On Monday, China ratified an updated cybersecurity legislation that will enter effect next June. The policy regulates a number of aspects of the Chinese Internet: What data companies need to keep on domestic servers, the interaction between companies and the government, and the interaction between companies and Chinese users.
Notably, when considering the impact on the Internet, the law include:
- Network operators are expected to record network security incidents and store logs for at least 6 months (Article 21)
Note that the punishment for refusing to keep logs is a fine up to 10,000usd to the operator, and of up to 5,000usd to the responsible person. -
Services must require real-identity information for network access, telecom service, domain registration, blogging, or IM (Article 24)
The punishment for failing to require identity is up to 100,000usd and suspension of operations. - Network operators must provide support to the government for national security and crime investigations (Article 28)
- If a service discovers prohibited user generated content they must remove it, save logs, and report to the government (Article 47)
The punishment for this is up to 100,000usd and closing down the website
The concerns from foreign companies seem to center around a couple things: The first is that there’s a fairly vague classification of ‘critical infrastructure’, which includes power, water and other infrastructure elements explicitly, but also refers to services needed for public welfare and national security. Any such service gets additional monitoring requirements, and needs to keep all data on the mainland. Companies are worried they could be classified as a critical service, and that there aren’t clear guidelines about how to avoid or limit their risk of becoming subject to those additional regulations.
The other main concern seems to be around the fairly ambiguous regulation of supporting national security investigations by the government. There’s a concern that there aren’t really any limits in place for how much the government can request from services, which could include requiring them to include back doors, or perform significant technical analysis without compensation.
My impression is that these regulations aren’t much of a surprise within China, and they are unlikely to cause much in the way of change from how smaller companies and individuals experience Internet management already.