pattern of state involvement in commercial data acquisition once national security interests are invoked.

Shapiro's deep dive into China's central planning documents provides the foundational evidence for this strategic pivot. She specifically references the 14th 5-year plan for the bioeconomy, the 14th 5-year plan for pharmaceuticals, and the 14th 5-year plan for long-range objectives for 2035. These documents, increasingly adhered to under Xi Jinping's leadership, serve as authoritative blueprints for China's future development. Crucially, these plans highlight "big medical data integration" as a significantly emphasized, upstream goal. This upstream focus is critical because China employs a strategic development playbook, observed previously in sectors like electric vehicles, where controlling foundational elements allows them to accelerate downstream innovation and reduce reliance on external R&D.

The "upstream vs. downstream" strategy is a cornerstone of China's industrial policy. As demonstrated by Emily Debria's work on electric vehicles, China initially lagged in EV technology but gained dominance by controlling the upstream supply chain—acquiring mineral mines and then battery production capabilities, eventually leading to a robust EV manufacturing sector. Shapiro applies this same logic to the biotech sector. She argues that China views "medical data mines" – encompassing individual genetic and health data – as the foundational upstream asset. By consolidating this data into "big medical data" repositories, China can then drive downstream development in fields like precision medicine and stem cells, which are explicitly highlighted in the 14th 5-year plan for the bioeconomy and directly link to national security imperatives such as addressing population aging, fertility concerns, and overall public health resilience.

China's ability to execute this strategy leverages several competitive advantages that are often constrained in Western democracies. Unlike the US, which is bound by regulations like HIPAA, China faces fewer restrictions on consolidating vast amounts of medical data from disparate sources. The state's capacity to mandate genetic testing for large segments of its population further amplifies its data collection capabilities. These governmental powers, combined with targeted industrial policy incentives, provide China with a significant strategic edge in building comprehensive medical data reserves. The national security importance of this data is explicitly articulated in Chinese policy, with statements linking "biosafety" to the "health of the people, long-term stability of the country" and identifying bioinformatics and human genetic resource preservation as "national strategic research platforms." This explicit connection to national security underscores why the acquisition of such data is not merely an economic pursuit but a state-level imperative, justifying aggressive, state-sponsored methods.

Key Findings

▶ Watch: Diagramming China's 14th 5-Year Plan for Bioeconomy (3:20)

Amelia Shapiro's research identifies several key findings regarding China's aggressive pursuit of medical big data, demonstrating that this is not merely a theoretical interest but an active, multi-faceted strategy.

Firstly, China is actively pursuing foreign genetic data through various overt and covert channels. The speaker highlights China's plans to export high-end medical devices, genetic testing services, pharmaceutical R&D services, and internet diagnosis and treatment platforms. These seemingly commercial activities are, in fact, highly effective mechanisms for collecting foreign genetic and medical data. The motivation for collecting foreign data is multifaceted: it provides a broader genetic base for developing globally exportable medical solutions, fills gaps in China's domestic data (which may lack the fidelity or diversity of data from advanced healthcare systems like the US), and supports the development of AI and proteomics applications that thrive on large, aggregate datasets.

Secondly, China's domestic PRC data sharing laws play a crucial role in consolidating and controlling medical data. New regulations mandate that information collected about individuals in China must be submitted to the Chinese government. Furthermore, highly sensitive health data is often prohibited from export, effectively creating a walled garden of domestic data. This strategy ensures that China retains exclusive control over its population's medical information while simultaneously seeking to acquire foreign data. A notable example cited is BGI's controversial practice of establishing fertility clinics in the US and offering free prenatal tests to collect genetic data, which is then sent back to China.

Thirdly, the allocation of national funding underscores China's commitment to this domain. Shapiro analyzed aggregated NSSFC (National Natural Science Foundation of China) funding in medicine and life sciences, comparing it with investments in the national lab system. Her findings reveal a significant and disproportionate investment in "animal and human genetics," a highly specific sector, across both immediate-application research (NSSFC) and basic research (national labs). This sustained, high-level funding for genetics research signals a deliberate long-term strategy to build foundational capabilities in this area, reinforcing its strategic importance beyond immediate clinical applications like cancer medicine or neuroscience.

