ARTICLE IN PRESS

computer law & security review ■■ (2017) ■■–■■

Available online at www.sciencedirect.com

ScienceDirect

w w w. c o m p s e c o n l i n e . c o m / p u b l i c a t i o n s / p r o d c l a w. h t m

The impact of China’s 2016 Cyber Security Law

on foreign technology firms, and on China’s big
data and Smart City dreams

Max Parasol *
China Law Research Group, University of Technology, Sydney, Australia
Lawyer and Law Lecturer, Monash University, Melbourne, Australia

A B S T R A C T

Keywords: Chinese officials are increasingly turning to a policy known as Informatisation, connecting
China industry online, to utilise technology to improve efficiency and tackle economic develop-
Big data mental problems in China. However, various recent laws have made foreign technology firms
The Internet of Things uneasy about perceptions of Rule of Law in China. Will these new laws, under China’s stated
Smart Cities policy of “Network Sovereignty” (“网络主权” “wangluo zhuquan”) affect China’s ability to attract
Network Sovereignty foreign technology firms, talent and importantly technology transfers? Will they slow China’s
Rule of Law technology and Smart City drive? This paper focuses on the question of whether interna-
Cyber Security Laws tional fears of China’s new Cyber Security Law are justified. In Parts I and II, the paper analyses
why China needs a cyber security regime. In Parts III and IV it examines the law itself.
© 2017 Max Parasol. Published by Elsevier Ltd. All rights reserved.

China’s Cyber Security Laws cannot be understood without

1. Introduction
In Part I, this paper provides background context by introduc-
ing China’s Smart City drive. Smart Cities and associated
technologies have deliberately been chosen for analysing
China’s Cyber Security Law for two reasons. Firstly Smart Cities
must utilise all the technologies that China has officially stated
are necessary for its development namely: the Internet of
Things, cloud computing, big data and spatial geographic in-
formation systems. Big data informing these policy decisions
is often collected from millions of smart devices, including
mobile phones, that necessitate a cyber security regime.
Secondly Smart Cities can offset many of the political prob-
lems that besiege the Chinese Government and cause citizen
unrest, namely air quality, traffic congestion, access to health-
care and efficient government services. This intersection of
incredibly complex policy decisions that keeps Chinese leaders
awake at night, merits our direct attention.
understanding its Informatisation strategy. In Part II, this
paper charts China’s Informatisation Strategy and Network Sov-
ereignty policies. This paper unpacks the Chinese policy
statement that connecting industry online and cyber security
are truly “two wings of one body”. It is argued that the current
Chinese Government values technological progress as China’s
key development task and accordingly recent controversial laws
that worried foreign technology firms and governments were
amended to avoid impeding technological goals, including
China’s 2015 Anti-Terrorism Law. In Parts III and IV, this
paper objectively assesses China’s Cyber Security Law at length.
The law was passed by the National People’s Congress on 7
November 2016, taking effect on 1 June 2017. While some
provisions of this Law appear to tighten government control
over Chinese and foreign technology firms, this paper pres-
ents evidence that suggests China will not harm its inno-
vation agenda through excessive control over data and cyber
technology.

* UTS Faculty of Law, University of Technology Sydney (UTS), City campus, 15 Broadway, Ultimo, NSW 2007, Australia.
E-mail address: maxparasol@rocketmail.com.
http://dx.doi.org/10.1016/j.clsr.2017.05.022
0267-3649/© 2017 Max Parasol. Published by Elsevier Ltd. All rights reserved.

Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
 ARTICLE IN PRESS
2 computer law & security review ■■ (2017) ■■–■■
There is a complete circle to be drawn. The Chinese Gov-
ernment must appease a population now expecting more from
its leadership in terms of economic development and better
quality of life while at the same time protecting them from cyber
risks in an increasingly inter-connected world.These are complex
policy considerations to balance.
To fulfil these demands, this paper contends that China must
rely on assistance from both foreign and local technological
innovators. These firms will therefore play a role in shaping
the cyber security compliance debate in China. The text of the
Cyber Security Law and subsequent regulatory developments
allow for such negotiations over interpretation and enforce-
ment. Negotiations may continue for another 18 months.
2. Part I: why China needs a Cyber Security
Regime
The following background is necessary to understand why
China needs a cyber security regime, especially in relation to
China’s national policy of using the internet and big data to
resolve long-standing development problems.
The enactment of the Cyber Security Law in 2016 arguably
reflected more than a legislative attempt to regulate the in-
ternet for the purpose of censorship. The law was passed by
the National People’s Congress on 7 November 2016, but did
not take effect until 1 June 2017. There have been a number of
attempts to lobby the Cyberspace Administration of China (CAC)1
to delay implementation. On 15 May 2017, global technology
companies represented by 54 trade groups from Europe, Asia
and the US petitioned China to delay the enactment of the Cyber
Security Law.2 Their major argument is that it could discrimi-
nate against foreign businesses. This paper argues that China
will continue the ongoing compliance debate with foreign tech-
nology companies and that reports of CAC “[i]ndiscriminately
requiring businesses to hand over source codes” are inaccurate.3
2.1. Billions of connected devices
The Cyber Security Law was a necessity for Smart Cities and
associated technologies to develop in a safe and secure way.
China has 731 million internet users according to government
statistics in January 2017. Further, 695 million users use the in-
ternet through mobile devices. They rarely use cash and rely on
1
Discussed in detail below, CAC is the office that outlines China’s
cyber strategy.
2 6
The letter was signed by 54 trade groups including the US-
China Business Council, American Chamber of Commerce in China,
BusinessEurope, the Japan Chamber of Commerce and Industry and
the Korea-China Business Council.see: Eva Dou, ‘Global Tech Com-
panies Call on China to Delay Cybersecurity Law’, (Wall Street Journal,
15 May 2017) <https://www.wsj.com/articles/global-tech-companies
-call-on-china-to-delay-cybersecurity-law-1494837117> accessed 18
May 2017.
3
Michael Martina and Cate Cadell, ‘Amid industry pushback, China
offers changes to cyber rules: sources’ (Reuters, 19 May 2017) <http://
www.reuters.com/article/us-china-cyber-law-idUSKCN18F1VZ>
accessed 21 May 2017.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
China’s distinct online, e-commerce, payment and logistics
ecosystem.4
Cyber technologies will define the 21st century. Cyber se-
curity must therefore be part of everything that we create.While
this can be linked to national and global security, it is also through
this lens that fears surrounding China’s Cyber Security Law
can be reduced. As Smart Cities utilise key public infrastruc-
ture, a close reading of China’s new Cyber Security Law indicates
that cyber security concerns focused on “critical infrastruc-
ture” were a primary policy driver for the new law.
The Chinese Government has focused its attention on an in-
novation agenda, and that may be hard for the international
community to grasp. Observers must look for the intent behind
the law from the wider Chinese policy context, and the massive
task of ensuring network security among China’s billions of con-
nected devices.5
2.2. China’s history of legislative petri dishes
There are over 300 Smart City pilot projects6 across China. They
build upon China’s history of what I call ‘law in a petri dish’,
or the legislative laboratory that China has created since 1978
in China’s Special Economic Zones and Technology Develop-
ment Zones.7 These national level programs started with the
Special Economic Zones for three cities in 1978, as part of China’s
economic reform, and were extended to the Economic and Tech-
nological Development Zones in 14 cities in 1984. The phrase
“Special Economic Zone” itself belies their role in Chinese law
and development history. They evolved as a place for political
and economic policy experimentation.
Wei-Wei Zhang in Transforming China: Economic Reform and
its Political Implications sums up the experimental role of the
Special Economic Zones:
The SEZs became, effectively, laboratories in which the opera-
tion of the market economy was carried out. The intention of the
state was to extend methods that proved successful in the zones
to other parts of the country. Should the experiment fail, its adverse
impact could be minimized since the zones were located far away
from China’s political and economic centres. The strategy was
4
This is according to Chinese Government statistics released in
January 2017. See: Steven Millward, ‘China now has 731 million in-
ternet users, 95% access from their phones’, (TechinAsia, 23 January
2017) <https://www.techinasia.com/china-731-million-internet
-users-end-2016>accessed 23 January 2017.
5
China has been predicted to have 10 billion connected devices
by 2020. Mary Lennighan, ‘China to have 10bn connected devices
by 2020’, (Total Telecom, 24 February 16), <https://www.totaltele.com/
view.aspx?ID=492917> accessed 25 March 2017.
At present, there are more than 300 pilot Smart Cities in China.
‘Sector Report: Smart Cities in China’ (2016) EU SME Centre, <http://
www.cbbc.org/cbbc/media/cbbc_media/KnowledgeLibrary/Reports/
EU-SME-Centre-Report-Smart-Cities-in-China-Jan-2016.pdf> accessed
January 2017, p20.
7
The Chinese Government allowed two provinces of the four prov-
inces, Shenzhen in Guangdong Province and Xiamen, Fujian
Province, to adopt “special policies” (teshu zhengce 特殊政策) and to
implement “flexible measures” (linghuo cuoshi 灵活措施). These unique
powers were aimed at attracting foreign capital and technology.
They were granted preferential tax measures and enjoyed higher
foreign-exchange retention rates.
 ARTICLE IN PRESS
computer law & security review ■■ (2017) ■■–■■
relatively successful in attracting foreign capital, pioneering reform
experiments and creating from scratch an export-oriented economy.8
Major Chinese planning documents are incredibly ambi-
tious. Ambitious targets are set and usually reached, according
to the official statistics. Legislative laboratories also allow China
to constantly trial legislative tasks in small pilot zones. This
bodes well for successful Smart City projects tested on a small
scale and implemented with technocratic efficiency. In ten years
we may be describing the great success of Smart Cities in the
same way that commentators now describe the legal and po-
litical reforms associated with China’s Special Economic Zones.9
2.3. “Smart Cities” “智慧城市”
As part of its innovation agenda, the Chinese govern-
ment has been strongly promoting the development of Smart
Cities. There are various definitions of a “Smart City”. It is of-
ten argued that while the most important element of a Smart
City is often described as technology, in practice citizen
participation and engagement is the most important ele-
ment. For China to build effective Smart Cities, access to open
and accurate big data10 and the development of articulate
Smart City strategies is of paramount importance. “A wide-
spread program is needed to build public awareness of
8
Wei-wei Zhang, Transforming China, Economic Reforms and its Po-
litical Implications. (St. Martin’s Press, New York, 2000), p.21.
9 12
Policy makers for Smart City construction in China include the
central government, various ministries and regional/city-level gov-
ernments, especially in pilot Smart Cities. In addition the private
sector is heavily involved, this is discussed below. Several minis-
tries have been involved in developing policies, standards and the
evaluation process, including:The National Development and Reform
Commission (NDRC); The Ministry of Industry and Information Tech-
nology of the People’s Republic of China (MIIT); The Ministry of
Housing and Urban-Rural Development of the People’s Republic of
China (MOHURD); The Ministry of Finance.Local/City Govern-
ments also play an important role. For example, the Shanghai
Municipal Government published its action plan for promoting and
accelerating Smart City development in 2011. In 2014, the second
edition of the action plan covering 2014–2016 was announced.
Shanghai published its action plan for promoting and accelerat-
ing Smart City development in 2011. To achieve these targets from
a technical perspective, Shanghai aims to focus on the construc-
tion and development of the following areas:Broadband; WLAN; Ipv6
access; Big data; Cloud-computing; IoT; and Network security.‘Sector
Report: Smart Cities in China’ (2016) EU SME Centre, <http://
www.cbbc.org/cbbc/media/cbbc_media/KnowledgeLibrary/Reports/
EU-SME-Centre-Report-Smart-Cities-in-China-Jan-2016.pdf> accessed
January 2017, p10.
10
In May 2013 a group of international scholars brainstormed two
definitions of big data in a session on Data Science and Big Data
at the Xiangshan Science Conference (2013) in Beijing. The first defi-
nition, for academic and business communities, is “a collection of
data with complexity, diversity, heterogeneity, and high potential
value that are difficult to process and analyze in reasonable time,”
and the second, for policymakers, is “a new type of strategic re-
source in the digital era and the key factor to drive innovation, which
is changing the way of humans’ current production and
living”:‘Report on the 462nd Session: Data Science and Big Data.’
(Xingshan Science Conference, Chinese.Academy of Sciences, Beijing,
May 29–31 2013). Cited in ‘The Bridge: a global view of big data’,
(National Academy of Engineering, 2014) <https://www.nae.edu/
File.aspx?id=128774> accessed 12 July 2015.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
3
ICT,11 including how it can be accessed and used and its role
in economic and social development. Efforts are needed to
promote e-government, to encourage citizen use of online public
services and participation in decision-making.”12 “Smart City”
is a vague term applied to everything from urban design to traffic
management policy. It is the use of information technologies
to solve urban problems incorporating intelligent and sustainable
urban development.13 A Smart City is a digitally connected city.
However it is as much about town planning for city growth as
it is about technology. “In its widest understanding, smart city
integrates the whole range of services a city needs and wants
to offer in a way that follows state of the art public administration
requirements – including the use of most recent technology”.14
The goals of “good city management” are therefore ideally also
the “leading goals of smart city development.”15 While the defi-
nition of a Smart City varies greatly within the literature,
sustainability is one key phrase associated with a Smart City.16
Modern technology trends have increased the recent devel-
opment of Smart Cities. Government-employed Smart City
strategies are regarded as a powerful catalyst to develop and
utilise technologies – such as the Internet of Things (IoT),17 cloud
11
Information and Communications Technology (ICT) is an ex-
tended term for information technology (IT), stressing the integration
of telecommunications (telephone lines and wireless signals), com-
puters as well as necessary enterprise software, middleware, storage,
and audio-visual systems, which enable users to access, store, trans-
mit, and manipulate information.
Christine Zhen-Wei Qiang, China’s Information Revolution: Man-
aging the Economic and Social Transformation (World Bank Publications,
Washington, DC, 2007), p85.
13
Anthony, M., Townsend, Smart Cities: Big Data, Civic Hackers, and
the Quest for a New Utopia (W. W. Norton & Company, New York, 2013).
14
Kang Yanrong, Jeanette Whyte, Thomas Hart, ‘Comparative Study
of Smart Cities in Europe and China’, White Paper, EU-China
Policy Dialogues Support Facility II (PDSF), March 2014, p16. <http://
euchina-ict.eu/wp-content/uploads/2015/01/Smart_City_report
_draft-White-Paper-_-March-2014.pdf> accessed 2 February 2015.
15
ibid.
16
Smart Cities often refer to intelligent and sustainable urban de-
velopment: ibid.
17
Internet of Things (IoT) is the interconnection via the internet of
computing devices embedded in everyday objects, enabling them
to send and receive data.Cisco estimates that there were about 200
million things connected to the Internet in the year 2000 and that
this number has increased to approximately 10 billion by 2013. Cisco
sees the next wave of dramatic Internet growth will come from a
combination of machine-to-machine (M2M), person-to-machine
(P2M), and person-to-person (P2P), which they describe as the In-
ternet of Everything (IoE): Joseph Bradley, Joel Barbier, Doug Handler,
‘Embracing the Internet of Everything To Capture Your Share of $14.4
Trillion’, Cisco White Paper, 2013. <http://www.cisco.com/c/dam/
en_us/about/ac79/docs/innov/IoE_Economy.pdf> accessed 2 March
2015.According to Chinese policy documents, Internet of Things (IoT)
is a new infrastructure, which expands the services and applications
provided by the present communication networks and the Inter-
net. Sensing and identifying the physical world by utilising sensor
technologies and intelligent devices, IoT through transmission and
interconnection of networks performs computing, processing and
knowledge mining, in such a way as to realise information inter-
action and seamless interaction between human and objects as
well as between objects, thereby serving the purposes of real-time
control, accurate management and scientific decision-making of
the physical world: ‘The White Paper on the Internet of Things’,
China Academy of Telecommunication Research of MIIT, 2011.
 ARTICLE IN PRESS
4 computer law & security review ■■ (2017) ■■–■■
computing and big data – in urban planning, construction, and
city management.
The movement for Smart Cities is strong globally. Global
problems are theoretically solvable in a smarter planet. Smart
systems are transforming energy grids, supply chains and water
management. Smart healthcare systems can dramatically lower
the cost of therapy. Smart food systems are using radio fre-
quency identification technology to trace meat and poultry from
the farm through the supply chain to store shelves.
Smart Cities need secure networks but also contain many
open networks in need of a cyber security regime. Billions of
devices envisaged connecting to a wide range of applica-
tions, ensures that security is essential for many Smart City
initiatives especially those connected to a country’s critical in-
frastructure. This new connected landscape makes cyber
security a governmental responsibility to protect key infra-
structure and data breaches. China often releases technical
aspirational goals18 but the question remains, how can China
develop a polity actively engaged in Smart City goals and will
the Cyber Security Law of 2016 help those aims?
One high-profile example expounds why Smart City plans
could greatly assist the implementation of responsive govern-
ment, while in some cases also arousing international
suspicions of a nascent dystopia.
2.4. Yinchuan
Yinchuan is the capital of Ningxia province, in northern China,
which China announced as the blueprint “Smart City” across
18
For example: A Five-Year Plan on China’s National Informatisation
(2016–2020) was issued by the State Council on December 27 2016.
According to the official press release: <http://english.gov.cn/policies/
latest_releases/2016/12/27/content_281475526646686.htm> China will
put more resources into the development of cutting-edge informa-
tion technology, including 5G wireless systems, IPv6, smart
manufacturing, cloud computing and the Internet of Things. The plan
set a goal of authorising 15.3 trillion patents in the information in-
dustry. The goal is by 2020, BeiDou Navigation System, involving 35
satellites, will be completed and provide services for international
clients. The plan includes:• More integrated national databases, cov-
ering information from government, academic institutions and other
public sectors, will be set up and open to the public, so as to break
information barriers. A unified online system will be established,
integrating information and services from different departments,
regions and levels to build a “smart government”. The govern-
ment hopes to deal with 80 percent of paperwork online by
2020.• More funds will be invested into information infrastruc-
ture, especially for rural and remote regions. By 2020, 40 percent
rural families in central and western China will have access to cable
internet. In addition, the speed of the internet will be accelerated
and costs will be lowered.• The government hopes to connect the
internet industry with manufacturing and agriculture. E-commerce
and other new business models will be promoted. By 2020,
e-commerce trade volume is planned to reach at least 38 trillion
yuan.• The plan also focused on cyber security, promoting legis-
lation of relative laws and regulations, setting up risk alerts and
an emergency mechanism. It also vows to further crack down on
telecom fraud.• China has made significant achievements in
informatisation, according to the Five-Year Plan on Informatisation.
It also mentioned some shortcomings, including lagging innova-
tion capability, core technology’s dependency on foreign companies,
lagging information infrastructure in rural and poor regions, and
the risk of a widening digital gap.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
China in October 2016. Yinchuan is the favoured “Smart City”
leader over Shanghai or Beijing, due to its small size – its popu-
lation is only 1.5 million.19 The city is testing various smart City
measures, including solar powered public rubbish bins that
double as compactors, allowing them to increase storage ca-
pacity five-fold. When full, the bins send out a signal to garbage
collectors to empty them.
Other aspects are more problematic. On local buses, facial
recognition software has replaced the fare box. Faces are linked
to their bank accounts. Public transport boarding is not slowed
by people fishing for correct change. Yet this system alone raises
questions regarding the kind of data China’s Smart Cities should
be able to collect.20
This is only one example of individual Smart City projects.
There are over 300 other experiments in China, undoubtedly
the world’s largest roll out of Smart City projects. These proj-
ects can help assist the Chinese Government in alleviating great
social problems.
However, major fears surrounding China’s new Cyber Secu-
rity Law concern where and how data is stored and whether
this will allow abuse of citizens’ rights and freedoms by an au-
thoritarian government. Principally that data must be locally
stored in China, due to China’s preoccupation with “Network
Sovereignty” best embodied by the phrase “secure and control-
lable”. This is seemingly in stark contrast to China’s innovation
goals.
2.5. The Key Tenets of the 13th Five Year Plan:
innovation, “sharing” and “openness”
Innovation is China’s number one goal and this central
focus must be emphasised before analysing China’s Cyber Se-
curity Law. The 13th Five-Year Plan21 is the first Five-Year Plan
under President Xi Jinping’s leadership, and was released on
15 March 2016. The 13th Five-Year Plan Proposal contains five
main principles underpinning the policies for China’s future
development.22
The first aspirational principle is innovation, primarily as
a driver of economic development and to shift China’s eco-
nomic structure into a higher-quality growth pattern. The other
four principles are: coordination 23 ; green development 24 ;
opening-up; and sharing. These broad aspirational goals all
seem promising for technologies like the Internet of Things and
movements such as big data analytics and Smart Cities. The
Five-Year Plan pledges openness, stating that China should
utilise both domestic and global markets and be more active
19
Daisy Carrington, ‘Yinchuan: The smart city where your face is
your credit card’, (CNN, 11 October 2016) <http://edition.cnn.com/
2016/10/10/asia/yinchuan-smart-city-future/> accessed 12 January
2017.
20
ibid.
21
《国民经济和社会发展第十三个五年规划》（“十三五”规划”）[the 13th
Five-Year Plan for Economic and Social Development of the Peo-
ple’s Republic of China (‘the 13th Five-Year Plan’)] National People’s
Congress, 17 March 2016.
22
ibid.
23
Coordination means to ensure balanced coordinated develop-
ment among rural and urban areas, and across different industries.
24
Green development means protecting the environment and pur-
suing environmentally friendly economic growth.
 ARTICLE IN PRESS
computer law & security review ■■ (2017) ■■–■■
in global governance. Sharing means “Development for the
People, by the People and Shared by the Entire Population”.25
Growth for growth’s sake is not enough.“Inclusive growth” was
a key theme of the 12th Five-Year Plan (2011–2015) and continues
to be a main priority for Chinese leaders who face numerous
problems that are already impacting the quality of life of Chinese
citizens.These include a widening income gap, a growing elderly
population and a deteriorating natural environment. China’s
manufacturing comparative advantage continues to erode and
many university graduates are unemployed. China’s innova-
tion economy is a political imperative. Innovation is therefore
a major priority for the Chinese government.
2.6. “Smart Cities” in China’s Five Year Plans
According to the Chinese National Development and Reform
Commission (NDRC)26 (中华人民共和国国家发展和改革委员会), the
“Smart City” strategy introduces modern science and technol-
ogy, such as the Internet of Things, cloud computing, big data,
spatial geographic information systems, to urban planning, con-
struction and operation.
Smart Cities can improve urban management and service
industries with the help of information and data resources.The
goal is to integrate information resources, and improve urban
management and services, as well as transform China’s economy
to more modern industries.The term “智慧城市”,“Zhihui Chengshi”
or “Smart City” has been widely accepted in China. The Smart
City concept garnered much attention at the 2010 Shanghai
World Expo, where it was a key theme.The World Expo’s slogan
was “Better City, Better Life”.
In China the movement to develop such technologies, both
political and popular is very strong.27 China has employed a
large and sustained deployment of Smart City projects. The 12th
Five-Year Plan, which guided broad economic policy until 2015,
identified Smart City technology as a sector to be strengthened
and encouraged. China’s Five-Year Plans are blueprints con-
taining the country’s social, economic, and political goals. They
encompass and intertwine with existing policies, regional plans,
and strategic initiatives. A Five-Year Plan signals the Chinese
government’s vision for future reforms and communicates this
to other parts of the bureaucracy, industry players and Chinese
citizens. It is a living document that will go through constant
review and revision over a five year period.28
25
《国民经济和社会发展第十二个五年规划》（“十二五”规划”）[the 12th
Five-Year Plan for Economic and Social Development of the Peo-
ple’s Republic of China (‘the 12th Five-Year Plan’)] National People’s
Congress, 14 March 2011.
26
The National Development and Reform Commission of the Peo-
ple’s Republic of China (NDRC), formerly known as the State
Planning Commission and State Development Planning Commis-
sion, is a macroeconomic management agency under the Chinese
State Council, which has broad administrative and planning control
over the Chinese economy. See: <http://en.ndrc.gov.cn/>.
27
Anthony, M., Townsend, Smart Cities: Big Data, Civic Hackers,
and the Quest for a New Utopia (W. W. Norton & Company, New York,
2013).
28
《国民经济和社会发展第十二个五年规划》（“十二五”规划”）[the 12th
Five-Year Plan for Economic and Social Development of the Peo-
ple’s Republic of China (‘the 12th Five-Year Plan’)] National People’s
Congress, 14 March 2011.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
5
After the 12th Five-Year Plan identified Smart City technol-
ogy as a sector to be encouraged, ministries subsequently began
sponsoring programs and industry alliances.29 As Smart Cities
are Chinese Government policy, multinational companies, in-
cluding several from China, are now in a race to develop and
deploy Smart City platforms in which disparate systems com-
municate and share information.30 There have been various public
documents calling for greater attention to the development of
Chinese Smart Cities. For example, on 15 January 2014, the NDRC
and the Ministry of Industry and Information Technology31 (MIIT),
along with other relevant departments, publicised a Notice to
Speed up the Project Implementation of Smart Cities.32 It is
argued below that there is no indication that China’s Cyber Se-
curity Law was intended to disrupt this existing agenda.
However planning for Smart City success will depend upon
China’s cyber security regime. If China continues collecting data
everywhere and employs sensors everywhere, China will need
to have a well-articulated cyber security regime. Countries must
protect critical infrastructure that is connected through private
smart phones among other devices. In many ways China is at
the global vanguard of dealing with these issues. These are
serious threats facing China given the high penetration of in-
ternet usage and connected devices in China.
The Internet of Things enables objects to talk to other objects.
Billions of devices envisaged connecting to a wide range of ap-
plications. Security is therefore essential for many applications.
This final point is pertinent in that the Chinese Government
knows all too well the sinister threat of cyber security attacks
posed, for example, by having a system of live sensors across
a city.
In May 2017, it was reported that China was a major victim
of the global ransomware attack.33 Limited, disputed and
29
For example, in 2012, the Ministry of Housing and Urban-Rural
Development (MOHURD) formally issued the “Notice of Carrying out
the National Smart City Pilots”, and the “National Interim Mea-
sures for Smart City Pilots” and approved 90 Smart City pilot projects.
30
Many cities such as Nanjing, Shenyang, Chengdu, and Kunshan,
have made strategic Smart City platform cooperation agree-
ments with global software giant IBM: Zhang Yongmin, and Du
Zhongchao, “Present status and thinking of construction of smart
city in China,” China Information Times 2 (2011), p. 28–32. IBM is
generally regarded as a leader in the integration and effective cen-
tralisation of communication between Smart City industries and
government departments.
31
The Ministry of Industry and Information Technology of the Peo-
ple’s Republic of China was established in 2008 as a department
under the State Council responsible for the administration of China’s
industrial branches and information industry. It is a “super min-
istry” responsible for the integration of science and technology
planning and industry, but not media content control. See: <http://
www.miit.gov.cn/n11293472/index.html>.
32
Cited in ‘Sector Report: Smart Cities in China’ (2016) EU SME Centre,
<http://www.cbbc.org/cbbc/media/cbbc_media/KnowledgeLibrary/
Reports/EU-SME-Centre-Report-Smart-Cities-in-China-Jan-2016
.pdf> accessed January 2017, p8. The link <http://gjss.ndrc.gov.cn/
zttp/xxhm/201401/t20140113_692263.htm> is no longer available.
33
The WannaCry ransomware attack is a worldwide cyber attack,
which targets computers running the Microsoft Windows operat-
ing system, encrypting data and demanding ransom payments in
Bitcoin cryptocurrency. The attack started on 12 May 2017 and has
been described as unprecedented in scale, infecting computers in
over 150 countries.
 ARTICLE IN PRESS
6 computer law & security review ■■ (2017) ■■–■■
tentative early evidence suggested the attack may be associ-
ated with a group backed by North Korea.34 China struggled
to recover from the global hacking assault that hit Chinese com-
panies, government agencies and universities especially hard.
It was argued that the risks of China’s heavy dependence on
pirated software were exposed by this incident.35 Research-
ers believe large numbers of computers running unlicensed
versions of Microsoft Windows probably contributed to the reach
of the ransomware attack. As pirated software is usually not
registered with the developer, users often miss major secu-
rity patches that ward off newer cyber assaults.36 Now imagine
if that software was connected to hardware and infrastruc-
ture across a Chinese city. Furthermore it underscores why
China might choose to increase reliance on foreign technol-
ogy firms and strengthen intellectual property protections in
order to avoid future cyber security risks. Alternatively, it may
bolster the Government’s resolve.
China’s current approach under the Cyber Security Law will
be to conduct reviews to ensure that network products and ser-
vices are “secure and controllable.” Understanding Chinese
companies and government agencies as well as private citi-
zens’ well-known historically heavy dependence on pirated
software partially explains this requirement. It is a major cyber
security risk. Part IV below this paper seeks to objectively assess
the intention of China’s 2016 Cyber Security Law, and that as-
sessment requires a deep appreciation of the magnitude of
China’s Smart City top-down policy dreams.
3. Part II: China’s Informatisation Strategy
and Network Sovereignty: “Cyber security and
Informatisation are two wings of one body”
China’s Cyber Security Laws cannot be understood without un-
derstanding China’s Informatisation drive and the concept of
34
Evidence for North Korean involvement via the Lazarus Group,
remains tentative, Symantec called the code overlap “weak links.”
“The Lazurus Group” is a hacker collective with ties to North Korea:
‘North Korean hackers behind global cyberattack?’ (CBS News, 16
May 2017) <http://www.cbsnews.com/news/cyberattack-wannacry
-ransomware-north-korea-hackers-lazarus-group/> accessed 19 May
2017.Western reports suggested that North Korea was responsible.
Some reports in China suggested that the US was responsible. See:
‘WannaCry ransomware has links to North Korea, cybersecurity
experts say’, (The Guardian, 16 May 2017) <https://www.theguardian
.com/technology/2017/may/15/wannacry-ransomware-north
-korea-lazarus-group> accessed 16 May 2017.See also the China Daily
editorial: ‘Greater global cooperation required to fight cyber crime’,
(China Daily, 18 May 2017) <http://www.chinadaily.com.cn/cndy/
2017-05/17/content_29377195.htm>accessed 18 May 2017.
35
Paul Mozur, China, ‘Addicted to Bootleg Software, Reels From
Ransomware Attack’, (New York Times, 15 May 2017), <https://
www.nytimes.com/2017/05/15/business/china-ransomware
-wannacry-hacking.html> accessed 16 May 2017.
36
A study last year by BSA, a trade association of software vendors,
found that 70 percent of software installed on computers in China
was not properly licensed in 2015: ‘Seizing Opportunity Through
License Compliance’, BSA Global Software Survey, May 2016, <http://
www.bsa.org/~/media/Files/StudiesDownload/BSA_GSS_US.pdf> 17
accessed May 2017 cited in ibid.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
Network Sovereignty. It is important to point to the forma-
tion of the Cyber Security and Informatisation Leading Small
Group,37 and its Office, the Cyberspace Administration of China
(CAC) in 2014 as a critical moment in the development of
China’s overall strategy and institutional approach to the prob-
lems of cyber security/Informatisation. At that moment, Chinese
President Xi Jinping then took a personal role in the ICT policy
and regulatory making process. This centralisation provided
much impetus to the legal and institutional developments since
2014. Policy for both Cyber Security and Informatisation resides
with the leader of China.
The consolidation of internet regulations in bodies such as
the Central Leading Group for Cyberspace Affairs and the State
Internet Information Office (SIIO) (中央网络安全和信息化领导小组),
represents a fundamental change from China’s previous patch-
work of online governance.38 This new so-called Leading Small
Group, established on 27 February 2014 and chaired by Presi-
dent Xi Jinping himself, emphatically signalled the consolidation
of internet governance. The SIIO Leading Group exerts ulti-
mate authority over the Cyberspace Administration of China
(CAC) (国家互联网信息办公室), and it gained chief responsibil-
ity in regulating online content.39 In June 2016, China named
Xu Lin, head of the Cyberspace Administration of China, re-
placing Network Sovereignty advocate, Lu Wei.40 Xu publically
37
The new leading group largely merged the membership of the
previous two leading bodies for online governance, the State
Informatisation Leading Group (SILG) and the State Network and
Information Security Coordination Small Group (SNISCSG).
38
‘习近平:把我国从网络大国建设成为网络强国’ [‘Xi Jinping: Build Our
Country from a Large Network Country into a Strong Network
Country’]. (Xinhua, 27 February 2014), available at: <http://news
.xinhuanet.com/politics/2014-02/27/c_119538788.htm> accessed 27
February 2016.
39
‘国务院关于授权国家互联网信息办公室负责互联网信息内容管理工作的
通知 国发’ [‘Notice concerning Empowering the Cyberspace Admin-
istration of China to Be Responsible for Internet Information Content
Management Work’], (State Council, 26 August 2014). For an English
translation see: <https://chinacopyrightandmedia.wordpress.com/
2014/08/26/notice-concerning-empowering-the-cyberspace
-administration-of-china-to-be-responsible-for-internet
-information-content-management-work/> accessed 27 February 2016.
40
David Iaconangelo, ‘China replaces its internet czar. Will its
policies change, too?’ (Christian Science Monitor, 29 June 2016) <http://
www.csmonitor.com/World/Asia-Pacific/2016/0629/China
-replaces-its-internet-czar.-Will-its-policies-change-too> ac-
cessed 30 June 2016.As the official responsible for implementing
the government’s internet policies, Lu was known for his outspo-
ken defense of “Network Sovereignty”. Under Lu’s direction in recent
years, China had taken some tentative steps in the direction toward
a “multi-stakeholder” approach to regulating the internet. In 2015,
Lu had joined the governing body of Netmundial, a forum based
on Western principles of access. Chinese organisations stepped up
their participation in ICANN, the nonprofit that manages IP ad-
dresses globally: Peter Ford, ‘On Internet freedoms, China tells the
world, ‘leave us alone’, (Christian Science Monitor, 18 December 2015)
<http://www.csmonitor.com/World/Asia-Pacific/2015/1218/
On-Internet-freedoms-China-tells-the-world-leave-us-alone>
accessed 12 January 2016.Lu was a global advocate for Network Sov-
ereignty influencing other countries in their internet policies.Bethany
Allen-Ebrahimian, ‘The Man Who Nailed Jello to the Wall’ (Foreign
Policy, 29 June 2016) <http://foreignpolicy.com/2016/06/29/the
-man-who-nailed-jello-to-the-wall-lu-wei-china-internet-czar
-learns-how-to-tame-the-web/> accessed 30 June 2016.
 ARTICLE IN PRESS
computer law & security review ■■ (2017) ■■–■■
vowed to maintain the Chinese Communist Party’s control over
cyberspace.41
Thus, significant institutional change has taken place in order
to consolidate and streamline Chinese ICT policymaking pro-
cesses. It also put the realisation of the Informatisation agenda
at the centre of political and economic reform. CAC’s mem-
bership comprises economic and technological policymakers
on the one hand, and entities more concerned with ideologi-
cal and international security on the other.42
CAC perhaps embodies the inherent conflict between
Network Sovereignty and Informatisation. Are they conflict-
ing strategies or two wings of the same bird? Previously various
