As China’s President Xi Jingping prepares to visit the White House next week, the head of China's Cyberspace Administration, Lu Wei, is holding a summit with US technology companies in Seattle. There, he's expected to further press US technology companies operating in China to sign off on a pledge that they will comply with Chinese information security policies—potentially giving Chinese authorities direct access to user data. The terms of the pledge, which the New York Times reports requires companies to “promise they would not harm China’s national security and would store Chinese user data within the country,” are similar in ways to the PRISM agreement between technology companies and the US government revealed by former National Security Agency contractor Edward Snowden.
But the pledge also goes further, pressing for systems to be “secure and controllable”—suggesting that companies may have to provide direct backdoors to systems for surveillance and provide the Chinese government with source code to their applications.The pledge document begins, “Our company agrees to strictly adhere to two key principles of ‘not harming national security and not harming consumer rights.’”
Much of the pledge document is focused on user privacy rights, outlining policies that would give users the right to know where their data was stored, to control how much of their personal data was collected, to opt out of the collection of personal data, and to “choose to install, or uninstall non-essential components [and] to not restrict user selection of other products and services.” The pledge also asks companies to “guarantee product safety and trustworthiness” by taking measures to build security into products, rapidly patch vulnerabilities, and “not install any hidden functionalities or operations the user is unaware of in the product.”
As part of the requirements for “security of user information," the pledge would require tech companies to “employ effective measures to guarantee that any user information collected isn’t illegally altered, leaked or used.” All data collected from Chinese customers would have to be stored in Chinese facilities and not be moved outside the country “without expressed permission of the user or approval from relevant authorities”—meaning the government would have oversight over what data could be exported for corporate use (and potentially accessed by foreign intelligence organizations).
Finally, the pledge would also require companies to agree to “accept the supervision of all parts of society”—including third-party evaluation of all products to determine they are “secure and controllable…to prove compliance with these commitments.” It is this clause that the Times’ industry sources suggested could be used by the Cyberspace Administration of China to demand access to encrypted data stored in cloud computing services and to provide source code for review.
The scheme is similar in many ways to what other countries have required of Chinese technology companies—and what Chinese companies such as Huawei have offered to do to meet the security requirements of the UK and other countries for telecommunications security assurance. And in the US, the NSA and Central Security Service have a similar, voluntary program with the National Institute of Standards and Technology (NIST) called the National Information Assurance Partnership for Common Criteria security testing. But the concern of US tech companies is the potential for China’s government to use the promises to extract trade secrets and pass them to Chinese technology companies for their own use—something that the US government has accused China of doing through more covert economic espionage.
reader comments
95