Based on these observations, Shapiro provides a clear picture of the types of medical data China is most interested in:

• Biotechnology big data research: Data that is "plug-and-chug," meaning it is easily formatted and readily usable in analytical programs, reducing the need for extensive data cleaning or specialized expertise.
• Data not easily accessible in China: This includes information from diverse genetic backgrounds, individuals in different circumstances (e.g., specific epigenetics data), people working in occupations uncommon in China that might have unique medical indicators, recipients of advanced medical care not widely available in China, or data related to climates unlike those prevalent in China.
• Infectious disease IP: While not extensively covered due to its well-known status as a target (e.g., vaccine companies), Shapiro places it high on the target list, underscoring its continued relevance.
• Software necessary to analyze big biomedical data: Beyond the data itself, the tools and platforms for processing and interpreting it are highly valued.
• Easily formatted biomedical data: Reinforcing the "plug-and-chug" preference.
• Technology that's upstream of medical data: This includes foundational technologies like genetic testing chips, an area where China is heavily investing in manufacturing.

Shapiro's most critical finding, however, is a predictive one: she anticipates a significant increase in state-sponsored cyber attacks targeting US medical data within the next year. This prediction stems from a recent DOJ regulation implemented in July, which banned the export of US genetic, proteomic, and other sensitive data, closing many previous loopholes and introducing severe penalties, including criminal charges. Historically, China has been able to legally acquire much of this data through investments, company acquisitions, or direct purchases. With these avenues now largely closed, Shapiro argues that China will not simply abandon its strategic goals but will instead intensify its cyber espionage efforts to obtain the data it can no longer legally purchase. This shift transforms the US medical sector into an even more critical battleground in the ongoing geopolitical competition.

Technical Deep Dive

▶ Watch: Big medical data integration: A critical upstream focus (5:40)

The technical deep dive into China's motivations for acquiring US medical data centers not on specific exploit techniques, but on the strategic value of the data itself and the architectural implications of China's "upstream" development playbook. At its core, China's approach is to control the foundational elements of the biotech ecosystem to accelerate its own innovation and establish global leadership.

The concept of "medical data mines" refers to the raw, granular health information of individuals, including genetic data, health records, lifestyle data, and proteomic data. This vast pool of information, particularly from diverse populations and advanced healthcare systems like those in the US, is considered the primary "upstream" resource. By consolidating and integrating this data into "big medical data" repositories, China aims to create an unparalleled resource for research and development.

The value proposition of this "big medical data" is multi-faceted:

1. Fueling AI and Proteomics: The proliferation of artificial intelligence (AI) and proteomics in medical research demands massive, high-fidelity datasets for training models and identifying patterns. "Plug-and-chug" data—medical information that is easily formatted and ready for automated analysis—is immensely valuable. This type of data reduces the need for extensive manual cleaning and preparation, accelerating the pace of discovery. US healthcare systems, with their advanced diagnostic equipment and comprehensive electronic health records, generate precisely this kind of rich, high-fidelity data that may not be as readily available or consistent within China's own healthcare infrastructure.
2. Diverse Genetic Baselines: Foreign genetic data is crucial for developing medical solutions with global applicability. Human genetic diversity means that drugs, therapies, and diagnostic tools optimized for one population might be less effective for others. By acquiring data from a wide range of ethnic backgrounds, China can develop more universally effective treatments and diagnostic tools, enhancing its export capabilities in the biotechnology sector. This is directly linked to China's stated goal of exporting high-end medical devices and pharmaceutical R&D services.
3. Accelerating Downstream Innovation: The "upstream" control strategy is designed to bypass or significantly reduce the need for extensive basic research and development. By having access to comprehensive medical data, China can more rapidly advance in "downstream" fields like precision medicine (tailoring medical treatment to the individual characteristics of each patient) and stem cell research. These areas are highlighted in China's 14th 5-year plans and are seen as critical for addressing national security concerns such as an aging population, declining fertility rates, and future pandemic preparedness. The ability to quickly iterate and innovate in these areas, informed by a vast data pool, gives China a strategic advantage.
4. Strategic Research Platforms: The emphasis on bioinformatics as a "national strategic research platform" in Chinese policy documents underscores the technical infrastructure required to process and derive insights from this big data. Bioinformatics involves the application of computational techniques to analyze biological data, particularly genetic and genomic information. Access to the raw data is only one part of the equation; the ability to efficiently analyze it using advanced software and computational resources is equally critical. Therefore, software necessary to analyze big biomedical data is also a high-priority target.
5. Epigenetics and Unique Conditions: The specific interest in data related to epigenetics, unique medical conditions tied to specific occupations or environments, and advanced medical care types unavailable in China points to a desire for highly specialized datasets. Epigenetics, the study of how behaviors and environment can cause changes that affect the way genes work, requires diverse environmental and lifestyle data. Acquiring this information from populations exposed to different climates, diets, and occupational hazards allows China to build a more comprehensive understanding of human health beyond its domestic data limitations.