ministries had authority over various aspects of the telecom-
munications and the internet. There was a need for developing
e-leadership institutions. Regulatory gaps allowed for the
success of China’s internet giants.43 For example, while the in-
ternet was a banned industry for foreign investment, all of the
BATs had foreign investment through a curious non-legal44 off-
shore entity known as a Variable Interest Entity located in the
Cayman Islands.45
Further, the positioning of CAC near the apex of China’s lead-
ership hierarchy means China’s top leaders will be able to
pursue fundamental reform of national internet regulations
in line with those principles that they view as most essential
to China’s future development. This is a fundamental change.
Placing internet regulations close to the leadership hierarchy
41
‘China appoints new internet regulator’, (Reuters, 29
June 2016) <http://www.reuters.com/article/us-china-internet
-idUSKCN0ZF0H4> accessed 30 June 2016.
42
Rogier Creemers, ‘Cyber China: Updating Propaganda, Public
Opinion Work and Social Management for the 21st Century’, Journal
of Contemporary China, (2015).
43
See Shao, Guosong, Internet Law in China, (Elsevier, Cambridge,
2012). See also Chen, Tain-Jy, and Ying-Hua Ku, ‘Rent Seeking and En-
trepreneurship: Internet Startups in China’, Cato Journal 36(3) (2016)
659.VIEs are usually an offshore holding company based in the
Cayman Islands. This company then establishes a Wholly-Foreign
Owned Entity (WFOE). Investors gain control of the WFOE through
various legal contracts. “Ownership through management con-
tracts.” The first VIE was Sina Weibo in 2000. VIEs can therefore list
on foreign stock markets or be controlled by a foreign investor.A
regulatory loophole in China’s foreign investment regime allowed
this investment in prohibited industries for foreign investment to
occur. It is a legal grey area, which escapes Chinese regulatory con-
trols for foreign investment in “sensitive” industries such as the
internet and media. As of early 2017, VIEs are still unproven in
Chinese Courts. It was essentially created to allow foreign own-
ership in “sensitive industries”.
44
It seems likely that the Chinese government will make VIEs
illegal in 2017. On 19 January 2015, the State Council issued a dis-
cussion draft of legislation setting out the plan for overhauling the
antiquated Chinese foreign investment legal regime. The new system
is set out in the PRC Investment Law Discussion Draft (“Draft”), a
massive document of 178 Articles and 11 Chapters. The underly-
ing philosophy of the Draft is explained in the Explanation of the
PRC Investment Law (the “Explanation”). The Explanation makes
it clear the new law directly targets VIEs. The Draft law is ex-
pected to be passed in 2017.
45
For further reading see: Samuel Farrell Ziegler, ‘China’s Vari-
able Interest Entity Problem: How Americans Have Illegally Invested
Billions in China and How to Fix It’ [2016] 84(2) George Washington
Law Review 539.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
7
means China’s strong desire to invent, innovate and moder-
nise its economy might receive a major boost.
A new centralised internet governance regime may also offer
more clarity for companies, who have always faced the per-
sisting “fuzzy logic”46 of China’s legal system and the substantial
discretion afforded administrative authorities to interpret that
law in an ad-hoc manner. Indeed there is also the strong ar-
gument that in light of China’s top-down innovation policies
China needed a high-level e-leadership, such as the CAC to be
created. The following arguments were made in 2010 in an
article about China’s Emerging Informatisation Strategy:
China needs to take key cross-cutting and synergistic actions:
develop e-leadership capabilities and institutions, develop human
resources to support national ICT diffusion priorities, promote af-
fordable and shared access to ICT, and orient the national innovation
system and ICT industry development to support local adapta-
tion and local users.47
It has been stated that: “The senior political ranks in Beijing
recognize that the government’s ability to control, censor, and
supervise the technology and the information it transmits has
fallen behind and must now catch up. Essentially, the tech-
nology has gotten ahead of the government’s ability to manage
it.”48 This is not necessarily a sinister appraisal of the Chinese
Government’s intent. Nevertheless, the role of CAC is evolv-
ing. CAC has faced a lot of bureaucratic hurdles in trying to
centralise control over cyber security and Informatisation poli-
cies and regulation.49
In a Chinese report, Xinhua News agency noted that CAC is
also trying to reassure foreign companies that the new powers
of review will not compromise products and services, and in-
tellectual property is not in danger. Xinhua also noted that after
passing the Cyber Security Law, CAC is drafting related guidelines
on accessing online data, trying to ease concerns that the new
46
There is also an epistemic problem in defining Chinese laws.
Knowledge of the implementation of laws is sparsely diffused across
bureaucracies, government officials, and those few who have tested
new laws. Sometimes that knowledge is not diffused at all. I call
this problem: ‘fuzzy-logic’, the idea is often used in computer coding
where multiple truths exist in one phrase. That is, Chinese laws
and regulations exist at nausea but often cannot be understood.
Fuzzy logic is an approach to computer programming based on
“degrees of truth” rather than a standard “true or false” logic. Fuzzy
logic includes cases of truth but also includes the various states
of “truth” in between. For example, the result of a comparison
between two things may be not “tall” or “short” but measured in
degrees of tallness. There is a clear ambiguity between what is
meant by “tall” or “short” and everything in between.
47
Nagy K. Hanna, and Christine Zhen-Wei Qiang. “China’s emerg-
ing informatization strategy”, Journal of the Knowledge Economy
1(2) (2010) p158.
48
Samm Sacks, ‘Apple in China, Part I: What Does Beijing Actu-
ally Ask of Technology Companies?’ (Lawfare, 22 February 2016)
<https://www.lawfareblog.com/apple-china-part-i-what-does
-beijing-actually-ask-technology-companies> accessed 1 March 2017.
49
There is an inherent contradiction between cyber security and
Informatisation policy planning. For example, the international re-
sponse to the Cyber Security Law has meant that CAC has had to
consider delaying the law.
 ARTICLE IN PRESS
8 computer law & security review ■■ (2017) ■■–■■
law opens the door for police abuse of power.50 However, fears
about the impact of the new law on foreign businesses remain.
There are increasing reasons for those fears, including the
fact that China’s Cyberspace regime is evolving rapidly. On 25
March 2016, China created the Cyber Security Association of
China (CSAC – 中国网络空间安全协会). CSAC is a Chinese Com-
munist Party (CCP)–controlled industry association. CSAC further
connects the major stakeholders in China’s evolving cyber-
governance regime: government, the private sector, and
researchers. CSAC reflects President Xi’s broader efforts to cen-
tralise power over China’s cyber bureaucracy. Like many of these
new institutions the organisation is in charge of very diverse
goals.51 CSAC’s leadership and membership is also notewor-
thy. Its chair, Fang Binxing, is best known as the “Father of the
Great Firewall,” China’s internet censorship and surveillance
system. Fang’s selection as head of the association suggests a
pro-Network Sovereignty orientation for CSAC.
Furthermore, there were no non-Chinese representatives
among CSAC’s initial membership.52 The CSAC consists of aca-
demic institutes, individuals and internet companies including
Tencent and internet security company Qihu 360. CSAC will focus
on promoting self-discipline in the industry, accelerating the es-
tablishment of industry standards. It will also promote and
develop cyber security studies and participate in international
cooperation through conferences and comparative bodies.53
CSAC’s membership features 257 individual members, in-
cluding senior representatives from Alibaba, Chinese network
security companies, and influential scientific universities and
research institutes, such as the Chinese Academy of Engineering
and the Beijing University of Posts and Telecommunications. Un-
derstandably whether foreign representatives are allowed on to
50
‘中央网信办：正制定个人信息收集规范标准’ [Cyberspace Adminis-
tration of China: Establishing a standard for collecting personal
information] (Xinhua, 11 November 2016) <http://news.xinhuanet
.com/2016-11/11/c_1119897534.htm> accessed 25 December 2016.
51
Fang Binxing (方滨兴), chairman of the CSAC, has indicated in
interviews that the association’s efforts will fall into the follow-
ing categories:• Laws and regulations helping to build out the
new information and communications technology (ICT) legal
regime.• Technology support helping to boost the domestic ICT in-
dustry.• Public opinion supervision to help in information control
and propaganda.• Security and stability of information systems,
products, and services (conventional cyber security).• Protecting core
Chinese interests under globalization, and promoting globally com-
petitive Chinese IT companies.The combination of these diverse
goals under the umbrella of one association, the CSAC, under-
scores a trend that started with the creation of the LSG: President
Xi is tightly tying together the political bureaucracies overseeing
ICT (hardware and software) and digital content (propaganda
system).See: Samm Sacks and Robert O’Brien, ‘What to Make of
the Newly Established CyberSecurity Association of China’, (Center
for Strategic and International Studies, 25 May 2016) <https://www
.csis.org/analysis/what-make-newly-established-cybersecurity
-association-china> accessed 29 May 2016.
52
Fang Binxing justified favoring Chinese companies over their
(possibly) technologically more sophisticated foreign competitors
on the grounds that they are more secure since they are bound
by local government laws: ibid.
53
‘Draft law strengthens China’s cyber security legislature’, (Tech
2, 27 June 2016) <http://tech.firstpost.com/news-analysis/draft
-law-strengthens-chinas-cyber-security-legislature-322671.html> ac-
cessed 30 June 2016.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
this committee will have a major influence on perceptions of its
objectivity.54 The creation of these new organisations and policies
must be contextualised within China’s broader drive to strengthen
cyber governance55 and the concept Network Sovereignty.56
3.1. China’s Informatisation Strategy and Internet Plus
China’s recent Internet Plus policy is one part of China’s
Informatisation Strategy. China’s Informatisation Strategy
could simply be described as China’s e-development or online
development campaign. Connecting industry, government and
the polity to the economic benefits of online platforms and mar-
ketplaces.The Informatisation Strategy has been Chinese policy
since the early 1990s with a goal to build an “information society”.
In Chinese, the characters (xinxihua zhanlue 信息化战略) literally
explain the force for transformative change (hua 化) that infor-
mation can provide. It sounds much less technocratic than
Informatisation in English. The Chinese Government’s termi-
nology of Informatisation is defined as the transformation of
an economy and society driven by information and communi-
cations technology. The Chinese Government has used
informatisation interchangeably with the terms information
society, knowledge economy, and e-development.57 Upgrading
networks and technical requirements for the development of
the internet is also part of this strategy:
(Informatization), covering the enablers of the knowledge economy
and the application of information and communication technology
(ICT) to government, business, and society. They identify the
54
During the launch, Wang Xiujun (王秀军), deputy director of the
country’s internet regulator, said that she hoped the association could
emphasise on safeguarding the country’s internet security and build-
ing up China as an internet power, while attracting more cutting-
edge cyber security enterprises and talent to enhance the industry’s
authority.
55
On 27 December 2016 CAC published China’s first National
Cyberspace Security Strategy (“National Strategy”). See: 《国家网络空间
安全战略》 [National Cyberspace Security Strategy] (People’s Repub-
lic of China) Cyberspace Administration of China, 27 December 2016.
The National Strategy offers few fresh initiatives, but summarises
goals within the PRC Cyber Security Law and other regulations passed
over the past year. A guiding concept is “Network sovereignty”, which
the Strategy defines as China’s right to police the internet within
its borders and participate in managing international cyberspace.
In particular, the strategy also emphasises the need to safeguard key
information infrastructure operators.
56
CSAC seems to be an example of President Xi and his former chief
cyber security deputy Lu Wei (鲁炜)’s pursuit to align government,
industry, and academia around a shared set of cyber governance ob-
jectives. Lu Wei was seen as an evangelist for Network Sovereignty.
Perhaps Lu’s greatest personal contribution to the evolution of the
modern internet was his role as evangelist for China’s approach. He
wasn’t just the technocratic architect of a system of controls; he also
served as a vocal international advocate for the ideological and prac-
tical superiority of such a system. He proudly championed “network
sovereignty”.See: Samm Sacks and Robert O’Brien, ‘What to Make
of the Newly Established CyberSecurity Association of China’, (Center
for Strategic and International Studies, 25 May 2016) <https://www
.csis.org/analysis/what-make-newly-established-cybersecurity
-association-china> accessed 29 May 2016.
57
Nagy K. Hanna, and Christine Zhen-Wei Qiang. “China’s emerg-
ing informatization strategy”, Journal of the Knowledge Economy
1(2) (2010) p162.
 ARTICLE IN PRESS
computer law & security review ■■ (2017) ■■–■■
challenges facing government, business, and rural informatization,
the growing digital divide between rural and urban areas and the
innovations pursued to bridge this divide. This holistic frame-
work is then used to identify key gaps and weaknesses in each
enabler as well as synergies and cross-cutting coordination issues
that need to be managed to support ICT application priorities and
achieve national development goals.58
There is a direct connection between Informatisation (or cre-
ating online platforms) of government departments, Smart City
policies and the need for cyber security laws. On 27 July 2016
China released the Outline of the National Informatisation De-
velopment Strategy (“Outline”),59 it begins with the bold statement
that “without informatisation, there is no modernisation”. The
Chinese Government, through its bold policy statements, dis-
plays a keen sense of history and the need for technological
advancement. Statements like: “human society has undergone
the agricultural revolution and the industrial revolution, and is
now undergoing the information revolution” are made. The
internet is at the forefront of this new stage of development:
At present, a new round of scientific and technological revolu-
tion is unfolding, represented by information technology, the Internet
is becoming more of a guiding force for innovation-driven devel-
opment every day. . . Global informatisation has entered a new
stage of comprehensive penetration, cross-boundary conver-
gence, where it accelerates innovation, and leads development.60
58
“This framework is about creating an information society or
knowledge economy “ecosystem”—a holistic approach that engen-
ders integrated leadership and shared vision, facilitates partnerships
among stakeholders, and maps the connections and shapes the re-
lationships among diverse players. Accordingly, e-development is
defined most holistically so as to facilitate a way of systematically
thinking about ICT as enabler of development, of strategically man-
aging informatization programs, of tapping synergies among
interdependent elements of ICT, and of communicating to a broad
community of practice” See Nagy K. Hanna, and Christine Zhen-Wei
Qiang. “China’s emerging informatization strategy”, Journal of the
Knowledge Economy 1(2) (2010) p129.
59
This Strategy Outline is an adjustment and development of the
“National Informatization Development Strategy 2006–2020” “on the
basis of new circumstances”. For an English translation see: Outline
of the National Informatisation Development Strategy’ (Central Com-
mittee General Office, 27 July 2016) <https://chinacopyrightandmedia
.wordpress.com/2016/07/27/outline-of-the-national
-informatization-development-strategy/> accessed January 20 2017.
60
“Information technology is blending into biotechnology, new
energy technology, new material technology, etc., which is currently
triggering mass technological breakthroughs with green, smart and
extensive characteristics. Information, capital, technology and talent
are flowing ever more quickly at a global scale, the Internet is pro-
moting industrial change, it stimulates the transformation from
an industrial economy to an information economy, and a new in-
ternational division of labour structure is being shaped.The Internet
information undertaking represents new productive forces and new
development orientations, it promotes an unprecedented enhance-
ment of humanity’s capacity to understand the world and change
the world, it is currently profoundly changing people’s ways of pro-
duction and life, it brings a qualitative leap in productivity, triggers
a major change in relationships of production, and is becoming a
guiding force remoulding a new structure in the development of
the international economy, politics, culture, society, ecology, and
military affairs”: see ibid.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
9
The next question is what is novel or reflects incremental
Chinese policy change in this grandiose policy statement? ““In-
ternet Plus” [explained in depth below] is a new factor changing
the situation” according to the Outline. What this means is
unclear. We will assess that statement below. However the
Outline also contains a comment that seems to reflect the need
for cyber security laws and “Network Sovereignty”.61 (Defined
below, but in short, China’s conception of Network Sover-
eignty is that the internet is subject to national boundaries that
individual countries should control and secondly, it also means
participation in global internet governance forums).
the construction of a legal system in cyberspace urgently needs
to be strengthened, and the potential of information technology
in stimulating economic and social development, as well as serving
the overall strategic arrangement of the country, has not been fully
liberated.62
There are further references for the need to form smart
“e-government”63 and engage China’s citizenry in that mission:
“move forward the modernisation of national governance systems
and governance capacities, strive to be one step ahead in prac-
ticing new development ideas, and let informatisation enrich
society, enrich the people, and lay a firm basis to realise the
Chinese Dream of the great rejuvenation of the Chinese nation.”64
61
The concept of Network Sovereignty, now officially translated
as Cyber Sovereignty by Chinese Government releases, emerged
in 2010, when the Chinese State Council Information Office pro-
duced The Internet in China, a white paper on Chinese internet
policy. The Internet in China states that: “Within Chinese terri-
tory the Internet is under the jurisdiction of Chinese sovereignty.
The Internet sovereignty of China should be respected and pro-
tected. Citizens of the People’s Republic of China and foreign citizens,
legal persons and other organisations within Chinese territory have
the right and freedom to use the Internet; at the same time, they
must obey the laws and regulations of China and conscientiously
protect Internet security.”State Council Information Office of Peo-
ple’s Public of China (SCIO), “The Internet in China,” China Daily,
8 June 2010, <http://www.chinadaily.com.cn/china/2010-06/08/
content_9950198.htm> accessed 10 June 2014.
62
For an English translation see: Outline of the National
Informatisation Development Strategy’ (Central Committee General
Office, 27 July 2016) <https://chinacopyrightandmedia.wordpress
.com/2016/07/27/outline-of-the-national-informatization
-development-strategy/> accessed January 20 2017.
63
Despite efforts to introduce freedom of information pro-
grams, China does not have a specific law requiring the government
to provide information. Moreover, the cost of accessing informa-
tion is still relatively high. Although the government has built its
capacity to provide information to the public, further legal reform
is needed to make information administration more open and ef-
fective. A government information access law would provide a legal
basis to support the free flow of information and the develop-
ment of e-government.
64
“Raising government informatisation levels. Perfect departmental
information sharing mechanisms, and establish state governance
big data centres. Strengthen data exchange and sharing, process-
ing and analysis, and monitoring and early warning concerning the
operation of the economy, strengthen capacity to support macro-
economic adjustment and policymaking. Deepen the application
of informatisation in finance and taxation, support the adjust-
ment of financial relationships between the Centre and the localities,
and stimulate reform of the fiscal system. Move forward with
 ARTICLE IN PRESS
10 computer law & security review ■■ (2017) ■■–■■
“Strategic Objectives” are firmly focused on strategic goals,
such as widespread fifth-generation mobile telecommunica-
tions (5G) coverage. These are exceptionally important for
Internet of Things movements, where the smartphone is the
key user device. There are also more ambitious goals like
improving China’s satellite capabilities. These are purely tech-
nocratic goals.
3.2. “Cyber security and informatisation are two wings
of one body”
There are numerous references to the importance of big data,
and the “Internet Plus” Action Plan in driving China’s devel-
opment. There is a “profound convergence of informatisation
and industrialisation.” However, the key point is this: “cyber
security and informatisation are two wings of one body”:
Guaranteeing security. Cyber security and informatisation are two
wings of one body, two wheels of one cart, they must be planned
together, arranged together, moved forward together and imple-
mented together, it must be ensured that they are coordinated and
consistent, and are advanced simultaneously; realistically prevent,
control and eliminate risks that might occur in the process of
informatisation, guarantee development with security, stimulate
security with development, strive to build a trend of long-term
security, and create an undertaking of long-term order.65
Cyber security is one leg of China’s innovation strategy. Ac-
cording to the Outline, China must therefore “build secure and
controllable information technology systems” in order to lead
globally “in next-generation mobile telecommunications, next-
generation internet and other such areas, strive to build
comparative advantages in areas such as mobile Internet, cloud
computing, big data, the Internet of Things”.
Indeed innovation and security are intertwined in ambi-
tious goals such as: “comprehensively plan[ning] the construction
of a national internet big data platform. Progressively launch
socialised trading data back-ups and authentication, and ensure
that data are traceable and recoverable.”
The Outline also calls for “deepening international coop-
eration and exchange”, and “participating in the formulation
of international norms”, both key aspects of Network Sover-
eignty discussed below.
Participating in the formulation of international norms. Vigor-
ously participate in the formulation of international norms for
security in cyberspace. Consolidate and develop regional
sharing of basic information concerning the population and en-
terprises, and effectively support reform of the household
registration system and reform of rules for commercial affairs. Move
forward the informatisation of government openness, strengthen
the construction of an Internet information data service plat-
form and service platforms convenient for the people, and provide
ever more high-quality and efficient online governmental ser-
vices”. For an English translation see: ‘Outline of the National
Informatisation Development Strategy’ (Central Committee General
Office, 27 July 2016) <https://chinacopyrightandmedia.wordpress
.com/2016/07/27/outline-of-the-national-informatization
-development-strategy/> accessed January 20 2017.
65
ibid.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
standardisation cooperation mechanisms, vigorously strive for an
important position in international standardization organisations.
In crucial technologies and important areas such as mobile tele-
communications, next-generation Internet, next-generation radio
and television networks, cloud computing, big data, the Internet
of Things, smart manufacturing, smart cities, cyber security, etc.,
vigorously participate in the formulation of international
standards.66
Finally the Outline in Item 49 urges for the need to “persist
in giving precedence to urgent necessities, and accelerate the
promulgation of urgently needed laws”.67 China’s Cyber Secu-
rity Law is listed first.
Furthermore, on 27 December 2016, the Central Cyber Se-
curity and Informatisation Leading Small Group approved, and
the State Internet Information Office (Cyberspace Adminis-
tration of China) published the National Cyberspace Security
Strategy,68 it too referred to: “Cyber security and Informatisation
are two wings of one body, two wheels of one cart.” The policy
document outlines the potential of the internet for “greatly
stimulating economic and social flourishing and progress, but
at the same time, has also brought new security risks and
challenges”.
3.3. Internet Plus: will it help China’s Smart City drive?
Internet Plus is the most recent embodiment of China’s
Informatisation Strategy. On 5 March 2015, Premier Li Keqiang
in the annual Government Work Report69 introduced the In-
ternet Plus70 policy to expand internet-driven economic activity
and guide new industry development. Internet Plus seeks to
integrate big data, the Internet of Things, and mobile inter-
net with manufacturing, and to promote e-commerce. The plan
stated the State Council “aims to further deepen the integra-
tion of the Internet with the economic and social sectors,
making new industrial modes a main driving force of growth
by 2018.” 71
On 4 July 2015, the State Council released the ‘Guiding Opin-
ions on Actively Promoting the “Internet Plus” Action Plan’
66
ibid.
67
ibid.
68
《国家网络空间安全战略》 [National Cyberspace Security Strat-
egy] (People’s Republic of China) Cyberspace Administration of
China, 27 December 2016.
69
The Government Work Report is the annual statement of the
Chinese Government’s annual goals and strategic aims.
70
The “Internet Plus” policy is designed to stimulate economic
growth through the internet and technology industries. “Internet
Plus” entails the integration of mobile internet, cloud computing,
big data and Internet of Things with modern manufacturing, fos-
tering new industries and business development, including
e-commerce, industrial internet and internet finance. ‘Li Keqiang’s
2015 Government Work Report’, (Sina News, 5 March 2015) <http://
news.sina.com.cn/c/2015-03-05/105331571230.shtml> accessed 7
March 2015.
71
‘China Headlines: China unveils “Internet Plus” action plan to
fuel growth’, (The State Council of the People’s Republic of China, 4 July
2015) <http://english.gov.cn/policies/latest_releases/2015/07/04/
content_281475140165588.htm> accessed 10 July 2015.
 ARTICLE IN PRESS
computer law & security review ■■ (2017) ■■–■■
(“Guiding Opinions”).72 The language of the Guiding Opinions
reflects everything a Smart City needs, including “openness of
public data resources”. The goal is that “by 2025, a networked,
intelligent, service-oriented and collaborative Internet Plus in-
dustry ecological system shall have been improved basically,
a new economic pattern of the Internet Plus shall have been
preliminarily formed, and the Internet Plus shall have become
an important driver of the innovative economic and social
development.”73 “Openness and sharing” and “data sharing” are
common phrases throughout the Guiding Opinions.
In addition, the Guiding Opinions delineate several rel-
evant supportive measures for Smart Cities. They include
changes to the policy environment: eliminating unreason-
able mechanisms and policies, easing internet-integrated
product and service market access, and promoting entrepre-
neurship and innovation. They also include government support
for businesses through increased government procurement of
cloud services, innovative credit products and services, and
crowdfunding.
3.4. Internet Plus v. Censorship and Cyber Security?
Thus, an important objective of Internet Plus is to provide an
open and shared innovation platform by dissolving the bar-
riers that restrict innovation for entrepreneurs. China’s
manufacturing-driven economy is unsustainable and China
must transform to an innovation-driven economy in the In-
ternet Plus era. There is a strong policy-imperative driving
Internet Plus. As Internet Plus is Chinese national policy, the
Chinese government will play a leading role in establishing an
efficient ecosystem and developing industrial parks and in-
cubators for Internet Plus-driven enterprises. “Moreover, in the
Internet Plus era, the general public will play an important role
by starting new Internet Plus undertakings or contributing their
innovative ideas as crowd intelligence.”74
In any country, the government must play a key role to
support innovation. In China the picture is more complex due
to internet controls and Network Sovereignty and the poten-
tial impact on cyber security of for example, real-name ICT user
registration. Despite progress in developing the technocratic
environment, China’s legal and regulatory framework for
Informatisation faces several challenges. Firstly, as the web
72
《国务院关于积极推进“互联网 + ”行动的指导意见》 [Guiding Opinions
on Actively Promoting the “Internet Plus” Action Plan] (People’s Re-
public of China) Standing Committee of the National People’s Congress
(NPCSC), 4 July 2015.The document, which includes general re-
quirements and targets, detailed action plans, and supportive
policies, outlined 11 key Internet Plus actions, including:• entre-
preneurship and innovation.• collaborative manufacturing.• modern
agriculture.• smart energy.• inclusive finance.• public services.• ef-
ficient logistics.• e-commerce.• convenient transportation.• green
ecology.• artificial intelligence (robotics).
73
ibid. The Guiding Opinions have a stated aim of achieving rapid,
high-quality economic growth and industry development, taking
advantage of China’s scale and applications of the internet to drive
deep and comprehensive integration between the internet and the
real economy.
74
Zhu Wang, et al. ‘Internet Plus in China’, [May–June 2016] IT
Professional, 18(3), 5,7.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
11
between the Chinese Government, large Chinese internet giants
such as Alibaba, Baidu and Tencent (known as BAT), foreign
technology firms and a large number of third-party service pro-
viders operating between the government and these enterprises
widens, who gets access to what data, and when becomes in-
creasingly important.75
Secondly, regulations must ensure a level playing field
for new innovators versus incumbents that are large and
powerful organisations, like BAT, who assist the Chinese Gov-
ernment in its censorship work. Reports of such delegated
censoring abound. For example, Alibaba’s Taobao reported
banned merchants from selling foreign media in China – even
media approved by censors. The smaller players in this story
(the e-commerce booksellers) are apparently being directed by
Alibaba’s directives – not the Chinese regulators.76 Thus, there
is a pressing issue: “regulations provide innovators with the
certainty of parameters. Without regulations, companies some-
times don’t feel confident to innovate, for fear that there will
be a sudden implementation of rules that could land them in
trouble.”77
The legal framework for enabling an innovation ecosys-
tem is complex in any country. Issues such as institutional and
regulatory competition and overlap – and, in some cases, un-
derdeveloped laws are all difficult to resolve. In China, internet
controls pose constant regulatory uncertainty. For example, will
China’s new Cyber Security Law restrict market entry by local
Chinese start-ups by making compliance too onerous?
The South China Morning Post, formerly a staunch voice of
critique on the Party’s mainland rule, before it was acquired
by Alibaba’s Jack Ma in December 2015, stated the following in
an editorial about Internet Plus:
China is well known for its strict censorship of online content. Hun-
dreds of foreign websites are blocked and Google remains unstable
in China. More recently, the influential documentary film Under
75
“To better connect government with these corporations, the In-
ternet Society of China (ISC) was established. To a certain degree,
the ISC is an organization in the vein of the All-China Journalists’
Association or the All-China Lawyers’ Association: a self-regulatory
body that connects a profession to the Party. It has issued a number
of conventions through which Internet companies voluntarily accept
duties and obligations in areas including blog and search engine
management, fair-trading and copyright. Its growing role as a
conduit between not only the technical and telecommunications
side of the Internet, but also the online content industry, is un-
derlined, amongst others, by changes in its governing council. In
2008, some of China’s best-known Internet entrepreneurs, includ-
ing Alibaba’s Jack Ma, Tencent’s Pony Ma and Baidu’s Robin Li, were
selected among the 25 vice-directors of this Council.”See: Rogier
Creemers, ‘Cyber China: Upgrading Propaganda, Public Opinion Work
and Social Management for the Twenty-First Century’, Journal of Con-
temporary China, 26(103), (2016) 85, 89.
76
Echo Huang, ‘Taobao is banning merchants from selling foreign
media in China – even media approved by censors’ (Quartz, 10 March
2017) <https://qz.com/929540/selling-foreign-media-in-china
-even-media-approved-by-censors-is-being-banned-alibaba-baba
-groups-online-shopping-platform-taobao/> accessed 12 March 2017.
77
Yasmine Yahya, Regulations essential to support innovation, say
analysts, (Straits Times, 10 February 2017) <http://www.straitstimes
.com/business/economy/regulations-essential-to-support
-innovation-say-analysts> accessed 15 February 2017.
 ARTICLE IN PRESS
12 computer law & security review ■■ (2017) ■■–■■
the Dome78 about air pollution in the country has been taken off
all major domestic websites.
We all know the key thing about the internet is freedom. If Beijing
misses the point and continues to censor access to information,
Premier Li’s new Internet Plus strategy will probably just get
more Chinese to shop online rather than have any significant and
long-term impact on the country’s long-awaited economic
transformation.79
How Internet Plus takes shape is unclear. The goal is to
improve innovation and efficiency. The key point is that col-
lecting data is great for big data driven initiatives. There is a
strong belief that: “[t]he smartphone is the fundamental tool
to connect all parties on the Internet and can be the starting
point of Internet Plus to link consuming, industries and
finance”.80 With China’s incredible smartphone penetration this
is certainly a fact. From a technology and development per-
spective, the more real data, and information collected from
real projects, the more diversified programmes and applica-
tion can be created to offer to the market. What data is collected
and how it is used poses difficult questions regarding the in-
tersection between Network Sovereignty, individual freedoms,
and China’s Informatisation drive.
