Exclusive | Cyber attack tied to China boosts development bank’s chief

Mauricio Claver-Carone, deputy assistant to President Donald Trump and senior director for Western Hemisphere affairs arriving in La Paz, Bolivia (January 2020)

The cyberattack crested just as finance officials from across Latin America were descending on Washington to commemorate the 60th anniversary of the Inter-American Development Bank.
On Sept. 24, 2019, requests from more than 15,000 internet addresses throughout China flooded the bank’s website, knocking part of it intermittently offline. To unclog the network, the bank took the drastic step of blocking all traffic from China.
But the attackers persisted, and as officials gathered for a day of conferences with athletes, academics and celebrity chefs the bombardment intensified.
Details of the attack, which has not been previously reported, are contained in an IDB internal document reviewed by The Associated Press.
News of the attacks is surfacing just as the bank’s new president, Mauricio Claver-Carone, seeks to leverage his hawkish views on China from his time in the Trump administration to outmaneuver those in Washington and beyond still fuming over his politically charged election last year.
Claver-Carone, the former National Security Council’s senior director for Western Hemisphere affairs, chaired last week in Colombia his first annual meeting of the IDB since he was elected last fall over the objections of Democrats and some regional governments who complained he was breaking the longstanding tradition of a Latin American being at the helm.
A geopolitical ideologue, Claver-Carone seems in no rush to abandon his disdain for Beijing’s growing influence in Washington’s backyard. In sharp contrast to his predecessor, Luis Alberto Moreno of Colombia, who eagerly promoted Chinese investment in the region, Claver-Carone recently floated the possibility of inviting Taiwan, the island democracy claimed by the communist Beijing government as part of its territory.
In curtailing China’s influence, Claver-Carone is looking to curry favor with Democrats who question his leadership but share his mistrust of Beijing. If he succeeds, they can help him deliver on what was the main pledge of his unorthodox candidacy: U.S. support for a capital increase so the bank can help the region dig out from a pandemic-induced recession that’s the worst in more than a century.
There are early signs he may be making some headway. This month, a bipartisan group of five lawmakers led by Sen. Bob Menendez, head of the Senate Foreign Relations Committee, proposed legislation authorizing an $80 billion capital increase that would boost lending at the Washington-based bank by 60%.
“People need to accept that he won,” said Dan Runde, a former official with the U.S. Agency for International Development in the George W. Bush administration and an expert on multilateral institutions at the Center for Strategic and International Studies. “Those who are not happy haven’t gone through the five stages of grief yet. They’re stuck somewhere between denial and anger.”
But Sen. Patrick Leahy, the powerful chairman of the Senate Appropriations Committee, has yet to sign on after warning last year that the choice of Claver-Carone, a “polarizing American,” to lead the IDB would hurt — not help — the case for a funding boost. There’s also an expectation that some in the region who supported Claver-Carone when Trump was in office — such as Brazil and Colombia — might switch allegiances to appeal to the new sheriff in town: President Joe Biden.
“The argument that an underfunded bank is an opportunity for China is very compelling,” said Dan Restrepo, who served in the same National Security Council role as Claver-Carone during the Obama administration. “But it doesn’t answer how you adequately fund the bank and with what leadership.”
As far as cyber-disruptions go, the attack against the IDB was too small to generate concern beyond the bank. Last year, more than 10 million similar distributed denial of service (DDoS) attacks were observed throughout the world, according to digital security firm NETSCOUT.
But occurring amid the IDB’s gala celebration it was fraught with symbolism.
The bash in Washington was hastily organized after the Trump administration six months earlier rallied allies to force the cancellation of the IDB gathering in the Chinese city of Chengdu, which was to be something of a breaking out party for China a decade after it joined the bank.
While the U.S. had been trying to derail the meeting for months, China’s denial of a visa to a representative of Venezuelan opposition leader Juan Guaidó gave it the opportunity to act decisively. While the IDB and the bulk of nations in Latin America recognize Guaidó as Venezuela’s legitimate leader, China is a staunch ally of President Nicolás Maduro
Claver-Carone was the U.S. official driving the diplomatic standoff with China at the IDB. As the top White House official for Latin America, he was also the architect of “America Rising,” a program that sought to curb the inroads being made by China in Latin America, where it has displaced the U.S. as a top trading partner in countries such as Argentina, Brazil, and Chile.
According to the IDB document, on Sept. 19, 2019, traffic to the IDB website surged to more than four times normal levels, forcing the main website and publications page offline. At first, the bank defended itself by blocking individual IP addresses.
But then “the attackers switched tactics and started to throw requests from more than 15,000 IP addresses spread throughout China,” according to the internal document. “By Tuesday 24th evening all income traffic from China was blocked, a decision the allowed us to come back online.”
Unthwarted, the attackers pivoted again, this time relying on 180,000 IP addresses from countries including Singapore and Japan. In all, the attack lasted for months but was effectively contained after three weeks when the bank turned to Amazon to build a more robust firewall.
While there is no indication the site was breached, “the downtime affected our digital presence and had a negative impact in different communication endeavors,” the document says. “It also made our vulnerabilities explicit for third parties, which could potentially make us the target of new attacks and impact the reputation of the IDB brand.”
Still, it’s impossible to know who was behind the attack.
While China has some of the world’s most skilled hackers, security experts say that doesn’t necessarily mean it is behind the attacks. JOSHUA GOODMAN, MIAMI, MDT/AP