To assess the likelihood of the name repetitions being coincidental, Cary examined two Chinese name databases and consulted with Yi Fuxian, a professor of Chinese demography at the University of Wisconsin–Madison. He found that the name Qiu Daibing—or 邱代兵 in Chinese characters—is relatively rare. Yi confirmed to WIRED that the surname 邱 accounts for just 0.27 percent of Chinese names, and when combined with the specific given name 代兵, it signifies an even smaller fraction of occurrences.
The name Yu Yang (余洋 in Chinese characters) is more common. However, Cary theorizes that the association of these two names is less likely to be mere coincidence. He argues, “The sheer improbability of someone with this name also being paired with a Yu Yang, having this skill set, and attending the same university where these companies are registered, it’s just an incredibly small chance that these are not the right people.”
WIRED attempted to reach Qiu Daibing and Yu Yang through Qiu Daibing’s LinkedIn page and an email provided on the website of Beijing Huanyu Tianqiong but did not receive any responses. If Cary’s theory that the two men connected to Salt Typhoon were indeed trained in Cisco’s Networking Academy is accurate, he contends that it does not reveal a flaw or security lapse in Cisco’s program. Instead, it highlights a significant challenge in a globalized market where technology products—and training on these products—are easily accessible, including to potential hacking adversaries.
Cary points out that the situation has become more pronounced as China has long sought to replace Cisco systems and other Western technologies in its networks with domestic options. “If China is moving toward actually removing these products from Chinese networks,” Cary asks, “who’s still interested in learning about them?”
At the same time, China has increasingly limited its own information-sharing with the global cybersecurity community. John Hultquist, chief analyst at Google’s Threat Intelligence Group, notes that researchers have faced pressure not to share their findings at international conferences. “It’s like we’re in a sharing group, and they’ve told us straight to our face that they’re not going to reciprocate,” Hultquist explains. “We’re benefiting them with our programs. But it’s not going in the other direction.”