Chinese officials are turning to technology to improve ef-
ficiency and tackle developmental problems, but big data
solutions to complex developmental problems, such as envi-
ronmental degradation for example, require technology firms
to ensure that their valuable proprietary data is secure and not
subject to abuse. In this regard, China’s policy of Network Sov-
ereignty has worried observers, and this has strongly flavoured
public responses to China’s Cyber Security Law.
3.5. Network Sovereignty and the Rule of Law
This section analyses the concept of Network Sovereignty in
more depth, and poses the question of whether or not China’s
Cyber Security Law is an assertion of that concept. Can Chinese
policy create successful innovation strategies in the face of
78
The documentary, Under the Dome, shaming China’s environ-
mental degradation, was allowed for viewing online, became viral
online, and was then removed by censors. Under the Dome, (穹顶之下
qióngdǐng zhī xià) is a 2015 self-financed, Chinese documen-
tary film by Chai Jing (柴静), a former China Central Television
journalist, concerning air pollution in China. The documentary
epitomises the complex censorship and policy environment in
China. It was viewed over 150 million times on Tencent within three
days of its release, and had been viewed a further 150 million times
(total 300 million views) by the time it was taken offline four days
later.
79
George Chen, ‘Can Li Keqiang’s Internet Plus strategy really save
China?’ (South China Morning Post, 8 March 2015) <http://www.scmp
.com/business/china-business/article/1732704/can-li-keqiangs
-internet-plus-strategy-really-save-china> accessed 10 March 2015.
80
Wu Nan, ‘Is China’s new ‘internet plus’ ambition all about new
smartphones?’ (South China Morning Post, 24 April 2015) <http://
www.scmp.com/tech/enterprises/article/1773737/chinas-new
-internet-plus-ambition-it-all-about-more-smartphones> ac-
cessed 19 May 2015.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
uncertainty over the Rule of Law81 including governmental access
to public and proprietary big data under Network Sovereignty?
China’s newest Five-Year Plan released in March 2016 once again
strongly promotes China’s national innovation agenda as the
major priority for the Chinese Government.82 Many big ideas are
espoused; however, clear regulatory procedures are yet to be
mandated. Internet Plus is one of those big policy ideas. However,
various recent legal and political developments have made
foreign technology firms, governments and observers uneasy
about the protections of the Rule of Law in China. Will these
new laws, under China’s stated policy of Cyber or “Network
Sovereignty”83 slow China’s technological drive? Do these laws
contradict/conflict with the aims and ideals of the Internet Plus
initiatives?
3.6. The concept of Network Sovereignty
Cyber or “Network Sovereignty” emerged as a policy after Presi-
dent Xi Jinping took office. There are two linked but contrasting
aspects of “Network Sovereignty”:
1. “Network Sovereignty” means that the Chinese Government
considers the close control of online discourse a matter of
national sovereignty. Network Sovereignty means cyber se-
curity is akin to a principle in international law similar to
exclusive economic zones – a country’s controlled maritime
borders. China has debated and implemented increas-
ingly tight data localisation policies over the past few years
and proposed further restrictions such as requiring all
Chinese data to be held in servers located in China, while
81
There are radically different interpretations of Rule of Law. De-
fining Rule of Law in China is a major theoretical task of this research.
In commercial law, it means the ability to have certainty in com-
mercial transactions and precision of the laws governing property
rights between citizens and the State and between private indi-
viduals. Rule of Law is a complex concept in China. It is an evolving
subject. Scholars such as Randall Peerenboom have written exten-
sively on the subject: see for example, Randall Peerenboom, China’s
Long March Toward Rule of Law (Cambridge University Press, Cam-
bridge, 2002); China Modernizes (Oxford University Press, Oxford,
2007).See also: John, Gillespie, ‘Developing a theoretical frame-
work for evaluating rule of law promotion in developing countries,’
in Rule of Law Dynamics: In an Era of International and Transnational
Governance, (eds.) Michael Zurn, Andre Nollkaemper, and Randall
Peerenboom, (Cambridge University Press, New York, 2012).
82
The newest Five Year Plan was released in March 2016, as China’s
manufacturing comparative advantage erodes and many univer-
sity graduates are unemployed, China’s innovation economy is a
political imperative.
83
Cited as Network or Cyber Sovereignty (“网络主权” “wangluo
zhuquan” or “Internet Sovereignty,” as it is sometimes translated.
However, it is better translated as “Network Sovereignty” from a
neutral language perspective). It emerged as a foundational policy
after President Xi took office. In short, the Chinese conception of
“Cyber (Network) Sovereignty” is an internet fragmented by na-
tional boundaries and regulated individually by national governments.
It has become a near-ubiquitous component of Chinese com-
ments delivered to overseas audiences on the subject of internet
policy-making. This is a common trend in Chinese politicking that
certain phrases become “fashionable” in China’s political dis-
course. This lexicon has been adopted by the Chinese media. Its
position in domestic law is evolving and unclear.
 ARTICLE IN PRESS
computer law & security review ■■ (2017) ■■–■■
granting access to government authorities.84 What this
means for foreign technology and Smart City business op-
erators is discussed further below.
2. Furthermore, China’s conception of Network Sovereignty also
means discussions over global internet governance. China
has actively been involved in creating global internet tech-
nical standards and norms of behavior.
While some fear China’s global impact on the internet,
Chinese agencies and engineers are increasingly coopera-
tively involved in technical standard development and internet
regulation working groups.85 This is a major aid for Smart Cities
to attempt to create clear and precise technical regulatory
standards. Indeed, “[w]hen it comes to standards, strategic en-
gagement is likely to be more successful than isolationism.”86
In many ways, cooperation is inevitable. There continues to be
large flows of capital out of China to other countries includ-
ing into foreign technology companies,87 and the drive for
foreign technology companies to enter China ensures that mu-
tually recognised best practices are an aspirational objective.
Indeed without cooperation there can be no extraterrito-
riality for cyber security laws.88 Network sovereignty is a
complex idea as cyberspace is everywhere but China seeks to
establish that there are borders in cyberspace that govern-
ments can control. Establishing a cyberspace strategy is a
statement of the potential collaboration and the potential
threats China faces. Cyber security risks emanate from many
sources: nation-states; insiders; criminal enterprise and
hacktivists. China’s Cyber Security Law begins to identify a
series of actors such as “network operators” – broadly defined
– and pair them with a potential threat.
The Outline of the National Informatisation Development
Strategy at Item 54 defined Network Sovereignty, in part as:
Safeguarding cyber sovereignty and national security. Manage
online activities within the range of our country’s sovereignty ac-
cording to the law, and persist in defending our country’s cyber
sovereignty. Persist in preventing and attacking acts to divide the
country, incite rebellion, overthrow the regime, destroy unity, steal
secrets, etc., through the network.89
84
These laws are discussed in detail below.
85
‘CNNIC Hosts “Promote Internet Development through Tech-
nology and Standards” Session of WIC Wuzhen Summit’ China
Internet Network Information Center, 2 February 2016, <https://
cnnic.com.cn/IC/Events/201602/t20160204_53402.htm> accessed 23
March 2017.
86
Nagy K. Hanna, and Christine Zhen-Wei Qiang. “China’s emerg-
ing informatization strategy”, Journal of the Knowledge Economy
1(2) (2010) p153.
87
See for example: Julie Zhu and Tova Cohen, ‘China’s tech money
heads for Israel as U.S. welcome wanes’ (Reuters, 11 May 2017),
<http://www.reuters.com/article/us-china-investment-israel
-idUSKBN187080> accessed 17 May 2017.
88
China’s Criminal Law was amended in 2016, to encapsulate cyber
crime offences. It could overlap with the Cyber Security Law.
89
For an English translation see: Outline of the National
Informatisation Development Strategy’ (Central Committee General
Office, 27 July 2016) <https://chinacopyrightandmedia.wordpress
.com/2016/07/27/outline-of-the-national-informatization
-development-strategy/> accessed January 20 2017.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
13
On 1 March 2017 China released its strategy on cyberspace
cooperation. According to Xinhua, the International Strategy of
Cooperation on Cyberspace (“Cyberspace Strategy”) is the first
China has released regarding the virtual domain.The Cyberspace
Strategy provides a comprehensive explanation of China’s policy
and position on cyber-related international affairs as well as the
basic principles, strategic goals and plan of action in its Cyberspace
relations. China implores other countries to “guard against cy-
berspace becoming a new battlefield”. The Cyberspace Strategy
aims to guide China’s participation in international cooperation
in cyberspace, and encourage the international community to
build a peaceful, secure, open, cooperative and orderly cyberspace.
China seeks a multilateral, democratic and transparent global
internet governance system. This may mean moving “central
command” of the internet out of US hands90 and into the UN91
and ICANN92. According to Xinhua News agency’s press release93:
The aim of the strategy – jointly building a community of shared
future in cyberspace – illustrates China’s approach to cyber-
space cooperation. Notably one that is based on peace, sovereignty,
shared governance and shared benefits.
The strategic goals of China’s participation in international cy-
berspace cooperation are: the safeguarding of China’s sovereignty,
security and development interests in cyberspace; the secure and
orderly flow of information on the Internet; improved global connec-
tivity; maintaining of peace, security and stability in cyberspace;
enhancement of international rule of law in cyberspace; the pro-
motion of the global development of the digital economy; and
deepening cultural exchange and mutual learning, according to
the strategy.
China’s plan of action includes promoting the building of rule-
based order in cyberspace, expanding partnership with other
countries, boosting institutional reform in Internet governance,
jointly combating cyber terrorism and crimes, and protecting in-
dividual privacy in cyberspace.
China supports Internet-based innovation and entrepreneur-
ship, and is committed to assisting developing countries with cyber
security capacity building, it said.
The country supports the formulation of cyberspace trade rules
and effective policy coordination among countries, said the strategy.
China will work with other countries to strengthen global infor-
mation infrastructure to facilitate the smooth flow of information,
90
There is currently an ongoing debate in the US, about whether
or not the US should cede all governance powers of the internet
to ICANN and other not-for-profit bodies.
91
Russia and China, among others, had backed the idea of em-
powering an obscure United Nations body called the ITU
(International Telecommunications Union).
92
ICANN guides the internet’s global Domain Name System (DNS),
including policy development for the internationalisation of the
DNS system. ICANN also maintains registries of Internet Protocol
identifiers. It is a not-for-profit technical body. See: https://
www.icann.org.
93
‘China releases first strategy on cyberspace cooperation’, (Xinhua,
1 March 2017) <http://news.xinhuanet.com/english/2017-03/01/
c_136094734.htm> accessed 1 March 2017.
 ARTICLE IN PRESS
14 computer law & security review ■■ (2017) ■■–■■
and facilitate cyber culture cooperation among countries, accord-
ing to the strategy.
With the animation, comic and games industry as a priority area,
China will carry out practical cooperation with countries along
the Belt and Road, encourage Chinese enterprises to provide online
cultural products and services catered to local needs based on local
cultural resources, said the strategy.
The strategy was issued by the Foreign Ministry and State In-
ternet Information Office.94
The Cyberspace Strategy reflects the inherent tension
between Internet Plus and Network Sovereignty.
China drafted several security laws during 2014–16 that tight-
ened regulation over suppliers of technological equipment and
services. Many of these measures involve the concept of “secure
and controllable” technology, a loosely defined term that in-
volves government security checks and data storage within
China.95 Chinese officials refer to the measures as necessary to
national security.96 They would allow China to verify that critical
equipment is not vulnerable to hacking and to fight terrorism
94
For an official English translation see: ‘Full Text: International
Strategy of Cooperation on Cyberspace’, (Xinhua, 1 March 2017)
<http://news.xinhuanet.com/english/china/2017-03/01/c
_136094371.htm> accessed 1 March 2017.
95
The phrase “secure and controllable” (安全可控) is sometimes also
referred to as “secure and reliable” (安全可靠) or “indigenous and con-
trollable” (自主可控). The Chinese government has also set out new
security requirements in industry-specific regulations. The phrase
has appeared in separate pending rules for ICT used in insurance,
medical devices, and the Internet Plus sectors (i.e. smart technol-
ogy, cloud computing, mobile technology, and e-commerce).“There
are numerous interpretations of the phrase, but one thing is
clear: the government is linking localization with security, which
means that Chinese companies have a competitive advantage
when it comes to meeting these new security standards. This
puts foreign technology companies in a weaker negotiating posi-
tion, and adds to pressure that they cooperate with local partners,
rather than attempting to go it alone in the market.” See Samm
Sacks, ‘Apple in China, Part I: What Does Beijing Actually Ask of
Technology Companies?’ (Lawfare, 22 February 2016) <https://
www.lawfareblog.com/apple-china-part-i-what-does-beijing
-actually-ask-technology-companies> accessed 1 March 2017.The
term “secure and controllable” was initially introduced in the
《关于应用安全可控信息技术加强银行业网络安全和信息化建设的指导意见》
（称“317号文”） [Guidelines on Promoting the Application of Secure
and Controllable Information Technology Products (Circular 317)]
(People’s Republic of China) China Banking Regulatory Commission
(CBRC), 26 December 2014. It was reported that the CBRC is going
to reintroduce the banking safety rules (the “Revised Regulation”)
after consulting representatives of western technology enterprises
such as Microsoft, IBM and Cisco about the revised regulation. It was
suspended in April 2015 and an amended version was released.
96
For example, the English language China Daily referenced the
murder of 29 people and many more were injured by knife-
wielding assailants at a train station in Kunming on 1 March 2014
as evidence of the need for the new law: “The attacks have brought
greater urgency to Chinese lawmakers’ drafting of an anti-
terrorism law. The first draft of the law was submitted for legislators’
review in October.”‘Lawmakers weigh China’s draft anti-terrorism law’,
(China Daily, 25 February, 2015) <http://www.chinadaily.com.cn/
china/2015-02/25/content_19653472.htm> accessed 22 March 2016.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
and criminality. By contrast, foreign governments and trade
groups have viewed these policies as onerous and a possible way
to discriminate against non-Chinese vendors.
Network Sovereignty’s position in Chinese domestic law
is becoming ubiquitous.97 It includes data protection98, banking99
and media regulations,100 China’s 2015 Anti-Terrorism and 2016
Cyber Security Laws.These laws all threatened to affect foreign
and Chinese technology companies participating in the Chinese
economy. They legislated on high profile matters such as data
encryption and technology transfers.101 They created great un-
certainty amongst foreign and Chinese technology companies.
In assessing whether these fears are justified, it is necessary
to focus on two high profile laws as the most prominent ex-
amples of legislated Network Sovereignty: the final version of
China’s Anti-Terrorism Law of December 2015, and China’s Cyber
Security Law which took effect on 1 June 2017. These laws fit
China’s ethos of “Network Sovereignty” – the idea that states
97
The National Security Law released on 1 July 2015 covers China’s
border security, acts of terrorism but also contains a provision that
discusses the need for the Chinese internet to be a “secure and
controllable” network and the need to maintain that network safely.
Article 25 introduces the concept of a “secure and controllable”
(安全可控) network; and Article 59 establishes the concept of “na-
tional security review and oversight”.《中华人民共和国国家安全法》
[National Security Law] (People’s Republic of China) Standing Com-
mittee of the National People’s Congress (NPCSC), 1 July 2015.
98
Currently, there is no comprehensive data protection law in China.
However, a draft Personal Data Protection Law has been under review
by the government for many years, but there is still no indication
as to if and when that law will be passed. It was reported that public
opinion has been sought. Reportedly, consultations had already been
held with large Chinese companies including Baidu, Alibaba, Tencent,
360 and Huawei. Rather, provisions relating to personal data pro-
tection are found in various laws and regulations. Generally speaking,
provisions found in laws such as the General Principles of Civil Law
and the Tort Liability Law may be used to interpret data protection
rights as a right of reputation or right of privacy.
99
See: 《关于应用安全可控信息技术加强银行业网络安全和信息化建设的
指导意见》 （称“317号文”） [Guidelines on Promoting the Applica-
tion of Secure and Controllable Information Technology Products
(Circular 317)] (People’s Republic of China) China Banking Regula-
tory Commission (CBRC), 26 December 2014.
100
For example, the Ministry of Industry and Information Tech-
nology (MIIT) and the State Administration of Press Publication Radio
Film and Television (SAPPRFT) unveiled new measures that require
localisation of server and storage equipment for online publish-
ing and take effect 10 March 2016. See: 《网络出版服务管理规定》,
[Network publishing services management regulations] (People’s
Republic of China) Ministry of Industry and Information Technol-
ogy (MIIT) and the State Administration of Press Publication Radio
Film and Television, 4 February 2016, <http://www.gapp.gov.cn/
govpublic/84/1067.shtml> accessed 20 September 2016.
101
《中华人民共和国反恐怖主义法》 [Counter-Terrorism Law] (Peo-
ple’s Republic of China) Standing Committee of the National People’s
Congress (NPCSC), 27 December 2015.In recent years, China and
the US have clashed over trade in the technology industry. Last year,
the Obama administration responded to lobbying from American
companies against a number of Chinese laws that the companies
said were devised to push them out of China. China abandoned a
regulation restricting what foreign hardware could be sold to Chinese
banks. China also banned Microsoft’s Windows 8 from govern-
ment offices and threatened to phase out of IBM servers from
Chinese banks.
 ARTICLE IN PRESS
computer law & security review ■■ (2017) ■■–■■
should be permitted to govern and monitor their own cyber-
space, controlling incoming and outgoing data flows.
3.7. China’s Anti-Terrorism Law
The State Council of China on 27 December 2015, published
the Anti-Terrorism Law of the People’s Republic of China. The
law came into effect on 1 January 2016. The initial draft was
circulated for comment in late 2014. It attracted global criti-
cism, especially from technology companies participating in
the Chinese economy. Following several rounds of revisions
during the subsequent 12 months, the Standing Committee of
the National People’s Congress passed the law unanimously.
Most of the debate on the draft law was focused on the so-
called “backdoor provisions.” The draft law would have required
telecommunications operators and internet service provid-
ers to provide the Chinese government with “backdoor” access
to their products, to handover encryption codes for review, and
to store local user data on servers within China.
The final law abandoned these demands for encryption
review and data localisation. Had the “backdoor provisions” been
implemented it is clear that foreign technology companies
feared losing their intellectual property via theft through de-
clared backdoors. This may have isolated and slowed China in
its innovation and Smart City drive. It would also have had
major implications for free and open company data.
The final law only requires telecommunications operators
and internet service providers to help decrypt information in
the event of a terror attack, but not install security “backdoors”
as initially planned in the draft version.102 In reality, this could
logically have the same impact as a backdoor. Even if a company
has an encryption system, mandated access (in a terror event)
is the same as having either a backdoor or front door. Yet the
amendment did appear to appease critics of the law.
Furthermore, importantly from a global trade perspective
and from a position of commercial reality, the provision in the
initial draft that required companies to keep servers and user
data within China was removed from the final law. What might
have been a major setback for the development of Smart Cities
may have in fact been a crisis averted.
This kind of internal debate and compromise is not unusual
in recent Chinese law-making.103 It seemingly allows China time
to await domestic and international reaction to its draft laws.
It also reflects the competing interests within the Chinese Gov-
ernment and the tension between Network Sovereignty and
Internet Plus. The Cyber Security Law is another example of
a consultative legislative debate, discussed in detail below.
3.8. Assessing the Anti-Terror Law: recent Chinese
legislative trends
Assessing the Anti-Terror Law in terms of recent Chinese
legislative trends, the question remains whether the
102
The final law retains the original text on the requirement for
providing the government with technical support, including
backdoor access and decryption, but only for the prevention and
investigation of terrorist activities.
103
Both China’s Anti-Terror Law and Cyber Security Laws went
through public consultation periods. Subsequent regulations dis-
cussed below also sought public comment.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
15
counter-terrorism provisions are different from domestic US
discussions surrounding backdoor keys for mobile phone en-
cryptions. Is the new law in line with international norms? Is
China legislating standard international practice?
3.9. The US, data encryption and backdoor keys
Many Western governments, including the US, have made
similar requests for encryption keys. In December 2015, the US
simultaneously debated the same backdoor key issue. The US
questioned whether to enforce security backdoors, for the
Federal Bureau of Investigations (FBI) in counter-terror inves-
tigations. Apple CEO Tim Cook released a statement in February
2016, saying: “When the FBI has requested data that’s in our
possession, we have provided it. Apple complies with valid sub-
poenas and search warrants, as we have in the San Bernardino
case”.104 The San Bernardino case refers to a terrorist attack
in California on 2 December 2015, in which 14 people were mur-
dered by an Islamist terrorist. Cook continued that “[w]hile we
believe the FBI’s intentions are good, it would be wrong for the
government to force us to build a backdoor into our prod-
ucts.” He went on to write that: “ultimately, we fear that this
demand would undermine the very freedoms and liberty our
government is meant to protect”.105
The crux of this debate is a combination of cyber security
measures, US political culture and commercial realities. US au-
thorities have had great difficulty un-encrypting devices.
Reportedly, Apple uses more secure encryption in its mobile soft-
ware than does Google for its Android phones, a commercial
selling point for Apple.106 Further, highly popular messaging plat-
forms such as Facebook’s WhatsApp, for example, use end-to-
end encryption that even the National Security Agency (NSA)
had to invest significant resources to crack.107 Facebook has been
working on integrating cryptography into its normal chat.108
In the final analysis, the US Justice Department aban-
doned its bid to force Apple to help unlock the iPhone used
by one of the shooters in the San Bernardino terrorist attack.
Investigators found a software loophole without Apple’s
assistance.109 It was later reported that an Israeli security firm
possessed the necessary technology to un-encrypt the iPhone
104
Elias Groll, ‘Why Apple – and Not Google – Is in the FBI’s Crosshairs’,
(Foreign Policy, 18 February, 2016) <http://foreignpolicy.com/2016/
02/18/why-apple-and-not-google-is-in-the-fbis-crosshairs/> accessed
25 March 2016.
105
ibid.
106
Google cannot encrypt its phone data as securely as Apple. This
makes Apple’s encryption technology a commercial selling point.
Arguably, Apple’s embrace “of encryption is as much a business
model decision as it is a principled embrace of user privacy”: ibid.
107
ibid.
108
Signal is an encrypted instant messaging and voice calling ap-
plication for Android and iOS.
109
Matt Zapotosky, ‘FBI has accessed San Bernardino shooter’s
phone without Apple’s help’, (The Washington Post, 28 March 2016),
<https://www.washingtonpost.com/world/national-security/fbi
-has-accessed-san-bernardino-shooters-phone-without-apples
-help/2016/03/28/e593a0e2-f52b-11e5-9804-537defcc3cf6
_story.html> accessed 30 March 2016.
 ARTICLE IN PRESS
16 computer law & security review ■■ (2017) ■■–■■
and shared the technology with the FBI.110 It has also been sug-
gested in cyber security circles that the FBI abandoned the
matter for political reasons due to public pressure as much as
technical reasons.111 Public opinion seemed to be turning against
the FBI. Indeed, the Congressional Committee112 Encryption
Working Group Year-End Report reported on 20 December 2016
that back doors and “compelled disclosure by individuals” are
a bad idea.113 A key question was asked: “[w]hat vulnerabili-
ties remain after communications have been encrypted and
how might those vulnerabilities be addressed?”114
The House Committee’s response was emphatic:
Encryption is inexorably tied to our national interests. It is a safe-
guard for our personal secrets and economic prosperity. It helps
to prevent crime and protect national security. The widespread use
of encryption technologies also complicates the missions of the law
enforcement and intelligence communities. As described in this
report, those complications cannot be ignored. This is the reality
of modern society. We must strive to find common ground in our
collective responsibility: to prevent crime, protect national secu-
rity, and provide the best possible conditions for peace and
prosperity.
That is why this can no longer be an isolated or binary debate.
There is no “us versus them,” or “pro-encryption versus law en-
forcement.” This conversation implicates everyone and everything
that depends on connected technologies – including our law en-
forcement and intelligence communities. This is a complex challenge
that will take time, patience, and cooperation to resolve. The po-
tential consequences of inaction – or overreaction – are too
important to allow historical or ideological perspectives to stand
in the way of progress.115
Apple released a statement: “From the beginning, we ob-
jected to the FBI’s demand that Apple build a backdoor into
the iPhone because we believed it was wrong and would set
a dangerous precedent. As a result of the government’s dis-
missal, neither of these occurred. This case should never have
110
“Israeli firm ‘helped FBI crack San Bernardino gunman’s cell
phone without Apple’s help’”, Daily Mail, 30 March 2016 <http://
www.dailymail.co.uk/news/article-3514875/Israeli-firm-helped
-FBI-crack-San-Bernardino-gunman-s-cellphone-without-Apple
-s-help.html> accessed 30 March 2016.
111
National reactions to Apple’s opposition of the order were mixed.
A CBS News poll that sampled 1022 Americans found that 50% of
the respondents supported the FBI’s stance, while 45% supported
Apple’s stance: ‘CBS News poll: Americans split on unlocking San
Bernardino shooter’s iPhone’, (CBS News, 18 March 18, 2016) <http://
www.cbsnews.com/news/cbs-news-poll-americans-split-on
-unlocking-san-bernardino-shooters-iphone/> accessed 19 Sep-
tember 2016.
112
Formerly known as the House Judiciary Committee and House
Energy and Commerce Committee Encryption Working Group.
113
US Congressional Committee, Encryption Working Group Year-
End Report, (. . ..,20 December 2016), <https://judiciary.house.gov/
wp-content/uploads/2016/12/20161220EWGFINALReport.pdf>
accessed 19 September 2016.
114
ibid., p13.
115
ibid.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
been brought.”116 The US government was then left to decide
whether it would outline its decryption method to Apple, in
keeping with a reportedly little-known process in which federal
officials must consider disclosing security vulnerabilities they
find to the companies at risk from those loopholes.117
3.10. China, data encryption and backdoor keys
The point of this commentary on US practice is to provide a
broader international context for recent Chinese legislative de-
velopments and their implications for Smart Cities and
innovation of smart technologies. Effective and successful In-
ternet of Things devices and Smart Cities need technologies
that talk to each other securely. Open dialogues between people,
machines and data, lead to successful Smart City outcomes.
Cyber security is an essential part of that dialogue.
Had the “backdoor provisions” in the Chinese Anti-Terror
Law been implemented it is clear that foreign and Chinese tech-
nology companies would have feared possible, intellectual
property theft, even if this fear was only based on perception
rather than reality.118 In observing the Chinese legal system,
foreign critique is often based on perceptions of vague regu-
lations. This negative reaction may be why the law was revised.
Regulatory clarity goes a long way towards increasing foreign
confidence in China’s legal system.
In April 2016, Cisco Systems signed an agreement with the
southern Chinese city of Guangzhou to build a “model smart
city”.119 The project is reportedly a first in China. This might
suggest that international partners have not been dissuaded
116
Matt Zapotosky, ‘FBI has accessed San Bernardino shooter’s
phone without Apple’s help’, (The Washington Post, 28 March 2016),
<https://www.washingtonpost.com/world/national-security/
fbi-has-accessed-san-bernardino-shooters-phone-without
-apples-help/2016/03/28/e593a0e2-f52b-11e5-9804-537defcc3cf6
_story.html> accessed 30 March 2016.
117
ibid.
118
In the cyber security community, the belief is that back doors
are dangerous. They could allow China to develop so-called NOBUS
exploitation technology. The phrase NOBUS comes from “NObody
But US”, and concerns security vulnerabilities that the United States
National Security Agency (NSA) believes that only it can exploit.
This opens up major ethical questions: should China stockpile in-
ternet vulnerabilities or disclose and fix them? “It’s a complicated
problem, and one that starkly illustrates the difficulty of separat-
ing attack and defense in cyberspace.” Bruce Shneier, ‘Should U.S.
Hackers Fix Cybersecurity Holes or Exploit Them?’ (The Atlantic, 19
May 2014) <https://www.theatlantic.com/technology/archive/2014/
05/should-hackers-fix-cybersecurity-holes-or-exploit-them/371197/
> accessed 20 February 2016.
119
“Cisco partners with Guangzhou to build ‘model smart city’”,
China.org.cn, 22 April 2016, <www.china.org.cn/business/2016-04/
22/content_38308997.htm>.Cisco will establish a head office for
innovation in Guangzhou’s Panyu District to develop technology
related to the Internet of Everything (IoE) and the Internet of Things
(IoT), and create a IoE/IoT cloud platform to serve industry.Through
big data, cloud computing, and the IoE/IoT, a smart city can address
problems such as traffic jams and pollution more efficiently. Gua-
ngzhou, as a national hub for advanced manufacturing, is actively
transforming its traditional industries with the introduction of new
technology. Cisco announced last June that it would invest 10 billion
U.S. dollars to support local innovation, and later set up a joint-
venture with Chinese cloud computing and data center company
Inspur.
 ARTICLE IN PRESS
computer law & security review ■■ (2017) ■■–■■
from investing in Chinese Smart City infrastructure by the Anti-
Terror Law. Cisco’s deal with the city of Guangzhou is perhaps
an endorsement of China’s legislative decisions. Or perhaps
an indication that foreign firms cannot be too fastidious. Oth-
erwise they will end up like Google: restricted from doing
business in China.120
Nevertheless, the amendment of the Anti-Terror Law pro-
vides some support for the hypothesis that foreign technology
companies will be able to negotiate their data security ar-
rangements under the new Cyber Security Law.
3.11. Big data, cloud computing, The Internet of Things
and Cyber Security
Before this paper considers China’s Cyber Security Law in depth,
it is important to acknowledge that China has been very suc-
cessful in developing its innovation ecosystem and as a result
faces genuine cyber security threats.
There is an intersection between big data and the Inter-
net of Things (IoT), big data adoption, analytics, big data
distributions, and cloud computing intelligence and cyber se-
curity. The IoT hardware device collects the (big) data (through
sensors for example) and then the analytics team (or artifi-
cial intelligence) discover the value of the data. ‘Things’ already
range from automotive subsystems and security cameras to
Bluetooth beacons, smart garments, agricultural crop sensors
and many other ‘things’.
A company’s ability to manage big data analytics is critically
important to their success or failure with IoT devices. IoT along
with artificial intelligence is a core justification for investing in
and implementing big data analytics. That is, the companies that
store all that valuable device data are concerned about making
big data usable.There is a belief beyond the IoT hype that: “[e]very
enterprise needs to factor in how the Internet of Things is going
to affect them and their business, and must respond by estab-
lishing the right infrastructure to support this level of Big Data
and analytics. If they don’t, they will fall behind.”121 This is where
China’s Cyber Security Law and what it says about enforced data
collections (discussed below) is important.
Protection of data has much to do with cyber security and
cyber security protocols. Data analytics can also provide cyber
security insights. However cyber security is crucial. Security is
a major concern for businesses as they research and implement
IoT infrastructure. American multinational telecommunica-
tions conglomerate, AT&T noted that 2014–2016 has seen a 3198%
increase in attackers scanning for vulnerabilities in IoT devices.122
120
Google.com has faced persistent blocking in China by Chinese
authorities, despite periods of time when it was unblocked, such
as the Beijing Olympics.
121
Howard Baldwin ‘A Match Made Somewhere: Big Data
and the Internet of Things’ (Forbes, 24 November 2014) <http://
www.forbes.com/sites/howardbaldwin/2014/11/24/a-match
-made-somewhere-big-data-and-the-internet-of-things/
#700337432028> accessed 15 July 2015.
122
‘AT&T, IBM, Nokia, Palo Alto Networks, Symantec and Trustonic
