China’s allegation that the U.S. National Security Agency spent more than two years targeting its National Time Service Center highlights a part of critical infrastructure that receives far less public attention than power grids, telecommunications networks or satellites: precision time itself.
China’s Ministry of State Security alleged in October 2025 that the NSA began targeting personnel at the National Time Service Center in 2022 before escalating into attacks against internal networks and attempting to penetrate a high-precision ground-based timing system between 2023 and 2024. The ministry claimed the campaign eventually involved 42 specialized cyberattack tools and warned that successful disruption could have affected communications, finance, electricity, transportation and other systems dependent on accurate synchronization.
Those allegations have not been independently established. China said it possessed evidence connecting the operation to the NSA but did not publicly release the technical indicators, malware samples or other forensic material necessary for independent researchers to reproduce that attribution. The distinction is critical: Beijing’s accusation is itself significant, but it should not be reported as independently proven U.S. responsibility.
What can be established more confidently is why a national timekeeping institution could attract the attention of a sophisticated intelligence service. Modern digital economies depend on accurate clocks to coordinate networks, authenticate systems, sequence financial transactions, operate telecommunications infrastructure and calculate satellite-navigation positions. Precision time has quietly become critical digital infrastructure.
China Says the Campaign Began With Employee Phones
According to the Chinese Ministry of State Security’s account, the alleged operation began on March 25, 2022, when the NSA exploited vulnerabilities associated with the messaging service of an unnamed foreign mobile-phone brand used by National Time Service Center employees.
Chinese authorities said attackers used the vulnerability to gain access to several employees’ mobile devices and obtain sensitive information. The ministry did not identify the smartphone manufacturer, specify the vulnerability or publish technical indicators that would allow outside cybersecurity researchers to verify the exploitation method.
The alleged initial-access technique is nevertheless important because it illustrates how sophisticated attacks against critical infrastructure do not necessarily begin with the infrastructure itself. Employees’ phones, credentials and other connected systems can provide indirect routes toward more sensitive networks.
Attackers seeking access to a hardened scientific institution may find it easier to compromise a device used by someone who works there than to attack the institution’s most protected systems directly. That makes identity security, endpoint protection and credential management important parts of critical-infrastructure defense even when the ultimate target is highly specialized technology.
China Says Stolen Credentials Were Used in 2023
The Ministry of State Security alleged that the campaign moved into another phase on April 18, 2023, when attackers began using previously obtained credentials to penetrate the National Time Service Center’s computer systems.
That represents a common pattern in advanced cyber operations. Initial access can provide credentials or intelligence that attackers later use to move deeper into an organization, allowing what begins as a compromise of individual devices to become a broader network intrusion.
From August 2023 through June 2024, China claims the operation intensified further. The ministry said the NSA deployed a new cyber operations platform and activated 42 specialized cyberattack tools against multiple internal network systems.
The public statement did not identify those tools or explain whether “42” referred to separate malware families, exploits, utilities or individual capabilities. Without that information, the number should be treated as part of China’s allegation rather than a technical fact independently verified by outside researchers.
The Most Serious Allegation Involves China’s Ground-Based Timing System
China’s strongest claim is that the alleged attackers attempted to penetrate the country’s high-precision ground-based timing system. The National Time Service Center is involved in China’s national timing infrastructure and operates under the Chinese Academy of Sciences.
The institution is responsible for generating, maintaining and distributing China’s national standard time, commonly known as Beijing Time. Its work supports telecommunications, finance, electricity, transportation, surveying, scientific research, aerospace and defense-related activities.
China’s Ministry of State Security said interference with those capabilities could theoretically produce consequences ranging from network failures and financial disruption to problems affecting electricity and transportation. Those statements describe potential consequences of severe timing disruption, however, rather than documented consequences of the alleged NSA operation.
There is no public evidence establishing that the attackers successfully altered Beijing Time, disrupted China’s national time service or caused the widespread failures described by Chinese authorities.
That distinction matters. An attempted intrusion into strategically important infrastructure is significant without assuming that every theoretically possible consequence actually occurred.
A National Time Center Is Much More Than a Clock
The National Time Service Center can sound like an institution responsible for making sure clocks display the correct hour. Modern timekeeping infrastructure performs a much more fundamental role.
Computers operating across different locations need ways to agree about when events occurred. Telecommunications networks need synchronization to coordinate signals. Financial systems timestamp transactions. Power grids use precise measurements from geographically distributed equipment. Cybersecurity tools use timestamps to reconstruct activity during incidents.
Different applications require different levels of accuracy. A consumer laptop can tolerate timing differences that would be unacceptable in high-frequency financial infrastructure, scientific measurement or advanced telecommunications.
That means “time” is effectively a data service on which other digital infrastructure depends.
An organization responsible for generating and distributing a national time standard can therefore become strategically important even though most consumers never interact with it directly.
Finance Depends on Knowing Which Event Happened First
Financial markets demonstrate why synchronization matters. Modern trading systems process enormous numbers of orders and transactions, often at extremely high speeds. Regulators, exchanges and financial institutions need accurate timestamps to reconstruct what happened and in what sequence.