In essence, China views medical data as the new oil for the biotech industry. The more diverse, comprehensive, and high-fidelity the data, the more powerful its AI models, the more robust its research, and the more effective its medical solutions will be. The technical "deep dive" here is into the architecture of strategic advantage that China is building, where data forms the bedrock of its ambitions to become a global leader in biotechnology, with direct implications for its national security and economic power.

Demo / Proof of Concept

▶ Watch: Understanding China's upstream-downstream development playbook (6:00)

This talk did not include a demonstration or proof of concept of a specific cyber attack technique. Instead, it focused on the strategic motivations, policy frameworks, and identified targets for future cyber espionage campaigns related to medical big data. Amelia Shapiro’s presentation was an analytical assessment of China's intentions and capabilities, rather than a technical showcase of an exploit or intrusion method.

Defensive Implications

▶ Watch: China's 'medical data mines' strategy in biotech (7:40)

The most significant defensive implication arising from Amelia Shapiro's talk is the urgent warning of a dramatic shift in China's approach to acquiring US medical data. Historically, China has leveraged legal and commercial channels, such as investments in US companies, direct data purchases, and the establishment of entities like BGI's fertility clinics, to collect sensitive genetic and proteomic information. However, the landscape has fundamentally changed with the implementation of a new DOJ regulation in July. This regulation effectively bans the export of US genetic data, proteomic data, and other sensitive information, closing many previous loopholes and imposing severe penalties, including criminal charges, for non-compliance.

Shapiro's core prediction is that China will not abandon its strategic goal of acquiring this data but will instead pivot decisively towards state-sponsored cyber espionage. This means that US healthcare organizations, biotechnology firms, research institutions, and any entities holding valuable medical data should anticipate a significant uptick in sophisticated, state-backed cyber attacks within the next year.

Defenders must recognize that the targeting will be strategic and diverse, reflecting China's broad interests:

• Hospitals and Healthcare Providers: These entities hold vast amounts of patient data, including electronic health records, diagnostic imaging, and potentially genetic information, making them prime targets.
• Genetic Testing Companies: Firms that perform genetic sequencing, analysis, and store genetic profiles are particularly vulnerable, as their core business revolves around the very data China seeks.
• Pharmaceutical and Biotechnology R&D Firms: Companies engaged in drug discovery, vaccine development, and advanced biotech research hold valuable intellectual property and experimental data, including clinical trial results and genomic data, which are directly relevant to China's bioeconomy goals.
• Academic Research Institutions: Universities and research labs that conduct cutting-edge studies in bioinformatics, precision medicine, stem cells, and epigenetics often house unique, high-fidelity datasets and proprietary research methodologies.
• Government-Managed Data Systems: Systems like those managed by the Department of Veterans Affairs (VA) or other government health agencies, which store comprehensive health records for large populations, are likely targets due to the consolidated nature of their data.
• "Upstream" Technology Providers: Companies involved in manufacturing or developing foundational technologies like genetic testing chips or specialized software for biomedical data analysis should also brace for increased targeting, as these are critical enablers for China's biotech ambitions.