Form IoT Cybersecurity Alliance’, (AT&T Newsroom, 8 February 2017)
<http://about.att.com/story/iot_cybersecurity_alliance.html> ac-
cessed 3 March 2017.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
17
In a survey AT&T conducted in 2016, 58% of business leaders
said they were not confident in the security of their IoT devices.123
For enterprises, the Internet of Things (IoT) currently represents
something of a double-edged sword. On the one hand there are
manifold opportunities to boost the efficiency of products and ser-
vices, create new revenue streams and reduce operational costs
by connecting all manner of devices (‘things’) to the internet and
analysing the data they generate. On the other hand, this is still
an immature market in which architectures, technologies, stan-
dards and vendors are all moving targets, making investment a
risky business. In particular, security is a major worry when it
comes to the IoT.124
At the network level there are great risks.125 This is where
China’s Cyber Security Law and what it says about protected
critical infrastructure is important. At the same time, the Law
could unduly restrict China’s impressive emerging entrepre-
neurial ecosystem. The issue of storing data in the cloud
securely will only become increasingly important. This is one
area of law that can really delay and impact China’s innova-
tion drive.
3.12. IoT, Shanzhai and Shenzhen
As connected devices become common, Shenzhen’s manu-
facturing heritage, talent base and manufacturing and
technology workers make it a perfect IoT hub, not just for China,
but the entire world. Increasingly, many Wholly Foreign-
Owned Enterprises (WFOEs) are setting up in Shenzhen.
Furthermore, many foreign firms are working with electron-
ics parts manufacturers in Shenzhen and are looking to
manufacture products, create joint ventures or enter technol-
ogy licensing agreements. There is an obvious reason for this,
as Forbes Magazine noted:
The IoT sector has found its center of gravity in a city far away
from Silicon Valley, in the bustling, southern Chinese Special Eco-
nomic Zone of Shenzhen. The Tier 2 China city with a population
of approximately 14 million is located 40 km north of Hong Kong.
While the city has always had a special identity as an entrepre-
neurial manufacturing hub, more recently it has become the darling
of IoT entrepreneurs from around the world.126
123
ibid.
124
Charles McLellan, ‘Internet of Things in the enterprise: The state
of play’ (ZDNet, 1 February 2017) <http://www.zdnet.com/article/
enterprise-iot-in-2017-the-state-of-play/> accessed 3 March 2017.
125
Several IoT technology areas have multiple contenders to choose
from. In low-power short-range wireless networks, for example,
there is Zigbee (and other IEEE 802.15.4-based PANs), ZWave,
Bluetooth (4 and 5), DASH7, WiFi, NFC and WiGig. Several options
are available for low-power wide-area networking too, including
proprietary technologies like Sigfox, incumbent 2G/3G cellular net-
works and NarrowBand IoT (NB-IoT) – the latter being the likely
long-term winner.
126
Falguni Desai, ‘Innovators Find Internet of Things Paradise in
Shenzhen’ (Forbes, 7 March 2016) <http://www.forbes.com/sites/
falgunidesai/2016/05/07/innovators-find-internet-of-things
-paradise-in-shenzhen/#5bf14931552d> accessed 1 March 2017.
 ARTICLE IN PRESS
18 computer law & security review ■■ (2017) ■■–■■
According to Wired Magazine, a “unique manufacturing eco-
system has emerged in Shenzhen. Inventers or makers have
access to the world’s leading hardware-prototyping culture
whilst challenging misconceptions from the West.”127 A uniquely
Chinese element is apparent. The “evolution of “Shanzhai” – or
copycat manufacturing – has transformed traditional models
of business, distribution and innovation, and Wired asks what
the rest of the world can learn from Shenzhen – the so-
called “Silicon Valley of hardware”.
Shenzhen-based HAX is the world’s largest hardware
accelerator,128 and their General Partner Benjamin Joffe eluci-
dated that:
The reason why HAX is based in Shenzhen and not Hong Kong
is because of the immediate access to the components market for
prototyping and to the manufacturing ecosystem and know-
how. It’s immediate, cheaper and faster. It’s literally one click
away.129
Furthermore, an hour away by train, Hong Kong “has the
benefits of a first world capital: Open Internet, international
workforce, rule of law, widespread English and first-world
lifestyle.”130 There is also long list of major Chinese technol-
ogy companies headquartered in Shenzhen: Huawei and ZTE
(telecommunications equipment, phones), Tencent (internet,
mobile apps), DJI (drones), OnePlus (mobile phones), to name
the most prominent.
With this background in mind, the question should be why
would China allow its new Cyber Security Law to tarnish a
seemingly organic success story in Shenzhen: a government-
initiated Special Economic Zone that has become the world’s
darling “Silicon Valley of Hardware” and the home of the In-
ternet of Things?
4. Part III: China’s Cyber Security Law
On 6 July 2015, the Standing Committee of the National Peo-
ple’s Congress released a first draft of the Cyber Security Law
of the People’s Republic of China (Draft) (《中华人民共和国网络安
全法（草案）》) (Draft)131 for public comment. When it was finally
adopted in November 2016, it became the first Chinese law that
127
Wired Magazine released the documentary: ‘Shenzhen: The
Silicon Valley of Hardware’ (Youtube, 5 July 2016).See: <https://
www.youtube.com/watch?v=SGJ5cZnoodY>.
128
Startup accelerators vary but are usually fixed-term, cohort-
based programs that include mentorship and culminate in a public
pitch event.
129
Falguni Desai, ‘Innovators Find Internet of Things Paradise in
Shenzhen’ (Forbes, 7 March 2016) <http://www.forbes.com/sites/
falgunidesai/2016/05/07/innovators-find-internet-of-things
-paradise-in-shenzhen/#5bf14931552d> accessed 1 March 2017.
130
ibid.
131
After first and second drafts were released for public consul-
tation in June 2015 and May 2016, respectively, it was a third draft
issued in October 2016 that was ultimately passed into law.
《中华人民共和国网络安全法（草案）》 [Cyber Security Law of the
People’s Republic of China (Draft)] (People’s Republic of China) Stand-
ing Committee of the National People’s Congress (NPCSC), 6 July
2015.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
focused exclusively on cyber security and China’s first attempt
to legislate a comprehensive cyber security regime.132 The draft
law signalled that the Chinese Government was tightening
control on domestic networks and data security in line with
its policy of Network Sovereignty. The draft law also caused
great concern among foreign companies fearing provisions re-
quiring the turnover of encryption keys to communications
equipment under certain circumstances.
The first draft granted authorities the power to cut internet
access in public security emergencies, and required data
localisation of servers in China as well as cyber security reviews
of company data. These moves dovetailed with other regula-
tions that required foreign technology companies with businesses
in China to store data on servers located inside the country.
Many observers, waited for an about-face and a watering
down of controversial provisions as had occurred with the Anti-
Terror Law. When in November 2016, the Standing Committee
of the National People’s Congress approved the Cyber Secu-
rity Law despite foreign opposition,133 hopes that the Chinese
government would respond positively to the concerns ex-
pressed on the draft Cyber Security Law were dashed. This
development was in stark contrast to China’s Anti-Terror Law.134
The Cyber Security Law took effect on 1 June 2017, so it is
important to analyse its key provisions and consider whether
the fears of its critics are justified.
4.1. Vague regulations make compliance difficult
The international business community has focused much of
its attention on how business obligations will change for Main-
land China operations and how the law will affect cross-
border handling of customer, operations, and other data. These
are all legitimate questions Chinese regulators need to elabo-
rate upon through detailed implementing rules.
• Firstly, only “network products and services” used in “criti-
cal information infrastructure” (still not fully defined) will
be subject to review. The law’s text offers no details on what
this will entail. According to The Interim Measures for Cyber
Security Review, the review will not be a compliance test,
but will focus more on the trustworthiness of the company
and its supply chain.135
• Secondly, “information infrastructure operators” must
store user data within the territory of mainland China.
132
Previously, regulations relating to cyber security in China were
scattered across many different laws, regulations and regulatory
documents. For example, Administrative Measures on Internet In-
formation Services (last amended in 2011), and Telecommunications
Regulations of the People’s Republic of China (last amended in 2016).
133
The Cyber Security Law of the People’s Republic of China was
adopted at the 24th session of the Standing Committee of the 12th
National People’s Congress on November 7, 2016. With seven chap-
ters and 79 articles, this Law will come into force on 1 June 2017.
134
China’s Anti-Terror Law had rules requiring companies in the
financial sector to prove the “security and controllability” of their
equipment through intrusive testing were suspended. Encryption
code handover requirements under national security and counter
terrorism laws were also rolled back.
135
《网络产品和服务安全审查办法 （试行）》 [Interim Security Review
Measures for Network Products and Services] (People’s Republic of
China) Cyberspace Administration of China, 2 May 2017.
 ARTICLE IN PRESS
computer law & security review ■■ (2017) ■■–■■
Problematically, data collection operators are obliged to store
data and personal information collected and produced by
their services in China.136 Companies may apply for excep-
tions to this rule, but only after undergoing an additional
audit and certification process unspecified by the new law.
• The law also requires internet company operators to co-
operate with investigations involving criminal conduct and
national security. Companies must give government inves-
tigators full access to their data if national security risks
are suspected.137 The new law states that the Chinese Gov-
ernment will take measures to monitor, defend and handle
cyber security risks and threats originating from within the
country or overseas sources, protecting key information in-
frastructure from “attacks, intrusion, disturbance and
damage”.138 The review process is unclear.
4.2. Vague rules: 1. Who do the laws apply to?
Of course, a preliminary question is who does the law apply
to? Depending on how a company is viewed under the Cyber
Security Law, the Law imposes security obligations. Further un-
certainty surrounds exactly who will be caught by the new rules.
Definitions of entity types are not clear. While the new law will
clearly apply to businesses and organisations, the extent to
which its terms will apply to individual employees and offi-
cers as well as web users is unclear. However, China is at the
vanguard of legislating cyber security laws, thus, some fluid-
ity of definitions should be expected if not encouraged in some
circumstances.
The following types of entities are considered by the law:
• “Suppliers of network products and services”139
• [Suppliers of] “critical network equipment and specialised cyber
(network) security products”140
136
《中华人民共和国网络安全法》 [Cyber Security Law of the Peo-
ple’s Republic of China] (People’s Republic of China) Standing
Committee of the National People’s Congress (NPCSC), 7 Novem-
ber 2016, Article 37.
137
See Articles 12, 28, 31, 35, 58 and 63 that refer to national se-
curity events and the corresponding requirements.
138
ibid. See Article 75.
139
“网络产品”, “服务的提供” (Articles 22, 64).Providers of “network
products and services” must comply with national and mandatory
standards. Their products and services must not contain malicious
programs; must take remedial action against security issues and
report them to users and relevant authorities. They must also provide
security maintenance for their products and services, which, cannot
be terminated within the contract term agreed with customers.
140
“网络关键设备 和网络安全专用产品” (Article 23).Critical network
equipment and specialised cyber security products must obtain gov-
ernment certification or meet prescribed safety inspection
requirements before being sold or provided. This potentially catches
a wide range of software, hardware and other technologies being
sold – or proposed to be sold – by international companies in the
China, since the definitions used in the law are drafted very broadly.
Further guidance by way of a catalogue of key network products is
expected in due course. Understandably there are concerns that this
may create barriers to international businesses looking to enter the
Chinese market.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
19
• “Network Operators”141
• “Critical infrastructure operators”142
• “Electronic information distributors”143
• “application software providers”144
• “electronic information distributor service providers”145
• “application software download service providers”146
It seems that the Cyber Security Law is trying to capture
technology firms including Smart City providers, who may
control “critical network equipment”. This law is necessary for
a country so focused on ambitious Smart City goals. “Network”
and “network operators” under article 76(1) and 76(3) are not
clearly defined. However, it seems that under the Law, an IoT
manufacturer may be considered to be a “network operator”
(as a “network service provider” (under Article 76) or perhaps
more likely a provider of “network products”).147 Furthermore,
IoT manufacturers or Smart City providers might be consid-
ered in control of “critical network equipment” or “specialised
network security products” (Articles 22–23). In turn, a firmware148
administrator could be considered to be a “network operator”
or “application software download service provider” (Article 48).
When read in light of China’s Smart City and Internet ofThings
drive it seems that these definitions are less abstract but remain
vague.Viewed in light of China’s connected Smart Cities, China’s
need to protect infrastructure is justifiable. However, what equip-
ment falls into the category of “key network equipment” and
“specialised network security products”is unclear. It is also unclear
according to what criteria or procedures “critical information
infrastructure facilities security assessments” will be conducted.
141
“网络运营者” (Articles 9, 21, 24–25, 28-29, 31, 40–43, 47, 49–50, 55-
56, 59, 61, 64, 68–69, 72, 76). A range of new obligations apply to
organisations that are “network operator” (ie network owners,
network administrators and network service providers). A “network”
means any system comprising computers or other information ter-
minals and related equipment for collection, storage, transmission,
exchange and processing of information. Some commentators argue
these broad definitions could catch any business that owns and
operates IT networks/infrastructure or even just websites in
China.Reports suggest vague terminology could be intended to catch
popular apps such as Taobao and WeChat, which have millions of
daily users in China who would be affected by a security breach.
This is not necessarily a sinister appraisal relating to censorship.
142
“关键信息基础设施的运营者” (Articles 34–39, 59, 65–66).
143
“电子信息发送者” (Articles 48, 68).
144
“应用软件提供者”.
145
“电子信息发送服务的提供者” (Articles 48, 68).
146
“应用软件下载服务提供者” (Articles 48, 68).
147
As regard network security, network operators must fulfill certain
tiered security obligations according to the requirements of the
classified protection system for cyber security, which includes: for-
mulating internal security management systems and operating
instructions; appointing dedicated cyber security personnel; taking
technological measures to prevent computer viruses and other
similar threats and attacks, and formulating plans to monitor and
respond to network security incidents; retaining network logs for
at least six months; undertaking prescribed data classification, back
up, encryption and similar activities; complying with national and
mandatory security standards; reporting incidents to users and the
authorities; and establishing complaints systems.
148
In simple terms, Firmware is software that is embedded in a
piece of hardware. In the context of Internet of Things compa-
nies it is important how firmware is classified under the Cyber
Security Law with regard to security protocols.
 ARTICLE IN PRESS
20 computer law & security review ■■ (2017) ■■–■■
4.3. Vague rules: 2. Data storage requirements
Article 37 has worried foreigner observers. The Article was
perhaps widened between the final draft and the passing of
the law. The word “citizen’s” was deleted, requiring all “per-
sonal information149 and important business data collected and
produced” in China to be stored in China:
Article 37: Citizens’ personal information and important busi-
ness data collected and produced by critical information
infrastructure operators during their activities within the terri-
tory of the People’s Republic of China, shall be stored within the
territory; where due to business requirements it is truly neces-
sary to provide it outside the mainland, a security assessment shall
be conducted according to the measures jointly formulated by the
national cyberspace administration and the relevant depart-
ments of the State Council. Where laws or administrative
regulations provide otherwise, those provisions apply.150
This changed phrasing now explicitly includes the data of
non-Chinese residents living, studying and working in China.
Understandably, Article 37 has created fears of potential intel-
lectual property theft in China. If, for example in a national
security event, China could demand encryption keys to servers
containing business data stored in China. Data storage com-
pliance costs and the scope of “security assessments” have also
proved worrying.
However, Article 37 also allows for data storage exceptions,
and future regulations might provide more clarity about who
is exempt from the requirement. Personal data and important
business data generated or collected in China by the opera-
tors of Critical Information Infrastructure Facilities must be stored
in China. However data transfers abroad are allowed if:
(i) there is a business need; and
(ii) security assessments are passed according to the rules
issued by the Cyberspace Administration of China (CAC)151
or other relevant governmental agencies.
Again, a loop-hole exists. Exemptions will likely operate.
Thus, if a company can prove that it is “truly necessary” to
store such information abroad, they must work with the State
Council to formulate specific monitoring procedures. Yet, the
law does not specify what is meant by other “important
business data” in Article 37. That ambiguity may mean keeping
more data inside China, costing overseas companies more
money, and heightening fears of proprietary big data theft.
149
“Personal information” is defined as including all kinds of in-
formation, recorded electronically or through other means, that can
identify a person’s identity, including, full names, birth dates, iden-
tification numbers, personal biometric information, addresses,
telephone numbers.
150
《中华人民共和国网络安全法》 [Cyber Security Law of the Peo-
ple’s Republic of China] (People’s Republic of China) Standing
Committee of the National People’s Congress (NPCSC), 7 Novem-
ber 2016, Article 37.
151
The Cyberspace Administration of China (CAC) (国家互联网信息
办公室), is the central internet oversight, and control agency for the
People’s Republic of China. CAC was founded in 2014 and is dis-
cussed in depth below.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
Article 34 is equally broad, requiring firms that operate “criti-
cal information infrastructure” comply with all other obligations
created by law or administrative regulation in performing se-
curity protection obligations.
Article 34: In addition to the provisions of article 21152 of this Law,
critical information infrastructure operators shall also perform the
following security protection obligations:
(1) Set up specialised security management bodies and persons
responsible for security management, and conduct security back-
ground checks on those responsible persons and personnel in critical
positions;
(2) Periodically conduct network security education, technical train-
ing and skills evaluations for employees;
(3) Conduct disaster recovery backups of important systems and
databases;
(4) Formulate emergency response plans for network security in-
cidents, and periodically organise drills;
(5) Other obligations provided by law or administrative
regulations.153
However, it is likely that Article 34 will become important
to offsetting foreign fears, as companies will negotiate mutu-
ally agreed upon outcomes with the Chinese Government.These
agreements may be as part of joint venture or licensing agree-
ments, or like Microsoft, companies could open a “transparency
centre” where Chinese Government coders could test and analyse
Microsoft’s products for security.154 Perhaps a regulatory prec-
edent will be set by Microsoft’s new centre. Indeed Article 34
may just be a codification of existing practices.
The head of Cyber Security Strategy for the Asia-Pacific at
Siemens AG argued China’s new reflected common practices
and existing informal pressures:
Beyond the new and pending laws and regulations, foreign firms
already face pressure to submit source code, undergo security
audits, and localize data and equipment. These procedures are costly
and expose foreign tech companies to a host of security, regula-
tory, and IP risks in order to be in the market.
Foreign tech firms have been providing at least partial source
code to the Chinese government for years. For example, Microsoft
provided Windows source code to the Chinese government in the
1990s. And it remains the common practice today. Providing source
code is not necessarily the same as providing so-called “backdoor”
152
Discussed below. It pertains to security inspections.
153
《中华人民共和国网络安全法》 [Cyber Security Law of the Peo-
ple’s Republic of China] (People’s Republic of China) Standing
Committee of the National People’s Congress (NPCSC), 7 Novem-
ber 2016, Article 34.
154
Tekendra Parmar, ‘China: Tech Giants Push Back Against Bei-
jing’s New Cyber Security Bill’, (Fortune, 2 December 2016), <http://
fortune.com/2016/12/02/cyber-security-bill-source-code/> accessed
12 December 2016.
 ARTICLE IN PRESS
computer law & security review ■■ (2017) ■■–■■
access to device contents, but it does have significant security im-
plications. And understanding the ongoing provision of such
information is necessary to meaningfully evaluate the conse-
quences of other requirements.
Similarly, security audits are also a regular part of operating in
the China market. In practice, a security audit could range from
something as benign as sitting down for a series of meetings with
government officials – perhaps from the Ministry of Public Secu-
rity – and answering questions about security features, data
storage, or management techniques to something far more inva-
sive. And as a consequence of the pending laws and regulations,
these security reviews are likely to become increasingly intensive.155
One important question is: If you provide a service for a State-
Owned Enterprise – are you then a critical infrastructure
provider? It probably depends on the kind of information in ques-
tion as well as how “other important data” is defined.156
4.4. Vague rules: 3. Unclear product review requirements
Article 65 states that “critical information infrastructure pro-
viders” stand to violate the law if they use products or services
that “have not had safety inspections or did not pass safety in-
spections.” Article 31 provides a seemingly partial definition of
“critical infrastructure operators” who are subject to a cyber se-
curity review:
The State implements focus protection for critical information in-
frastructure in important sectors and areas such as public
telecommunications and information services, energy, transpor-
tation, irrigation, finance, public services, e-government, etc., as
well as other critical information infrastructure that, whenever
it is destroyed, loses its ability to function or encounters data leaks,
may gravely harm national security, the national economy, the peo-
ple’s livelihood and the public interest, on the basis of the tiered
cyber security protection structure. The concrete scope of critical
information infrastructure and security protection rules are for-
mulated by the State Council.157
However, the nature and procedure for these safety inspec-
tions remain unspecified.
155
Samm Sacks, ‘Apple in China, Part I: What Does Beijing Actu-
ally Ask of Technology Companies?’ (Lawfare, 22 February 2016)
<https://www.lawfareblog.com/apple-china-part-i-what-does
-beijing-actually-ask-technology-companies> accessed 1 March
2017.In January 2015, Apple became the first foreign technology
company to publicly announce it would comply with increasing
China’s increasing security review procedures: Yin Cao, ‘Rule to
protect security “on the way this year”’, (China Daily, 22 January
2015) <http://www.chinadaily.com.cn/china/2015-01/22/content
_19373572.htm> accessed 1 July 2016.
156
Indeed, “critical information infrastructure operators” must
comply with Articles 34–39, 59, and 65–66, which are all provisions
strongly geared towards cyber security incident prevention and di-
saster recovery and technical support. This further suggests this
new law is strongly focused on China’s Smart City and Internet
of Things ambitions. Yet compliance requirements are still vague.
157
《中华人民共和国网络安全法》 [Cyber Security Law of the People’s
Republic of China] (People’s Republic of China) Standing Committee
of the National People’s Congress (NPCSC), 7 November 2016, Article 31.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
21
Article 21 also states that “specialised network security prod-
ucts” must meet a set of standards released in a “catalogue” by
the State Council, the administrative body chaired by Premier
Li Keqiang.The standards in this catalogue have yet to be revealed.
The government will also formulate and promulgate the cata-
logue of key network equipment. Products and services providers
shall comply with the compulsory requirements of relevant na-
tional standards. It is provided in the Cyber Security Law that
“key network equipment” and “specialised network security prod-
ucts” must be either certified or tested by a licensed security
certification institution in order to ensure compliance with rel-
evant national and industry standards and are not allowed to
be released into the China market unless they have passed the
certification or testing process.
Chinese regulations often lack clarity, ultimately leaving both
Chinese and foreign companies without a proper roadmap for
how to abide by the law. It is the kind of business environ-
ment the Party-State prefers, due to its flexibility and room for
official discretion and control. Those who seek to conduct busi-
ness must do so by China’s currently unclear but also flexible
rules. Further regulations will likely clarify some of these issues,
responding to business concerns.
Vague regulations do make compliance difficult. The ques-
tion remains, however, do these vague regulations shut foreign
ICT service providers out of the market? The answer to this
question is unclear. It is important to remember Chinese in-
dustry faces the same obstacles from the Chinese regulatory
environment. New security regulations will also bring added
compliance costs to Chinese start ups and small-to-medium
sized companies, perhaps inhibiting Chinese innovation. Nev-
ertheless, a common perception among foreign commentators
is that China’s Cyber Security Law simply benefits Chinese in-
cumbents, such as Alibaba’s cloud computing arm, AliYun.158
4.5. The centralisation of China’s internet regulatory
authorities: Network Sovereignty’s silver lining for
technology companies?
If it is true that some of the criticism of China’s legal system
emanates from its perceived legislative vagueness, it is also true
that China is addressing some of these concerns. While China’s
Network Sovereignty push poses challenges for global inter-
net governance, it also may conceal “something of a silver lining
for global technology firms wishing to operate in China”.159 This
is also helpful for groups seeking to influence the cyber secu-
rity compliance debate.
Under the Cyber Security Law, there is no confusion as to
which bureaucracy is in charge. The Law, streamlines the regu-
latory structure:
158
See for example: ‘China’s Cybersecurity Law Enacted’
(ChinaTechNews, 7 November 2016) <https://www.chinatechnews
.com/2016/11/07/24439-chinas-cybersecurity-law-enacted> ac-
cessed 10 November 2016.
159
Scott Livingston, ‘Beijing Touts “Cyber-Sovereignty” In Inter-
net Governance: Global Technology Firms Could Mine Silver Lining’,
(China Law Blog, 19 February 2015) <http://www.chinalawblog.com/
2015/02/beijing-touts-cyber-sovereignty-in-internet-governance
-global-technology-firms-could-mine-silver-lining.html> ac-
cessed 25 February 2015.
 ARTICLE IN PRESS
22 computer law & security review ■■ (2017) ■■–■■
Article 23: Critical network equipment and specialised cyber se-
curity products shall follow the compulsory requirements of relevant
national standards, and be safety certified by a qualified estab-
lishment or meet the requirements of a security inspection, before
being sold or provided. The National Cyberspace Administration
together with the relevant departments of the State Council, for-
mulate and release a catalogue of critical network equipment and
specialized cyber security products, and promote reciprocal rec-
ognition of safety certifications and security inspection results to
avoid duplicative certifications and inspections.160
This leaves China’s Cyberspace Administration (explained
above) in charge of cyber security matters. Articles 50–53 state
that the National Cyberspace Administration is the highest
authority.161 Article 51 clearly states that the National Cyber-
space Administration is in charge of coordinating the relevant
departments in matters involving cyber security.162 Article 39
states that the State network information departments shall
comprehensively coordinate relevant departments for various
tasks such as inspections and technical support.163
160
《中华人民共和国网络安全法》 [Cyber Security Law of the Peo-
ple’s Republic of China] (People’s Republic of China) Standing
Committee of the National People’s Congress (NPCSC), 7 Novem-
ber 2016, Article 23.
161
“Article 50: The National Cyberspace Administration and relevant
departments perform cyber security supervision and administra-
tion responsibilities; and where discovering information the release
or transmission of which is prohibited by laws of administrative regu-
lations, shall request the network operators stop transmission, employ
disposition measures such as deletion, and store relevant records;
for information described above that comes from outside mainland
People’s Republic of China, they shall notify the relevant organisation
to adopt technological measures and other necessary measures to
block the transmission of information.” 《中华人民共和国网络安全法》
[Cyber Security Law of the People’s Republic of China] (People’s Re-
public of China) Standing Committee of the National People’s Congress
(NPCSC), 7 November 2016, Article 50.
162
“Article 51: The State establishes cyber security monitoring and
early warning and information bulletin systems. The National Cy-
berspace Administration shall do overall coordination of relevant
departments to strengthen collection, analysis and reporting efforts
for cyber security information, and perform unified release of cyber
security monitoring and early warning information in accordance
with regulations.” 《中华人民共和国网络安全法》 [Cyber Security Law
of the People’s Republic of China] (People’s Republic of China) Stand-
ing Committee of the National People’s Congress (NPCSC), 7
November 2016, Article 51.
163
“Article 39: The State Internet Information department shall com-
prehensively coordinate relevant departments. The following
measures may be adopted in order to protect the security of critical
information infrastructure: With respect to random inspection testing
of security risks to information infrastructure, [they may] propose
measures for improvement, and when necessary to do so may
appoint specialist inspection and detection institutions to under-
take testing and evaluation for security risks; Periodically organise
critical information infrastructure operators to conduct emer-
gency cyber security drills, increasing the level and coordination of
responses critical to information infrastructure responses to cyber
security incidents. Promote cyber security information sharing among
relevant departments, the operators of critical information infra-
structure, cyber security services institutions and relevant research
institutions. Provide technical support and assistance for cyber se-
curity emergency management and recovery and so forth.”
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
5. Part IV: are fears of the new law justified?
There is an understandable fear among foreign and Chinese
companies, and any company that relies on foreign software
systems to run its business in China. The requirements to store
data locally as well as only employing technology deemed
“secure” might amount to Chinese firms gaining another edge
over foreign rivals. Storage requirements, however, remain
unclear. It is true that: “[t]he law also requires business info
and data on Chinese citizens gathered within the country to
be kept on domestic servers and not be transferred abroad
without permission. That last condition hampers the opera-
tions of multinationals accustomed to a global Internet
computing environment”.164 Yet this may also harm China’s in-
novation plans:
For example, requirements for data localisation may prevent en-
gineers that are employed by the same Chinese firm, but located
separately in Europe and China, from effectively communicating
on how to rapidly address a problem. This would provide a par-
ticular challenge given that they would be competing in
international markets with companies that do not face this
limitation.165
There are also obvious implications for Smart Cities, often
built in China with foreign technology partners such as IBM and
Cisco. As their R&D and major operating bases are outside of
China – foreign technology partners will likely need to send data
outside of China. Foreign technology partners may also not agree
to transfer data used in building applications for privacy reasons.
In the Chinese Party-State, where the government uses the
media as a tool for public policy statements, there is often a
discord between Chinese-language news sources and English-
language news sources. Chinese-language news is for domestic
consumption. English-language news is how the government
wants the international community to digest vague laws. It
means little to Chinese citizens.
In English, Xinhua news agency highlighted provisions of
the Cyber Security Law that state that “efforts will also be made
to punish criminal activities online and safeguard the order
and security of cyberspace. Individual users and organiza-
tions are not allowed to jeopardize security on the Internet or
use it to “damage national security, honor and interests””.166
That language is certainly reminiscent of Chinese internet cen-
sorship and the increasing growth of Network Sovereignty-
inspired legislation. Xinhua further noted that: “[o]nline
activities that attempt to overthrow the socialist system, split
the nation, undermine national unity, advocate terrorism and
164
‘China Adopts Cybersecurity Law Despite Foreign Opposition’,
(Bloomberg, 7 November 2016) <https://www.bloomberg.com/news/
articles/2016-11-07/china-passes-cybersecurity-law-despite
-strong-foreign-opposition> accessed 7 November 2016.
165
European Chamber of Commerce in China, ‘China Manufacturing
2025: Putting Industrial Policy Ahead of Market Forces’, March 2017, p26.