Even outside high-frequency trading, banks and payment systems need reliable clocks for transaction records, authentication, fraud detection and audit trails.
If systems disagree substantially about time, logs can become difficult to reconcile and automated processes can behave unexpectedly. An attacker capable of manipulating time within specific systems could potentially create confusion about event sequences or interfere with security controls.
That does not mean compromising a national time center would automatically allow an attacker to rewrite financial records across an entire country. Financial institutions use multiple sources, safeguards and internal controls.
The important point is dependency: accurate timing is one of the invisible components supporting reliable digital finance.
Telecommunications Networks Need Synchronization Too
Telecommunications infrastructure provides another example. Modern mobile networks coordinate enormous numbers of devices, radio signals and network components, requiring accurate frequency and timing information.
5G networks can have particularly demanding synchronization requirements because neighboring cells and distributed infrastructure need to coordinate transmissions efficiently. Poor timing can reduce performance or, under more severe circumstances, interfere with service.
Operators typically build redundancy into these systems and can obtain timing from several sources, including satellite navigation and specialized network equipment.
That redundancy is important when considering the consequences of an attack. A national timing institution may be strategically significant without representing a single switch whose compromise instantly disables every telecommunications network.
Cybersecurity analysis should therefore distinguish between an important dependency and a single point of catastrophic failure.
Satellite Navigation Is Fundamentally a Timing Technology
Satellite-navigation systems provide perhaps the clearest demonstration of the relationship between time and critical infrastructure.
GPS, China’s BeiDou, Europe’s Galileo and other global navigation satellite systems use satellites equipped with extremely precise clocks. Receivers calculate their location partly by measuring how long signals take to travel from several satellites.
Because radio signals travel at approximately the speed of light, extremely small timing errors can translate into meaningful positioning errors.
That means navigation and timing are deeply connected. Satellite systems used for maps and vehicle navigation also provide precise timing signals to telecommunications networks, financial institutions, energy infrastructure and other industries.
China’s development of BeiDou reduced its dependence on the U.S.-controlled GPS system and forms part of a broader strategy to maintain domestic control over strategically important technological infrastructure.
The National Time Service Center fits into that larger system of technological sovereignty.
Timing Is Also Essential to Cybersecurity
Ironically, accurate time is necessary for investigating cyberattacks themselves.
Security logs record timestamps showing when users logged in, when files changed, when connections were created and when applications executed particular actions. Incident-response teams combine those records to reconstruct what an attacker did.
If clocks across systems are significantly misaligned, investigators can struggle to determine the correct sequence of events. That can make it harder to understand how an intrusion began or how attackers moved through a network.
Authentication technologies can also depend on time. Time-based one-time passwords, certificate-validity periods and some distributed security mechanisms assume reasonably synchronized clocks.
An attack that manipulates timing inside specific systems could therefore have cybersecurity consequences even without disrupting the wider national time standard.
This is one reason precision timing deserves to be considered part of the security architecture rather than merely a scientific measurement problem.
China Has Not Published Enough Evidence for Independent Attribution
The most important limitation surrounding the National Time Service Center case is attribution.
China’s Ministry of State Security described the campaign as an NSA operation and said authorities possessed evidence supporting that conclusion. But the public announcement did not include the kind of technical documentation that would allow independent researchers to verify it.
No detailed malware analysis accompanied the announcement. The ministry did not identify the alleged 42 cyber tools, publish command-and-control infrastructure or provide indicators of compromise that could be compared with previously documented NSA operations.
That does not prove China’s accusation is false. Intelligence agencies often possess classified information they cannot publicly disclose, and governments regularly make cyber-attribution decisions using intelligence unavailable to independent researchers.
It does mean the correct journalistic formulation remains “China alleges” rather than “the NSA hacked China’s time center.”
The difference is especially important in disputes between geopolitical rivals, where technical cybersecurity incidents can also become instruments of diplomatic messaging.
The NSA Did Not Confirm the Allegation
The NSA did not publicly acknowledge conducting the operation. When asked about the accusation, an NSA official told Nextgov/FCW that the agency does not confirm or deny media allegations regarding its operations and said its focus remained countering foreign malicious activity targeting U.S. interests.
That leaves the public attribution unresolved. China has made a detailed accusation, while the alleged perpetrator has neither confirmed nor directly rebutted the operational claims.
The uncertainty is not unusual in intelligence operations. Cyber espionage is designed to remain hidden, and governments have strong reasons not to disclose the methods through which they know what another intelligence service has done.
Independent analysts therefore have to separate three questions: whether an intrusion occurred, what systems were affected and who conducted it. Public evidence can be strong on one question and weak on another.
The U.S. and China Are Both Making Critical-Infrastructure Cyber Claims
The allegation also needs to be understood within a much wider U.S.-China cybersecurity confrontation. Washington has repeatedly accused Chinese state-sponsored groups of targeting American and allied infrastructure, while Beijing increasingly publishes allegations describing U.S. intelligence operations against Chinese organizations.
In August 2025, the NSA, CISA, FBI and international partners issued a joint cybersecurity advisory on Chinese state-sponsored activity targeting telecommunications, government, transportation, lodging and military infrastructure networks around the world.
