Chinese Government Implements Cybersecurity Law Designed To Spy On Citizens, Quell Dissent

Privacy

from the protected-from-everything-but-their-own-government dept

The Chinese government is going in for a third pass on its “cybersecurity” law — one that has little to do with security and everything to do with control.

This is something the government has been working on for a few years now. It’s a chance for it to tame the “Wild West” internet, particularly the “West” part of it with all these ideals about free speech and the spreading of information. The third reading, with all alterations and additions appended, will likely be going into effect this week. Human Rights Watch has a long post detailing the law’s negative aspects — which is almost all of them.

Among other things, service providers will be forced to censor “prohibited content.” They’ll also be required to collect real names and other identifying user information, even if the only service provided is instant messaging.

There’s also an information-sharing plan not unlike the one the US government has set up for its cyberwar operations. The difference is that the Chinese government makes no pretense about two-way sharing. It simply demands companies turn over harvested info and other data.

[The law] requires companies to monitor and report to the government undefined “network security incidents,” as well as provide undefined “technical support” to security agencies to aid in investigations, raising fears of increased surveillance. The final draft further specifies that network operators must retain network logs for at least six months and accept government supervision.

“Government supervision” sounds like fun, especially combined with another aspect of the proposed law, which gives the government the legal right to shut down internet infrastructure to respond to “major security incidents.”

Earlier versions also demanded local storage of Chinese user data by foreign service providers, with the government’s stated intent being to “preserve internet sovereignty” by walling off its citizens from the rest of the connected world. It’s unclear whether these demands have survived multiple alterations as the full final version of the cybersecurity law has yet to be released.

That’s not the extent of the control the government is seeking to exert. It goes far beyond its attempt to create a siloed Chinese internet. The law also gives the government new options for quashing dissent.

In addition to prohibiting individuals from using the Internet to “endanger national security, advocate terrorism or extremism, [or] propagate ethnic hatred and discrimination,” article 12 of the second draft also prohibits them from “overthrowing the socialist system” and “fabricating or spreading false information to disturb economic order.” The third draft adds to this list, banning the use of the Internet “to incite separatism or damage national unity.”

The law does add in privacy protection requirements for service providers, but its unclear who they’re supposed to benefit. Companies must safeguard user info and notify them of data breaches, but the government’s logging requirements and “supervision” efforts make it clear it’s never going to be locked out of accessing the information companies are supposed to be protecting from outsiders.

China may be a willing partner in the global economy but when it comes to it own citizens, it prefers them as isolated as possible. On one hand, it’s more of China being China. On the other hand, these power grabs masquerading as national security upgrades aren’t solely limited to governments with long histories of repression. As everyone gears up for the cyberwar, government entities who long for more control of pesky citizens will often find their expansion ideas humored, if not codified.

Filed Under: china, civil liberties, cybersecurity, dissent, surveillance