166
‘Xinhua Insight: China adopts cybersecurity law to protect na-
tional security, citizens’ rights’, (Xinhua, 7 November 2016) <http://
news.xinhuanet.com/english/2016-11/07/c_135812209.htm> accessed
7 November 2016.
 ARTICLE IN PRESS
computer law & security review ■■ (2017) ■■–■■
extremism are all prohibited, according to the provisions, which
also forbid activities including inciting ethnic hatred, discrimi-
nation and spreading violence and obscene information.”167
Again this seems to reflect the increasing promulgation of
Network Sovereignty-inspired legislation. However, there is
another explanation. The final version, when compared with
previous drafts of the Cyber Security Law reinforces the pro-
visions targeting cyber fraud and cyber crime by imposing
criminal, administrative and legal penalties against individu-
als and entities that commit cyber fraud and cyber crime. The
law is clearly targeting criminal behaviour in this regard.
Nevertheless, increasing use of this language has worried
foreign observers. Critics of the law say it threatens to shut
foreign technology companies out of various sectors deemed
“critical”, and includes contentious requirements for security
reviews and for data to be stored on servers in China. In a state-
ment, James Zimmerman, chairman of the American Chamber
of Commerce in China, argued the law has more to do with
protectionism than cyber security: “[i]n terms of improving se-
curity, this law is at best a missed opportunity, and some of
the measures seem to emphasize protectionism rather than
security.” He was adamant that:
one thing is for sure: the more difficult it is for data to travel across
the Chinese border, the more difficult it will be for companies inside
those borders to innovate, and China risks becoming isolated tech-
nologically from the rest of the world.168
Conversely, Chinese companies may try to evade govern-
ment pressure to buy from local technology suppliers deemed
more “secure”. Securing network infrastructure is a responsi-
bility that must be addressed regardless of the nationality of
the ICT product vendor. This is the question being asked of
Network Sovereignty. Will it slow China’s innovation drive?
5.1. Objectively assessing China’s Cyber Security Law:
censorship and cyber security are not the same thing
If we separate aspects of this law concerning censorship and
Network Sovereignty, perhaps the law’s cyber security aims could
be more objectively assessed? Of course, it is a difficult task to
decipher the Chinese Government’s intent. As with many pieces
of legislation anywhere in the world there are multiple purposes.
As China’s economic development progresses, innovation has
become a central concern of Chinese policymakers. Law has been
the most central tool by which this innovation is stimulated.
Consequently, a range of legislative and regulatory measures,
aimed at enhancing China’s capability for developing and
commercialising new technologies, are now in place. Neverthe-
less, the pursuit of innovation sometimes conflicts with other
interests of the Party-State, in particular, the maintenance of
information control, manifested through a complex web of regu-
lation around technology and content.
167
ibid.
168
Josh Horwitz, ‘China’s bewildering new cybersecurity law is
keeping foreign tech firms out of the country’ (Quartz, 7 November
2016).<http://qz.com/829248/chinas-new-cybersecurity-law-is
-so-vague-that-its-keeping-foreign-tech-firms-out-of-the-country/>
accessed 7 November 2016.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
23
Therefore an objective assessment of the Cyber Security Law
requires an objective assessment of its goals. One must evalu-
ate the regulatory framework by: firstly, studying whether the
Chinese policy measures are effective in achieving their pro-
posed aims; and secondly, by assessing the logic behind the
policies, which may suggest that China’s innovation policies
induce certain outcomes, but equally impede others.
Indeed, there is a perception that the pursuit of innovation
sometimes conflicts with other interests of the Chinese Party-
State, in particular the maintenance of information control.There
is also an ongoing question as to whether this conflict assists
China’s entrepreneurial ecosystem by blocking foreign tech-
nology firms such as Google and Facebook; as well as China’s
policy of “indigenous innovations” which meant government
procurement of local products in a protectionist manner.169
Objectively, where does intellectual property theft fit into
this picture? How does it relate to encryption and enforced
backdoors? Colouring in the lines prejudicially towards China,
China clearly has nefarious plans with this requirement.170 Many
will recall and continue to point to 171 China’s policies of
169
In 2006 China released the “Medium- to Long-Term Plan for the
Development of Science and Technology” (MLP). The Chinese Gov-
ernment declared its intention to transform China into “an
innovative society” by 2020 and a world leader in science and tech-
nology by 2050. The aim of the MLP was to reduce China’s reliance
on imported technology to no more than 30% within a few years,
to increase domestic R&D funding, and to leapfrog foreign rivals
in what the government identified as “strategic emerging sectors”.
They included: biotechnology, energy-efficient technologies, equip-
ment manufacturing, information technology, and advanced
materials. Under the MLP, the Chinese Government introduced
export subsidies for Chinese firms. The MLP also introduced a policy
for the promotion of “indigenous innovations”, requiring govern-
ment ministries and state-owned businesses to procure goods, when
feasible, from Chinese-owned companies. Various laws and regu-
lations were associated with China’s MLP. It was considered a form
of protectionism by foreign critics.According to the MLP, foreign com-
panies wanting to compete for government contracts and subsidies
promoted under indigenous innovation policies, had to transfer their
proprietary technology and IP to their Chinese partners. Despite
objections that those policies violate the terms of China’s mem-
bership in the World Trade Organisation, few international firms
have left, instead resigning themselves to supporting innovation
within China.
170
China’s Cyber Security Law arguably echoes other existing re-
quirements that companies install “back doors” so that security
agencies can access encrypted communications. Many have argued
that doing so undermines rather than enhances cyber security. Tech-
nology companies and internet operators may need to cooperate
with criminal and national security investigations, and hand over
source code and other sensitive or proprietary data when the au-
thorities deem it necessary. However we still need to wait until 1
June 2017 to see how this will take place.See: S. James Boumil III,
‘China’s Indigenous Innovation Policies Under the TRIPS and GPA
Agreements and Alternatives for Promoting Economic Growth’ (2012)
12(2) Chicago Journal of International Law 754.
171
The State Council’s original outline of its new “China Manu-
facturing 2025” policy included market share targets to “realise
guarantees of self-sufficiency” (实现自主保障) for sourcing 40 and
70 per cent of both core components and key basic materials by
2020 and 2025 respectively: Notification on the Printing and Dis-
tribution of Made in China 2025, The State Council, 8th May, 2015,
<http://www.gov.cn/zhengce/content/2015-05/19/content_9784
.htm> accessed 12 March 2017.
 ARTICLE IN PRESS
24 computer law & security review ■■ (2017) ■■–■■
“indigenous innovations” and question whether or not China’s
Cyber Security Law is more of the same.172 However, China has
731 million internet users according to government statistics
in January 2017. 695 million users use mobile devices and many
rarely use cash and rely on China’s online, e-commerce, payment
and logistics ecosystem. The number of “mobile wallet” users
is up to 469 million, up 31.2 percent in the past year, and WeChat
remains the most popular app, used by 80 percent of all in-
ternet users.173 China clearly needs a cyber security plan to
protect them.
Nevertheless, the text of the new law allows for much as-
sumption. According to the Cyber Security Law, critical
information infrastructure facilities are broadly defined to cover
a wide range of sectors including energy, transportation, elec-
tricity, water, gas, financial institutions, medical/healthcare, and
social security. “Critical information infrastructure network op-
erators” is a clear ambiguity in the Cyber Security Law. The
security review measures merely add that national security
checks triggering cyber security reviews of critical informa-
tion infrastructure network operators shall be determined by
critical information infrastructure protection departments,174
adding another layer of bureaucratic uncertainty to a conten-
tious provision. Resembling China’s policy of “indigenous
innovations”, government procurement decisions will be shaped
by the new cyber security review. This type of provision is what
leads to charges of “indigenous innovation”-style protection-
ism being leveled against China.175
Conversely, China has consistently focused on its need to
have a cyber security regime for genuine cyber threats, in ad-
dition to legislative and rhetorical references to Network
Sovereignty. This is due to China’s rapid technology adoption
rates and the need to educate new users of cyber risks. The
question then becomes does China care more about interna-
tional business and technological progress than censorship?
172
The China Manufacturing 2025 Roadmap also includes numer-
ous mentions of ‘indigenous innovation’ (自主创新) and ‘self-
sufficiency’ (自主保障, 自给, 自给率). As with the 2010 Medium- and
Long-term Plan for the Development of Science and Technology,
2006–2020 (MLP) and the strategic emerging industries (SEIs).
《国务院关于加快培育和发展战略性新兴产业的决定》 [Decision on Ac-
celerate and Develop Strategic Emerging Industries] (People’s
Republic of China), State Council, 18th October, 2010, See: <http://
www.gov.cn/zwgk/2010-10/18/content_1724848.htm>; Strategic
Emerging Industries Likely to Contribute 8% of GDP by 2015, (People’s
Daily, 19th October, 2010). <http://en.people.cn/90001/90778/90862/
7170816.html> accessed 12 March 2017.
173
This is according to Chinese Government statistics released in
January 2017. See: Steven Millward, ‘China now has 731 million in-
ternet users, 95% access from their phones’, (TechinAsia, 23 January
2017). <https://www.techinasia.com/china-731-million-internet
-users-end-2016> accessed 23 January 2017.
174
“Article 11: Products and services purchased by Critical Infor-
mation Infrastructure Network Operators that may affect national
security shall be subject to the cyber security review.Whether or
not network products and services purchased by the critical in-
formation infrastructure operators affect national security shall be
determined by critical information infrastructure protection de-
partments.”
175
“Article 10: Party and government departments and key indus-
tries shall prioritise the procurement of network products and
services that have passed the review, and shall not procure network
products and services that have failed the review.”
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
Furthermore, can a cyber security regime succeed without
increasing collaboration between the public and private sectors
on data protection issues? Openness of public data has much
to do with cyber security and cyber security protocols.
In order to pursue policies of “smarter” Smart Cities, China
needs to develop its cyber security framework. The Cyber Se-
curity Law focuses on ensuring the stability of China’s computer
networks, which face threats from viruses, other menaces as
well as hackers trying to access government and private net-
works and data. Accordingly, China needs strong policies, laws,
and consultative processes to ensure the security of networks.
China also needs a cyber security law to aid big data goals:
Since the concept of data openness has been driven by the central
government and there has been a drive towards openness and
sharing, some departments have accepted the concept and started
to consider openness. However, the fear of potential data theft,
replication and general security issues makes complete data open-
ness difficult to achieve in the short term.176
Perhaps this Cyber Security Law with its vagaries does not
yet achieve that goal. Chinese leaders have complex policy de-
cisions to make. China’s legislative campaign to safeguard its
infrastructure echoes post-Snowden revelation efforts in Europe,
the US and elsewhere. Even with Network Sovereignty in the
background China is part of the global vanguard legislating in
these areas. Many countries are just starting to consider these
issues. These are complex areas to legislate around. There are
currently no international guidelines for best practice in cre-
ating a cyber security regime.177 There is equivalent law in the
US in terms of cyber security planning.
Secondly, perhaps an objective approach requires us to sepa-
rate internet content control and censorship laws and regulations
from genuine cyber security goals. China’s internet content regu-
lators determine whether content is consistent with social values.
Regulators focus on preventing dissemination of information that
the government considers illegal. Unlike information network or
cyber security, which mainly deals with data and network pro-
tection, internet content regulation involves placing regulations
on what Chinese people can read, see, and hear on the internet.
The Cyber Security Law requires instant messaging services
and other internet companies to require users to register with
their real names and personal information, and to censor content
that is “prohibited.”178 Real name policies restrict anonymity
176
‘Sector Report: Smart Cities in China’ (2016) EU SME Centre,
<http://www.cbbc.org/cbbc/media/cbbc_media/KnowledgeLibrary/
Reports/EU-SME-Centre-Report-Smart-Cities-in-China-Jan
-2016.pdf> accessed January 2017, p26.
177
There are clear differences of opinion regarding internet gov-
ernance. China’s vision of Network Sovereignty, the idea that the
internet, like territory, has borders which each nation is entitled
to monitor and defend, is an idea that is gaining steady appeal
around the globe, particularly among authoritarian regimes. Iran,
Russia, Turkey, Thailand, and Zimbabwe are looking to China as they
consider their own national version of the “Great Firewall”.
178
See Article 24. Network operators handling “network access and
domain registration services” for users, including mobile phone and
instant message service providers, are required to comply with “real
identity” rules when signing up or providing service confirmation
to users, or else may not provide the service.
 ARTICLE IN PRESS
computer law & security review ■■ (2017) ■■–■■
and can encourage self-censorship for online communica-
tion.This appears to have little to do with cyber security. Burglars
do not leave business cards. No hacker will send you his email
address while he attacks your network and systems. Real-
name registration as required by various Chinese laws and
regulations, is clearly aimed at discouraging criticism of the
Party.
5.2. Real name user registration
Common in many previous recent pieces of legislation is
the concept of real name user registration.179 In August 2014,
China promulgated the so-called “WeChat (微信) Articles”
–regulations designed to collect WeChat user data.180 The Instant
Messaging Regulations 《即时通信工具公众信息服务发展管理暂行
规定》—colloquially known as the “WeChat Articles” are im-
portant because they affect the reportedly nearly 700 million181
WeChat users. The State Internet Information Office (SIIO) de-
manded real name registration for WeChat accounts, with the
proviso that users would be permitted a public handle or nick-
name. Previous similar legislation aimed specifically at Sina
Weibo had a major negative commercial effect on Sina Weibo.182
The sheer size of companies such as Baidu, Alibaba and
Tencent means that effective control over a few companies
enables the State to regulate the majority of online activities.
Yet where the government previously largely out-sourced
the burdens of regulating individual behaviour to those
179
Notwithstanding these broad new grants of authority, many pro-
visions appear to codify longstanding government restrictions on
internet usage. Article 24, for example, mandates that companies
verify an individual’s real identity before providing internet ser-
vices. The China Cyberspace Administration has enforced similar
requirements on blogs, instant-messaging services, discussion
forums, and other internet outlets for over a year. Article 12 pro-
hibits persons or organisations from “subverting national
sovereignty” or “overthrowing the socialist system.” This parallels
Article 15 of the 2015 National Security Law. See: 《中华人民共和国
国家安全法》 [National Security Law of the People’s Republic of
China] (People’s Republic of China) Standing Committee of the Na-
tional People’s Congress (NPCSC), 7 January 2015.Article 58 of the
Cyber Security Law, gives the State Council and other govern-
ment entities the ability to temporarily restrict internet access as
required by “national security” or to preserve “social order.” The
Cyber Security Law does not retreat from past censorship powers.
180
On 7 August 2014, the State Internet Information Office (SIIO)
issued a new set of guidelines entitled: 《即时通信工具公众信息服务发
展管理暂行规定》 [Provisional Regulations for the Development and
Management of Instant Messaging Tools and Public Information
Services] (People’s Republic of China) State Internet Information
Office (SIIO), 7 August 2014.These regulations, the so-called “WeChat
Articles” require that instant messaging service providers who
engage in “public information service activities” obtain certain prior
qualifications. The SIIO issued the WeChat Articles. Many of China’s
internet regulations bear the SIIO stamp.
181
See: Steven Millward, ‘WeChat still unstoppable, grows to 697m
active users’, (TechinAsia, 17 March 2017).<https://www.techinasia
.com/wechat-697-million-monthly-active-users> accessed 23 March
2017. The figure was obtained from Tencent’s (WeChat’s parent
company) Quarter 4 2016 report. The link is no longer available.
182
See for example: Eric Harwit, ‘The rise and influence of Weibo
(microblogs) in China’, Asian Survey 54(6)(2014), pp. 1059–1087.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
25
enterprises,183 it has now drastically expanded the range and
scope of legal and regulatory measures directly affecting in-
ternet users.
One dominant element of this strategy is the gradual ex-
pansion of real name registration requirements in various areas
of telecommunications and internet use.184 A self-regulatory
Convention on mobile telephone apps passed in November 2014
committed developers and app stores to broaden the imple-
mentation of identity authentication systems.185 These efforts
seem to have some success: it was reported in January 2015
that more than 80 per cent of WeChat users had registered
under their real identities.186
Moreover, real name registration duties are not limited to
online content; they were also mandated for the purchase of
telephones, enabling the identification of online activities
through individual pieces of hardware.187 In February 2015, the
Cyberspace Administration of China mandated a real-name reg-
istration system for all account-based online information
services.188
The Cyber Security Law carte blanche seems to makes
smaller internet firms and new forms of media, including In-
ternet of Things and smart technologies subject to real name
user registration. The law in a petri dish approach was tested
on Weibo and WeChat with targeted regulations. Those firms
have survived and are both now flourishing. With 390 million
monthly users, Sina Weibo is seeing a huge unforeseen revival
183
In March 2017 there was a report that Taobao (an Alibaba
company) is banning merchants from selling foreign media in China
– even media approved by censors. The smaller players in this story
(the e-commerce booksellers) allegedly accept what Alibaba – not
the Chinese regulators dictate.See: Echo Huang, ‘Taobao is banning
merchants from selling foreign media in China – even media ap-
proved by censors’ (Quartz, 10 March 2017) <https://qz.com/929540/
selling-foreign-media-in-china-even-media-approved-by-censors
-is-being-banned-alibaba-baba-groups-online-shopping-platform
-taobao/> accessed 14 March 2017.
184
For example a Judicial Interpretation on online infringement
of personality rights, promulgated in October 2014, provides that
Courts may order internet companies to provide names, ad-
dresses and contact methods of users, where these are deemed
to have published defamatory information. Companies refusing to
carry out such requests would be liable for punitive measures.
《关于审理理应信息网络侵权人身权益民事纠纷按键使用法律若干问题的
规定》 [Regulations concerning Some Questions of Applicable Law
in Handing Civil Dispute Cases involving the Use of Information
Networks to Harm Personal Rights and Interests] (People’s Repub-
lic of China) Supreme People’s Court, 9 October 2014.
185
《北京市移动互联网应用程序公众信息服务自律公约》 [Beijing Mu-
nicipality Self-Discipline Convention on Internet Application
Programmes and Public Information Services], Capital Internet
Society, 26 November 2011.
186
Liu Sha, ‘Govt Takes Down Illegal Websites’, (Global Times, 14
January 2015) <http://www.globaltimes.cn/content/901784.shtml>
accessed 20 January 2016.
187
《电话用户真实身份信息登记规定》 [Telephone User Real Iden-
tity Information Registration Regulations], (People’s Republic of
China) Ministry of Industry and Information Technology (MIIT), 16
July 2013.
188
《互联网用户账号名称管理规定》 [Internet User Account Name
Management Regulations], (People’s Republic of China) Cyber-
space Administration of China, (CAC), 4 February 2015.
 ARTICLE IN PRESS
26 computer law & security review ■■ (2017) ■■–■■
in late 2016.189 What was once called ‘China’s Twitter’ has now
become a comprehensive platform that incorporates the major
features of social media channels like Twitter, YouTube, and
Instagram.190 Network Sovereignty, typified by real name usage,
has now been expanded throughout the Chinese internet in-
dustries, by Article 24 of the new Cyber Security Law:
Article 24: Network operators handling network access and domain
registration services for users, handling stationary or mobile phone
network access, or providing users with information publication
services, shall require users to provide real identity information
when signing agreements with users or confirming provision of
services. Where users do not provide real identify information,
network operators must not provide them with relevant services.
The State implements an online trustworthy identity strategy, sup-
ports research and development of secure and convenient electronic
identity confirmation technologies, and promotes mutual recog-
nition among different electronic identity confirmation
technologies.191
Article 30 makes it clear that, information obtained “when
carrying out cyber security protection duties, may only be used
for cyber security needs, and may not be used for other
purposes.”192 Sceptics may wonder whether the Chinese Gov-
ernment will really restrict its use of information in this way.
Some more colouring in the lines is required at this stage. Nev-
ertheless China continues to utilise data collection as a means
to maintain social order.193
5.3. Individual protections: protection of personal data
On the other hand, the Cyber Security Law provides in-
creased individual protections. Many will welcome the
introduction of requirements that are widely championed by
data protection authorities and bodies across North America
189
See: Steven Millward, ‘7 years of ‘China’s Twitter’, (TechinAsia,
14 August 2016). <https://www.techinasia.com/7-years-of-weibo
-china-social-media> accessed 10 January 2017.
190
Manya Koetse, ‘Weibo’s Revival: Sina Weibo Is China’s Twitter,
YouTube & InstaGram’ (What’s on Weibo, 20 November 2016) <http://
www.whatsonweibo.com/weibos-revival-sina-weibo-chinas
-twitteryoutubeinstagram/> accessed 22 November 2016.
191
《中华人民共和国网络安全法》 [Cyber Security Law of the Peo-
ple’s Republic of China] (People’s Republic of China) Standing
Committee of the National People’s Congress (NPCSC), 7 Novem-
ber 2016, Article 24.
192
《中华人民共和国网络安全法》 [Cyber Security Law of the Peo-
ple’s Republic of China] (People’s Republic of China) Standing
Committee of the National People’s Congress (NPCSC), 7 Novem-
ber 2016, Article 30.
193
In 2014, China released an outline of its new social credit system,
which rates citizens and firms on financial, legal, and civic terms.
Western media have focused on highly opaque and inaccessible
guidelines on the individuals and firms being rated. The most high
profile social credit system is Alibaba’s Sesame Credit. Sesame Credit
is a social credit scoring system being developed by Ant Financial
Services Group, an affiliate of the Chinese Alibaba Group. It uses
data from Alibaba’s services to compile its score. This is an area
that must be further observed especially as the lines between the
public and private sectors become more blurred.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
and Europe.194 The Cyber Security Law is the first national law
level legislation establishing the legal principles for protection
of personal data. In the past, data privacy was regulated by ad-
ministrative rules, judicial interpretations, government policies
and non-binding industry guidelines.195 Articles 41, 42 and 43
restrict the amount of personally identifiable information that
can be collected. These articles also limit how data can be trans-
ferred, and provide an individual the right to request that
information be deleted if mishandled.196 The Cyber Security Law
provides that network operators must safeguard the secrecy
of personal data collected. The collection and use of personal
data must follow the principles of legality, propriety and ne-
cessity and data collectors must follow the legal requirements
in terms of giving the notice and obtaining the consent.197
Further, in relation to public policy and privacy concerns, in
Article 22 of the Cyber Security Law, the general public must
be notified of any security flaws regarding their personal data.198
194
In Europe for example, organisations such as the European Data
Protection Supervisor (EDPS) operate as an independent supervi-
sory authority whose primary objective is to ensure that European
institutions and bodies respect the right to privacy and data pro-
tection when they process personal data and develop new policies.
195
See: Rogier Creemers, ‘Cyber China: Updating Propaganda, Public
Opinion Work and Social Management for the 21st Century’, Journal
of Contemporary China, (2015).
196
In case of a data breach incident, the data collectors shall report
to the authority and affected users should also be contacted. Com-
panies and individuals who are directly in charge can be fined up
to RMB 100,000 for failure to comply.
197
“Network operators” must:• make publicly available data privacy
notices. These notices must explicitly state purposes, means and
scope of personal information to be collected and used;• obtain
individuals’ consent when collecting, using and disclosing their per-
sonal information;• adopt technical measures to ensure the security
of personal information against loss, destruction or leaks;• if a data
security breach occurs must take immediate remedial action and
promptly notify users and the relevant authorities;• comply with
principles of legality, propriety and necessity in their data han-
dling, and not be excessive; not provide an individual’s personal
information to others without the individual’s consent; nor ille-
gally sell an individual’s personal data to others;• keep user
information confidential and to establish and maintain data pro-
tection systems;• rules do not apply to truly anonymous data.As
discussed above, while an earlier draft specifically provided pro-
tection to personal information of “citizens”, the final law does not
make this distinction. Seemingly offering a broader protection to
all personal information belonging to residents of China.
198
“Article 22: Network products and services shall comply with the
relevant national and industry standards. Providers of network prod-
ucts and services must not install malicious programs; when it is
discovered that their network products or services have risks such
as security flaws or leaks, they shall promptly notify users and adopt
remedial measures, and promptly notify users and report the
matter to the relevant controlling department according to
regulations.Providers of network products and services shall con-
tinuously provide security maintenance for their products and
services; and must not terminate providing security mainte-
nance during the set time period or period agreed on with
clients.Where network products and services have functions to
collect user information, their provider shall indicate this to users
and obtain agreement; where citizens’ personal information is in-
volved, this shall abide by the provisions of this Law, as well as
relevant laws and administrative regulations, concerning the pro-
tection of citizens’ personal information.”
 ARTICLE IN PRESS
computer law & security review ■■ (2017) ■■–■■
If we emphasise this legislative development, perhaps the
Cyber Security Law could be more objectively assessed? Data
theft is a live issue in China. In February 2017, Chinese State
media released a report suggesting that vendors have been
selling confidential information such as people’s national ID
numbers, home addresses, the value of their assets including
property, and even mobile phone call logs.199 Chinese Netizens
were outraged. A unit overseeing information security at
Tencent, which owns instant-messaging service, QQ, re-
leased a statement on reporting that since August 2016, QQ has
blocked over 3500 group accounts where personal informa-
tion was sold in bulk, including 30 such accounts in the previous
four days alone. This indicates a major need for the privacy
and criminal penalty articles in the Cyber Security Law.
5.4. Objective assessments: cyber security international
protocols and realities
The Chinese government, like the US government is within its
sovereign rights in wanting to ensure the security of digital
systems and data. A denial of service attack on the mainframe
of connected power station, for example, could have very serious
consequences for “critical infrastructure”.The question is: does
China’s Cyber Security Law achieve that aim? Or does it create
barriers to trade and innovation for both Chinese and foreign
innovators?
The short answer to this question is simple. Wait and
see. The Chinese government will issue future regulations to
clarify the law’s scope and intent. Only then can we objectively
assess the outcome. However other key Chinese information
security institutions, such as the China National Information
Security Standards Technical Committee (TC260) have been
open to international cooperation. 200
5.5. China National Information Security Standards
Technical Committee (Technical Committee 260 or TC260)
One cannot be sensationalist about Chinese legislative efforts.
In August 2016, it was reported that a Chinese government com-
mittee, Technical Committee 260 (TC260), was at work defining
cyber security standards. TC260 allowed Microsoft, Intel, Cisco
and IBM to take part in drafting Chinese cyber security rules
rather than participating as observers only.
TC260 is a cyber security advisory committee tasked with
defining China’s standards constituting “secure and control-
lable” technologies.201 TC260 is involved in discussions of
199
Liu Xiaojing and Li Rongde, ‘QQ Blocks Thousands of Ac-
counts for Selling Private Information’ (Caixin Global, 21 February
2017) <http://www.caixinglobal.com/2017-02-21/101057642.html> ac-
cessed 21 February 2017.
200
Eva Dou and Rachel King, ‘China Sets New Tone in Drafting
Cybersecurity Rules’ (Wall Street Journal, 26 August 2016) <http://
www.wsj.com/articles/china-moves-to-ease-foreign-concerns-on
-cybersecurity-controls-1472132575> accessed 27 August 2016.
201
ibid.It was also reported in cyber security circles, see for
example:Jeremy Seth Davis, ‘China allows foreign tech firms to par-
ticipate in creating cybersecurity standards’ (SCMagazine.com, 31
August 2016) <https://www.scmagazine.com/china-allows-foreign
-tech-firms-to-participate-in-creating-cybersecurity-standards/
article/530234/> accessed 31 August 2016.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
27
data storage and encryption. There is a live issue to be ad-
dressed by TC260 in that global companies juggling multiple
national security agendas can create “lots of competing
standards.”202 Perhaps these foreign technology firms, members
of TC260, already know the answer to the problem of vague
Chinese regulations and understand phrases such as “secure
and controllable”.
Furthermore, with regard to the location of servers within
China, it was reported that many foreign internet companies
have already complied with this measure. AirBnB, for example,
announced in November 2016, it would move its Chinese user
data to a domestic location, over a year after it officially entered
the Chinese market via a joint venture.203
Technology companies have also made public statements
against China’s Cyber Security Law requiring companies to
share proprietary source code within China. Microsoft wrote,
“[s]haring source code in itself can’t prove the capability to be
secure and controllable. It only proves there is source code”.204
In order to do so, you would need an expert security audit. China
would reportedly need to build its cryptographic expertise to
conduct such security audits.205 This is because in cyber se-
curity it is much easier to build attacks than to verify defenses.
While media reports stated that foreign technology compa-
nies will be required to provide source code to the Chinese
Government, there is no obligation in the law. The Cyber Secu-
rity Law does not explain source code compliance requirements.
For example, certification requirements could mean technol-
ogy companies will be asked to provide source code, encryption
or other critical intellectual property for review by security au-
thorities. Yet we do not know when and if this will actually occur.
As noted, reportedly, Microsoft in China already does so with
its software, under controlled conditions,206 and is planning a
“transparency centre,” allowing Chinese government coders to
test and analyse Microsoft’s products for cyber security issues.207
Technology companies may be required to provide source code
to third party bodies as part of specific licensing/review require-
ments. That could take place, in a system similar to Microsoft’s
202
ibid.
203
Josh Horwitz, “China’s bewildering new cybersecurity law is
keeping foreign tech firms out of the country”, Quartz, 7 November
2016.<http://qz.com/829248/chinas-new-cybersecurity-law-is-so
-vague-that-its-keeping-foreign-tech-firms-out-of-the-country/>.
204
Eva Dou, ‘Microsoft, Intel, IBM Push Back on China Cybersecurity
Rules’ (The Wall Street Journal, 1 December 2016) <http://www
.wsj.com/articles/microsoft-intel-ibm-push-back-on-china
-cybersecurity-rules-1480587542> accessed 21 December 2016.
205
However, in August 2016 China launched a satellite into orbit with
a unique feature: it has the ability to send information securely, not
with mathematical encryption but by using the fundamental laws
of physics. China will be the first country to achieve this feat. China’s
new satellite is an important step towards truly secure communi-
cations, as it allows quantum data to be sent over extreme distances
between any two locations.
206
Eva Dou, ‘Microsoft, Intel, IBM Push Back on China Cybersecurity
Rules’ (The Wall Street Journal, 1 December 2016) <http://www
.wsj.com/articles/microsoft-intel-ibm-push-back-on-china
-cybersecurity-rules-1480587542> accessed 21 December 2016.
207
Tekendra Parmar, ‘China: Tech Giants Push Back Against Bei-
jing’s New Cyber Security Bill’ (Fortune, 2 December 2016) <http://
fortune.com/2016/12/02/cyber-security-bill-source-code/> accessed
21 December 2016.
 ARTICLE IN PRESS
28 computer law & security review ■■ (2017) ■■–■■

