On Tuesday, Google revealed a new spate of attacks aimed at Gmail users, and said the attacks appeared to have come from Jinan, China. The new attacks illustrate the difficulty of stopping hackers who use simple "social engineering" tricks to steal personal data, and they raise questions about how such attacks can ever be traced with certainty.

Personal accounts belonging to U.S. government officials, Chinese political activists, military personnel, and journalists were targeted, the company said in a blog post. Google has pointed to Chinese hackers before—in early 2010 it said attackers from the country had stolen its intellectual property and tried to access the Gmail accounts of human rights activists. The Chinese foreign ministry has vigorously rejected the idea that the Chinese government was responsible for the attacks.

Google says the attackers did not exploit any security holes in the company's e-mail service. Instead, they involved tricking users into sharing their log-in information. Carefully tailored messages, apparently written by a friend or colleague, were used to direct victims to a fake log-in page where their details were captured. This technique, known as "spear phishing," was also used recently to steal information from the prominent security company RSA—information that may have been used to perform further attacks on the company's customers.

Experts say this type of attack is hard to stop; unlike other types of attacks, there is no technical fix. "I think of incidents like this more as a series of successes and failures on the part of the attacker," says Nart Villeneuve, a senior threat researcher at Trend Micro, which makes antivirus, antispam, and Internet security software. "It's more of a campaign than it is a single attack."