China routinely hacks into U.S. computer systems, both public and private. And the digital espionage is being conducted on an immense scale. That’s the conclusion of Mandiant, the cybersecurity company that investigated a wave of cyberattacks on The New York Times.

Mandiant’s independent report is very much in sync with what had previously leaked from the National Intelligence Estimate, the government’s most authoritative (and highly classified) assessment of cybersecurity risks. The bottom line of that report: Chinese military hackers pose a huge risk.

Beijing has been probing and infiltrating U.S. computer systems for years. But just because something has become routine doesn’t mean it’s not dangerous. And China’s cyberactivities are disturbing indeed.

For starters, they are robbing us blind of industrial secrets, then using them to fuel their own economic growth. Essentially, American firms are unwillingly providing free research and development to their Chinese competitors.

But today’s espionage forays can easily serve as dry runs for later destructive attacks — from shutting down power and water plants to disabling air traffic control to locking down bank computers and ATMs. At some point, the world situation may make such attacks quite advantageous for the Chinese People’s Liberation Army.

Let’s be clear. China’s ongoing cyber program is not simply an exercise in hacking, or military and commercial intelligence collection. It is woven into a larger Chinese strategy.

Beijing views international relations as a political/diplomatic competition, which includes psychological operations. Cyber is also part of its military preparations.

The Chinese military has a “Doctrine of Information Dominance.” Here, cyber plays a role as part of the larger effort to understand an opponent, then identify, influence and degrade the content and flow of his information. Beijing understands that, without this sort of comprehensive asymmetrical war plan, it cannot hope to defeat the U.S. military.

Cyberattacks emanating from China are not the acts of some rogue unit. These penetrations are integral to a larger, holistic Chinese strategy serving political, military, intelligence, and economic ends. This is their published, public doctrine on how they will defeat the West.

Past Chinese cyberincursions (e.g., Operation Aurora against Google, Operation Shady Rat against Canada) drew no real American response from either governmental or commercial players. This has frankly encouraged Chinese actions, because there has been no obvious downside. Why stop lucrative raiding, when there are no repercussions beyond an occasional scolding and finger wagging?

Efforts to foster “cooperation” with the Chinese army, especially in the cyber arena, have had the same effect; making the Chinese believe that no real response to their provocative actions is coming their way.

Any U.S. response needs to be more than just military, more than just the minimum, and more than just a single line of approach (economic, diplomatic or military). Washington must apply an integrated set of responses that will make Beijing see that if it plays with fire long enough, it will get burned. Only then will China pull in its cyberhorns.

-Steven P. Bucci is director of the Allison Center for Foreign Policy Studies at the Heritage Foundation.