US cyber attacks traced to Chinese army unit ON THE outskirts of Shanghai, in a run-down neighbourhood dominated by a 12-storey white office tower, sits a People's Liberation Army base for China's growing corps of cyberwarriors. A growing body of digital forensic evidence - confirmed by US intelligence officials who say they have tapped into the activity of PLA unit 61398 for years - leaves little doubt that an overwhelming percentage of the attacks on US corporations, organisations and government agencies originate in and around the white tower. A 60-page study, due to be released on Tuesday by Mandiant, a US computer security company, tracks for the first time individual members of the most sophisticated of the Chinese hacking groups - known to many of its victims in the US as "Comment Crew" or "Shanghai Group" - to the doorstep of the unit's headquarters. Mandiant was not able to place hackers inside the white tower, but it says there is no other plausible way to explain why so many attacks come out of one comparatively small area. "Either they are coming from inside Unit 61398," said Kevin Mandia, the founder and chief executive of Mandiant, "or the people who run the most-controlled, most-monitored internet networks in the world are clueless about thousands of people generating attacks from this one neighbourhood." Mandiant provided an advance copy of its report to The New York Times. While Comment Crew has drained terabytes of data from companies such as Coca-Cola, increasingly its focus is on companies involved in critical US infrastructure - its electrical power grid, gas lines and waterworks. One target was a company with remote access to more than 60 per cent of oil and gas pipelines in North America. Contacted on Monday, Chinese officials in Washington insisted their government did not engage in computer hacking, and they described China as a victim of hacking. But security researchers say the Chinese attacks have multiplied significantly in recent years. Mandiant has detected more than 140 Comment Crew intrusions since 2006. US agencies say 20 or so other Chinese groups they track appear to be contractors linked to the unit. Mike Rogers, the Republican chairman of the House intelligence committee, said the Mandiant report was "consistent with the type of activity the intelligence committee has been seeing for some time." A spokesman for the National Security Council, Tommy Vietor, said: "We have repeatedly raised our concerns at the highest levels about cyber theft with senior Chinese officials, including in the military, and we will continue to do so." US officials say a combination of diplomatic concerns and the desire to follow the unit's activities kept the government from going public until now. For more than six years, Mandiant tracked the actions of Comment Crew, so named for the attackers' penchant for embedding hidden code or comments into web pages. What most worries US investigators is that the latest attacks focus on obtaining the ability to manipulate critical infrastructure. Mr Obama alluded to this concern in the State of the Union speech, without mentioning China. "Now our enemies are also seeking the ability to sabotage our power grid, our financial institutions, our air-traffic control systems," he said. We cannot look back years from now and wonder why we did nothing.