Defensive strategies must therefore adapt to this evolving threat:

1. Enhanced Data Egress Monitoring: Organizations must prioritize robust monitoring for unauthorized data exfiltration, particularly of large datasets containing genetic, proteomic, and other sensitive health information. Traditional perimeter defenses may be insufficient against advanced persistent threats.
2. Intellectual Property Protection: Beyond raw data, the intellectual property associated with medical research, software, and device designs will be a high-value target. Strong IP protection measures, including access controls, encryption, and employee training on insider threats, are essential.
3. Vulnerability Assessments Focused on Data Holdings: Healthcare and biotech entities need to conduct thorough assessments to identify where their most valuable "upstream" data is stored, how it is protected, and its potential vulnerabilities. This includes understanding the data's format and its attractiveness for "plug-and-chug" analysis.
4. Threat Intelligence Integration: Staying abreast of specific threat actors and their tactics, techniques, and procedures (TTPs) targeting the healthcare and biotech sectors is crucial. Collaboration with government agencies and cybersecurity intelligence providers can provide early warnings.
5. Incident Response Preparedness: Given the anticipated increase in attacks, organizations must have well-rehearsed incident response plans specifically tailored to data breaches involving sensitive medical information.
6. "Odd Conclusion" Awareness: Shapiro's "odd conclusion" is a critical insight for policymakers and defenders alike: if the US does see a significant uptick in detected cyber attacks on medical information, it could paradoxically be a sign that the new DOJ regulations are effectively limiting legal data acquisition, forcing China into riskier, detectable cyber operations. Conversely, a lack of detected attacks might indicate that China's efforts are successfully stealthy, implying regulatory failure and ongoing, undetected compromise. This perspective suggests that detecting attacks, while undesirable, could be a metric of regulatory success.

Ultimately, Shapiro's talk is a call for proactive and intelligence-driven defense. The US medical sector must move beyond generalized cybersecurity practices to address a highly specific, state-sponsored threat driven by China's long-term national security and economic ambitions in biotechnology.

Key Takeaways

• China's Strategic Imperative: China views medical big data, especially genetic and proteomic information, as a critical national security asset, directly linking its acquisition to long-term stability, population health, and global biotechnology leadership under the military-civil fusion doctrine.
• Upstream Control Playbook: China is employing an "upstream" control strategy, aiming to dominate foundational medical data resources (e.g., "medical data mines") to accelerate downstream innovation in fields like precision medicine and stem cells, reducing reliance on external basic research.
• Shift to Cyber Espionage: New US DOJ regulations banning the export of sensitive US genetic and proteomic data will likely force China to shift from legal acquisition methods (investments, purchases) to intensified state-sponsored cyber attacks on US medical infrastructure.
• High-Value Targets: Organizations holding easily formatted "plug-and-chug" biomedical data, diverse genetic data, infectious disease IP, software for big biomedical data analysis, and upstream technologies like genetic testing chips are prime targets.
• Increased Threat Landscape: The US healthcare, biotechnology, and research sectors should anticipate a significant increase in sophisticated, state-backed cyber attacks within the next year, requiring enhanced vigilance and robust defensive measures.
• Paradoxical Success Metric: An uptick in detected cyber attacks on US medical data could paradoxically signal the effectiveness of US regulations in curbing legal data transfers, forcing China into detectable, illicit activities.

About the Speaker(s)

Amelia Shapiro is a researcher at Margin Research, an offensive security research company based in New York. Her work, as highlighted in this DEF CON talk, focuses on analyzing geopolitical motivations behind cyber attacks, particularly those originating from the People's Republic of China. Her research on China's health sector ambitions and information needs was funded by ARPA, underscoring its strategic importance. Shapiro specializes in dissecting complex policy documents and strategic frameworks to understand state-sponsored cyber targeting patterns.