Vatican computers hacked from China before talks with Beijing

Chinese hackers infiltrated the Vatican’s computer networks in the past three months, a private monitoring group has concluded, in an apparent espionage effort before the beginning of sensitive negotiations with Beijing.

The attack was detected by Recorded Future, a firm based in Somerville, Massachusetts. The Chinese Communist Party has been waging a broad campaign to tighten its grip on religious groups, in what government leaders have periodically referred to as an effort to “Sinicize religions” in the country.

China officially recognizes five religions, including Catholicism, but the authorities often suspect religious groups and worshippers of undermining the control of the Communist Party and the state, and of threatening the country’s national security.

Chinese hackers and state authorities have often used cyberattacks to try to gather information on groups of Buddhist Tibetans, Muslim Uighurs and Falun Gong practitioners outside China.

But this appears to be the first time that hackers, presumed by cybersecurity experts at Recorded Future to be working for the Chinese state, have been publicly caught directly hacking into the Vatican and the Holy See’s Study Mission to China, the Hong Kong-based group of de facto Vatican representatives who have played a role in negotiating the Catholic Church’s status.

The Vatican and Beijing are expected to start talks in September over control of the appointment of bishops and the status of houses of worship as part of a renewal of a provisional agreement signed in 2018 that revised the terms of the Catholic Church’s operations in China.

The series of intrusions began in early May. One attack was hidden inside a document that appeared to be a legitimate letter from the Vatican to Monsignor Javier Corona Herrera, the chaplain who heads the study mission in Hong Kong, Recorded Future said in a report to be released on Wednesday.

It was an artful deception: an electronic file that looked as if it was on the official stationery of Archbishop Edgar Peña Parra. The letter carried a message from Cardinal Pietro Parolin, the Vatican’s secretary of state, the pope’s second in command and an old China hand who has defended the deal. In his message, Parolin expressed the pope’s sadness about the death of a bishop.

It is unclear whether the letter was fabricated or a real document that the attackers had obtained and then linked to malware that gave them access to the computers of the Hong Kong church offices and the Vatican’s mail servers. Recorded Future concluded that the attack was most likely connected to negotiations over the extension of the 2018 agreement.

In a recent interview with an Italian television program, Archbishop Claudio Maria Celli, a key negotiator of the agreement, said that with the provisional agreement set to expire in September, the Holy See “wants to continue with this step, it wants to go forward.”

Matteo Bruni, the Vatican spokesman, did not respond to a request for comment Tuesday evening, and top Vatican officials with experience dealing with China declined to comment because they said they did not have sufficient information about the alleged hack.

The revelation comes at a moment when the Trump administration is in near-daily confrontation with China over the handling of the coronavirus pandemic, closures of diplomatic missions, Beijing’s campaign to claim vast swaths of the South China Sea and American efforts to limit Chinese technological advances in the United States and its allies, especially for installing next-generation communications gear.

But there is no indication that the Trump administration was involved in the report about the attacks on the Vatican.

Recorded Future concluded that the attack was carried out by a state-sponsored group in China, which it named RedDelta. It said that the tactics used by the group were similar to those of other state-sponsored hacking operations that had been identified in the past. But there were also new techniques and new computer code, and identifying the true source of a hack is difficult.

The revelations are certain to anger the Vatican as its relationship with the Chinese government has been enormously delicate, especially over China’s crackdown on Hong Kong. When the Vatican issued prepared remarks on July 5 for Pope Francis’ blessing at St. Peter’s Square, it included a message to the people of Hong Kong, saying the current standoff “requires courage, humility, nonviolence and respect for the dignity and rights of all. I hope that social and especially religious life may be expressed in full and true liberty, as indeed several international documents foresee.”

But in the end, the pope did not deliver those words when he spoke.

The negotiations between the Vatican and Beijing would follow on the provisional agreement of 2018. The deal, the details of which are still largely unknown, was aimed at laying the foundation for a process by which the pope and the Chinese authorities could agree on bishops appointed to the head of official churches in China. As part of the deal, Francis agreed to recognize several bishops who had been appointed by the Chinese government.

At the time, both sides said it was a starting point for deeper talks, and the Vatican praised it as leading to a rapprochement between the official churches in China and the Holy See. In China, churches for various Christian denominations, including Roman Catholicism, are either sanctioned by the Chinese government, which appoints or approves clerical leaders, or underground ones. The underground Catholic Churches have been loyal to the Vatican, and they are overseen by bishops secretly appointed by the pope.

2018 reportedly allowed Beijing to name bishop candidates to the official churches but gave the pope final say over the appointments. This was understood to be the process moving forward after the pope recognized the several bishops appointed by Chinese officials. Those bishops had been excommunicated by the Vatican.

Critics of the agreement denounced the Vatican for dealing with an authoritarian government and endowing Beijing with greater legitimacy, allowing it potentially more influence over the religious lives of China’s 10 million to 12 million Catholics. Some prominent American politicians, such as Sen. Marco Rubio, R-Fla., have been among those urging the Vatican to refrain from dealing with the Chinese Communist Party.

Under the rule of Xi Jinping, the Chinese leader, the party has tightened its control over the nation’s religious and spiritual life as part of a drive that Xi has led to increase party oversight in almost every aspect of society. Officials in southeastern China have imposed especially harsh restrictions on the practice of Christianity. From 2014 to 2016, the authorities in Zhejiang province, where Xi once served as party chief, ordered crosses to be torn down from 1,200 to 1,700 churches, according to officials and residents there.

The Vatican has had a fraught relationship with Beijing for decades.

The two severed diplomatic ties in 1951, and the Vatican officially recognizes Taiwan, the democratic island that has de facto independence from China. In recent years, Chinese officials have increasingly pressured the handful of governments around the world that recognize Taiwan to end those relationships, with some success. If the Vatican and Beijing move to restore diplomatic ties, Chinese officials would almost certainly demand that the Vatican end relations with Taiwan.

Francis had made it a goal to increase the church’s presence around the world. In China, Protestantism has been growing at a much faster rate than Catholicism.

In 2014, the Chinese government allowed the pope’s airplane to fly through Chinese airspace on its way to Seoul, South Korea, breaking with tradition. The pope broadcast via radio telegram a message to Xi, offering well wishes and blessings of peace. While addressing bishops outside Seoul, the pope said: “In this spirit of openness to others, I earnestly hope that those countries of your continent with whom the Holy See does not yet enjoy a full relationship may not hesitate to further a dialogue for the benefit of all.”

The hackers might have tried to penetrate the systems of the study mission in Hong Kong not only to try to obtain information on the upcoming negotiations, but also to monitor the group during a period of intense unrest in the city.

Since June 2019, large pro-democracy protests have unfolded in the territory. In May, the National People’s Congress in Beijing authorized the enactment of a national security law in Hong Kong that would give the authorities greater tools of repression. Officials imposed the law in June.

Throughout the protests in Hong Kong, officials have suspected churches of helping organize demonstrators and giving them aid.

Chinese hackers have tried to aid the Hong Kong authorities in cracking down on the protests, including by carrying out cyberattacks on Telegram, a secure messaging app used by many demonstrators. ZDNet reported this month that members of the Hong Kong Catholic Church had been targeted since May with malware by hackers believed to be associated with China.