U.S. authorities have separately spent years warning about Volt Typhoon, a Chinese state-linked campaign that American officials say established persistent access inside critical-infrastructure organizations. U.S. officials have argued that the positioning could potentially enable disruptive operations during a future geopolitical crisis.
China rejects U.S. accusations around campaigns such as Volt Typhoon and has argued that Washington exaggerates Chinese cyber threats while conducting large-scale intelligence operations of its own.
Neither side’s accusations should automatically be treated as proof of the other’s claims. What they collectively demonstrate is that critical infrastructure has become a central arena in strategic competition between the two countries.
Cyber Espionage and Cyber Disruption Are Different
Another important distinction concerns motive.
Intelligence agencies routinely attempt to collect information from foreign governments, militaries and strategic institutions. Cyber espionage can therefore involve penetrating networks without intending to disrupt the systems being observed.
Cyber disruption is different. Its purpose is to interfere with, degrade or destroy a system’s operation.
China’s allegation includes elements potentially relevant to both. The ministry says the NSA stole sensitive information and credentials, which resembles espionage, while also alleging an attempt to penetrate a high-precision timing system that Chinese authorities say could have produced serious disruption.
Public evidence does not establish that such disruption occurred. That distinction matters because infiltrating a system to gather intelligence carries different strategic implications from manipulating a national time standard to cause widespread operational failures.
Without more technical evidence, reporting should avoid collapsing those possibilities into a single claim.
Precision Time Is Becoming a Strategic Dependency
The enduring importance of this story lies beyond the unresolved attribution.
Modern economies depend on technologies that operate largely outside public attention. Domain-name infrastructure, undersea cables, satellite timing, cloud control planes and certificate systems can all become essential dependencies even when ordinary users rarely know they exist.
Precision time belongs on that list. The more telecommunications, finance, transportation, energy and computing become interconnected, the more valuable reliable synchronization becomes. That can make institutions responsible for national timing attractive targets for espionage, reconnaissance or potentially disruptive cyber operations.
It also creates a resilience challenge. Critical systems should not depend on one source of timing without alternatives capable of maintaining operation when satellite signals, network connections or other timing sources fail.
Protecting time therefore means more than securing atomic clocks. It requires protecting the networks, software, employees, credentials and distribution systems surrounding them.
China’s Technology Sovereignty Strategy Adds Context
The allegation also fits China’s broader effort to reduce strategic dependence on foreign technology. Beijing has invested heavily in domestic semiconductor manufacturing, satellite navigation, telecommunications, artificial intelligence, quantum technologies and other areas considered important to national resilience.
BeiDou is one of the clearest examples. China built an independent global navigation satellite system rather than relying solely on GPS, giving the country greater control over positioning, navigation and timing capabilities.
Domestic timekeeping infrastructure follows the same strategic logic. A country seeking technological autonomy needs not only its own platforms but also the scientific and digital infrastructure supporting them.
Cybersecurity becomes inseparable from that strategy. Domestic ownership provides limited resilience if strategically important systems remain vulnerable to foreign intelligence operations.
The National Time Service Center allegation is therefore not simply another hacking dispute. It concerns the security of infrastructure that China considers part of its technological independence.
The Case Also Shows the Limits of Public Cyber Attribution
Governments increasingly make public cyber-attribution statements because identifying an attacker can support diplomacy, sanctions, criminal charges and defensive action. But attribution is most persuasive when authorities release evidence that independent experts can examine.
The National Time Service Center case illustrates the opposite problem. China has provided a relatively detailed narrative — dates, an alleged initial-access mechanism and the claim that 42 tools were deployed — while providing relatively little technical material capable of external verification.
That leaves journalists and cybersecurity researchers with an unusual combination of specificity and uncertainty.
Specific dates can make an allegation appear highly substantiated, but precision alone is not independent evidence. The underlying forensic basis still matters.
Until more evidence becomes publicly available, the strongest conclusion is therefore narrower than either government’s political narrative: China says a sophisticated multiyear campaign targeted strategically important timing infrastructure and attributes it to the NSA, but outside observers do not currently have enough public technical evidence to independently confirm that attribution.
Why This Story Still Matters Even Without Proven Attribution
The unresolved attribution does not make the incident irrelevant. The National Time Service Center’s role demonstrates why governments have to expand their definition of critical infrastructure beyond the sectors most visible to the public.
Accurate timing supports digital communications, financial records, power-grid measurements, navigation and cybersecurity itself. As those systems become more automated and interconnected, the reliability of the infrastructure beneath them becomes increasingly important.
The alleged campaign also illustrates how attackers can approach hardened infrastructure indirectly. According to China’s account, the operation began not by attacking an atomic clock but by compromising employee mobile devices and obtaining credentials.
That is a familiar cybersecurity lesson applied to an unusually sensitive target: critical systems can be undermined through ordinary endpoints if organizations fail to secure the pathways leading toward them.
Whether the NSA conducted the campaign China describes remains unproven in the publicly available evidence.
The strategic importance of precision-time cybersecurity does not.
