Not that counterattacking is necessarily the best option, but from what I've heard from colleagues in China, the security ecosystem there is far worse than the US. Especially with respect to encryption, many companies and government services rely on poorly designed homebrew solutions.