The CCP’s dangerous actions—China’s multi-pronged assault on our national and economic security—make it the defining threat of our generation.

When I described the CCP as a threat to Americans’ safety a moment ago, I meant that in some ways quite literally. There has been far too little public focus on the fact that PRC [People's Republic of China] hackers are targeting our critical infrastructure—our water treatment plants, our electrical grid, our oil and natural gas pipelines, our transportation systems—and the risk that poses to every American requires our attention now.

China’s hackers are positioning on American infrastructure in preparation to wreak havoc and cause real-world harm to American citizens and communities. If or when China decides the time has come to strike, they’re not focused solely on political or military targets. We can see from where they position themselves, across civilian infrastructure, that low blows aren’t just a possibility in the event of a conflict. Low blows against civilians are part of China’s plan.

But the PRC’s cyber onslaught goes way beyond prepositioning for future conflict. Today, and literally every day, they’re actively attacking our economic security—engaging in wholesale theft of our innovation and our personal and corporate data. 

Nor is cyber the only PRC threat we face. The PRC cyber threat is made vastly more dangerous by the way they knit cyber into a whole-of-government campaign against us. They recruit human sources to target our businesses, using insiders to steal the same kinds of innovation and data their hackers are targeting while also engaging in corporate deception—hiding Beijing’s hand in transactions, joint ventures, and investments—to do the same.

And they don’t just hit our security and economy. They target our freedoms, reaching inside our borders, across America, to silence, coerce, and threaten our citizens and residents.

The FBI’s Response

But I can assure you the FBI is laser-focused on the threat posed by Beijing. We have cyber, counterintelligence, criminal, and weapons of mass destruction experts—just to name a few—defending against it.

And we’re working in partnership with the private sector, our allies abroad, and all levels of the U.S. government—especially the NSA [National Security Agency], Cyber Command, and CISA [the Cybersecurity and Infrastructure Security Agency], as well as ONCD [the Office of the National Cyber Director], whose leaders I’m honored to be here with today.

In fact, just this morning we announced an operation where we and our partners identified hundreds of routers that had been taken over by the PRC state-sponsored hacking group known as Volt Typhoon. The Volt Typhoon malware enabled China to hide, among other things, pre-operational reconnaissance and network exploitation against critical infrastructure like our communications, energy, transportation, and water sectors. Steps China was taking, in other words, to find and prepare to destroy or degrade the civilian critical infrastructure that keeps us safe and prosperous. And let’s be clear: Cyber threats to our critical infrastructure represent real-world threats to our physical safety.

So working with our partners, the FBI ran a court-authorized, on-network operation to shut down Volt Typhoon and the access it enabled. This operation was an important step. But there’s a lot more to do, and we need your help to do it.

Let me quantify what we’re up against: The PRC has a bigger hacking program than every other major nation combined. In fact, if each one of the FBI’s cyber agents and intelligence analysts focused exclusively on the China threat, China’s hackers would still outnumber FBI cyber personnel by at least 50 to 1. 

So as we sit here while important budget discussions are underway, I’ll note that this is a time to be keeping ahead of the threat by investing in our capabilities rather than cutting them. We need to ensure that we sustain and build on the gains we’ve made that have enabled us to take actions like the Volt Typhoon operation I just mentioned.

The budgets that emerge from the discussions underway now will dictate what resources we’ll have ready in 2027—a year that, as this committee knows all too well, the CCP has circled on its calendar. And that year will be on us before you know it. As I’ve described, the PRC is already, today, putting their pieces in place.

Conclusion

I do not want those watching today to think we can’t protect ourselves. But I do want the American people to know that we cannot afford to sleep on this danger. As a government and a society, we’ve got to remain vigilant and actively defend against the threat Beijing poses. Otherwise, China has shown it will make us pay.

Thank you, and I look forward to today’s discussion.