Introduction -- Rise of the cyber spies -- A focus on China -- Outline of report -- Part one: Context and background -- Alleged Chinese operations in cyberspace -- Applying the evidence-based approach to cyber attacks: the challenge of attribution -- Targeting Tibet -- Conduct of the investigation -- Phase 1: Field investigation -- Phase 2: Identifying command and control servers -- Part Two: Tracking Ghostnet -- Phase I: Field investigation -- Targeted malware, previous research -- Information Warfare Monitor field research -- Office of His Holiness the Dalai Lama -- Tibetan Government-in-Exile -- Offices of Tibet -- Drewla -- Phase 2: Identifying command and control servers -- List of infected computers -- Sending commands -- Command results -- Methods and capabilities -- Analysis of list of infected computers -- Methodology -- Selected infections -- Infection timeline -- Part Three: Investigating GhostNet: conclusions -- Alternative explanations -- Attribution -- The significance of GhostNet -- Part Four: About the Information Warfare Monitor. Read more...