transparency centres, in which regulators can review source code
in a highly controlled environment.
Furthermore, there is no reason to suggest that China’s Cyber
Security Law diminishes the importance of global coopera-
tion in technical standard-setting. Article 7 of the new law
echoes the desire of Network Sovereignty to create global in-
ternet standards:
Article 7: The State actively launches international exchange and
cooperation in the areas of cyberspace governance, research and
development of network technologies, formulation of standards,
attacking cybercrime and illegality, and other such areas; pro-
motes the construction of a peaceful, secure, open and cooperative
cyberspace, and the establishment of a multilateral, democratic
and transparent cyber governance system [emphasis added].208
TC260 will likely be engaged in consultations extensively
before 1 June 2017 and beyond.
5.6. Security technology is often public. The issue is how
governments legislate usage
Back doors do not affect the company that creates the en-
cryption technology, but the companies who use encryption
technology might need to worry, as might individuals who have
an expectation of privacy. For example, if Microsoft provides
encryption technology to Ford Motor Company, the Chinese
Government might request Microsoft’s assistance in an inves-
tigation of Ford. Companies are required to report “network
security incidents” to the Chinese Government and inform con-
sumers of breaches, but the law also states that companies must
provide “technical support” to government agencies during in-
vestigations. “Technical support” is also not clearly defined, but
could mean providing encryption backdoors or other surveil-
lance assistance to the government.
Security technology is often public. Encryption algorithms
are standardised, created by public research and are not pro-
prietary. Encryption algorithms are rarely intellectual property
as keeping encryption algorithms secret is a recipe for exploit-
able products.209 However, how encryption algorithms are
integrated is both intellectual property and a possible target
for cyber attack. Source code disclosures, on the other hand,
would be a major risk. Intellectual property theft may occur,
as source codes amount to instructions of how to do something
as opposed to designs. Source code is the implementation in-
structions for that encryption design, for example.
Overall security depends on many things including how code
is added to the wider product. In essence, you cannot tell if
your house is secure, just from the front door being locked.
There might be other ways to break in. If the whole house’s
source code was shared, there may be serious concerns of in-
tellectual property theft.
208
《中华人民共和国网络安全法》 [Cyber Security Law of the Peo-
ple’s Republic of China] (People’s Republic of China) Standing
Committee of the National People’s Congress (NPCSC), 7 Novem-
ber 2016, Article 7.
209
Encryption technology is generally available online for free (open
source), it would be trivial to subvert. Technically the use of back
doors is not a major difference. Without a backdoor Microsoft cannot
encrypt data.
The issue is how encryption usage is legislated. In practi-
cal terms, there is no difference between building a back door
and forcing Microsoft to un-encrypt when “technical support”
is required. Currently we have no concrete idea what “tech-
nical support” means. It does raise concerns at least theoretically
of commercial espionage and sabotage. In reality, for both fi-
nancial and technical reasons, it is unlikely that China would
invest in auditing source code to ensure Chinese Network Sov-
ereignty. This might be too big of a task.
5.7. Inherent tension between Network Sovereignty and
global internet guidelines: the Internet Engineering Task
Force (IETF)
It is difficult to envisage that China will be an international
standard setter as a task of Network Sovereignty. The Inter-
net Engineering Task Force (IETF), the global internet standards
body, is generally sceptical of any governmental involvement
and tries to leave internet regulatory work to technical experts.
The IETF “is a large open international community of network
designers, operators, vendors, and researchers concerned with
the evolution of the Internet architecture and the smooth op-
eration of the Internet. It is open to any interested individual”.210
In terms of the hierarchy of combative internet bodies the IETF
sits at the top. The IETF is an internet engineering task force
made up of academics and technologists hostile to govern-
ment. This is because it emerges from hacker ethos coupled
with an academic culture, designed purely for the commu-
nity development of internet standards and advocating a free
and open internet. It is difficult for countries to influence these
standards. The IETF also often rejects business concerns from
private industry if they conflict with good technical sense.
Indeed recently, when formulating the latest web encryption
standards: https, the business lobby proposed a way to have
security control over employees, suggesting back doors, to see
if employees were exposing proprietary information. The IETF
rejected this idea.211 In real terms it will be difficult for China
to influence the IETF.
5.8. Data localisation, cloud computing and keeping your
data in the cloud
Network Sovereignty is different in domestic context and in-
ternational contexts. Domestically it often means censorship
guidelines. Internationally it means China outlining its per-
spective for global internet guidelines. This is where the conflict
between the two aims becomes complex.
One aspect that surprised many is the requirement of the
Cyber Security Law for data localisation forcing “critical infor-
mation infrastructure operators” to store data within China’s
borders. As noted, the law does not include a clear definition
of infrastructure operators. Many businesses could be lumped
into that definition.
This is surprising because much of the recent drive to es-
tablish enterprises in China has been the intellectual property
210
See: https://www.ietf.org/about/.
211
See for example: ‘Re: [TLS] Industry Concerns about TLS 1.3’
<https://www.ietf.org/mail-archive/web/tls/current/msg21428
.html>.

Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
 ARTICLE IN PRESS
computer law & security review ■■ (2017) ■■–■■
protection of storing data in the cloud. That is, Internet of Things
devices can be valueless hardware, but the value of the company
resides in the big data collected. For the Internet of Things, cloud
computing is viewed as a key enabler to widespread adop-
tion. Cloud providers are expected to deliver secure and efficient
cloud services by default, protecting from major data breaches
or solution downtime issues. China would not seem likely to
disrupt this model that has been so successful in attracting
IoT start-ups to Shenzhen and other Chinese cities.
At the same time, in order to pursue Smart City policies,
China needs to strengthen cyber security. Internet Plus and
China’s passion for IoT devices means that: a security breach
is not limited to merely stealing credit card data. Anyone with
the right access could, for example breach firewalls or steal
health records from IoT devices. As millions of “things” start
joining the enterprise network, the surface area for hackers
to breach your system is expanding.212 All these devices will
leverage public Wi-Fi, cloud, Bluetooth networks, and other en-
abling networks, creating multiple points of vulnerability.213
The standards for IoT hardware and software are still evolv-
ing. Until there are established guidelines, companies need to
account for a vast range in device quality. Some devices may
be very sophisticated and hardy, while others may be cheap
and disposable. Low-quality devices have been used to gain
unauthorised entry into a secure network. In China where
Shenzhen’s shanzhai movement for knock-off and now inno-
vative electronic devices has thrived, this creates numerous
security concerns.
One big advantage of IoT is the sheer amount of data it gen-
erates. This allows operators to track operational data to create
alerts based on anomalies in the system. This may be com-
promised by legislating enforced localised data collecting
servers. Afraid of intellectual property theft from the cloud, data
collected in China may be quarantined by companies. This
would affect the quality of data samples. In turn, this may affect
the quality of security updates. Especially if the China market
represents the company’s greatest data collection point and
company directors insist on segregating data and operations.
In addition, what if Chinese technology companies are forced
to tamper with politically sensitive data, for example, related
to environmental degradation? Foreign and Chinese companies
alike, may be hampered by the data localisation requirements.
Data localisation is a risky ploy for China, time will tell what
it means to force “critical information infrastructure opera-
tors” to store data within China’s borders. Yet there are some
recent indicators that China will not sabotage its own cyber
security for its censorship goals.
5.9. Regulatory updates supporting third party
assessments
Much less controversial than the Anti-Terror Law and in-line
with China’s genuine cyber security concerns is the Encryp-
tion Law of the People’s Republic of China (Opinion-seeking
212
‘5 Considerations For Securing IoT’ (Forbes, 26 January
2017) <https://www.forbes.com/sites/vmware/2017/01/26/5
-considerations-for-securing-iot/#2e1a2e2c154a> accessed 27 January
2017.
213
ibid.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
29
Draft) (“Encryption Law”) promulgated in April 2017. The En-
cryption Law seeks to promote the use of encryption
technologies from a national level. As yet there has been no
international outcry over its intent.214 Unlike the initial Anti-
Terror Law it does not require “back doors” to be built. There
is a strong focus in the Encryption Law on the use of encryp-
tion to protect critical information infrastructure. Article 11 sets
forth that commercial encryption products that are sold or used
in business activities, as well as the provision of commercial
encryption services will be subject to approval in accordance
with to be-created certified encryption catalogues. In line with
the discussion above about encryption products, the major
global technology companies would need to be involved in as-
sisting in the creation of these catalogues.
5.10. Third parties in Security Review Measures and data
exits
The issue of the cross border data flows is complex and
evolving. On 11 April 2017, CAC released a circular for public
consultation until 11 May 2017: the Circular of the State In-
ternet Information Office on the Public Consultation on the
Measures for the Assessment of Personal Information and Im-
portant Data Exit Security (Draft for Soliciting Opinions)
(“Circular”).215 The Circular requires “network operators” in China
looking to transfer data abroad to undergo a security assess-
ment to determine whether the transaction carries “risks such
as disclosure, damage, tampering and abuse”. The rules will
therefore apply to any business seeking to transfer over one
terabyte of data or information on 500,000 or more individu-
als. This seems to widen the reach of the Cyber Security Law
as the rules limiting the transfer of data outside China’s borders
previously applied only to “critical information infrastruc-
ture operators.” This now includes “network operators”. A
“network operator” remains undefined and could be very broad.
The Circular prohibits any transfer of personal information
without prior consent of the user.216 Few clues were left as to
how this process will take place. The Chinese Government has
214
《中华人民共和国密码法 (草案征求意见稿)》 [Encryption Law of the
People’s Republic of China (Opinion-seeking Draft)] (People’s Re-
public of China) Office of State Commercial Cryptography
Administration (OSCCA), 13 April 2017.Article 20 is similar to China’s
Anti-Terror Law: People’s procuratorates, public security bodies and
State security bodies may require telecommunications operators
and internet service providers to provide technological decryp-
tion support when necessary for national security or the prosecution
of criminal cases.
215
《个人信息和重要数据出境安全评估办法 （征求意见稿）》 公开征求
意见 [Circular of the State Internet Information Office on the Public
Consultation on the Measures for the Assessment of Personal In-
formation and Important Data Exit Security (Draft for Soliciting
Opinions)] (People’s Republic of China) State Internet Informa-
tion Office, 11 April 2017.
216
“Personal information” is defined as various types of informa-
tion recorded by electronic or other means capable of identifying
a person’s personal identity alone or in combination with other
information. Including: the name of the natural person, date of birth,
identity document number, personal biometric information, tele-
phone number. Important data refers to data that is closely related
to national security, economic development, and social and public
interests, with specific reference to national relevant standards and
important data identification guidelines.
 ARTICLE IN PRESS
30 computer law & security review ■■ (2017) ■■–■■
now begun to create a process to allow data transfer and storage
overseas, despite the apparent prohibition in the Cyber Secu-
rity Law. This was almost certainly a response to the commercial
and security concerns of multinational technology firms. Nev-
ertheless this issue is evolving.
5.11. Third parties in security review measures
The major ongoing question is this: what role will third parties
have in China’s cyber regime? The Chinese Government has
begun issuing regulations to clarify the scope and intent and
implementation of China’s Cyber Security Law. In China’s “regu-
latory sandbox”217 where complex competing goals of Network
Sovereignty and Informatisation collide, it seems likely that
foreign firms will be extensively consulted. Article 29, for
example, provides that “relevant industry organisations will es-
tablish sound cyber security standards and mechanisms for
collaboration.”
On 4 February 2017, CAC sought public opinion on its draft
internet product and service security inspection law, a follow-
up to the Cyber Security Law: Measures for Security Reviews
of Network Products and Services (Draft for Solicitation of Com-
ments) (“Security Review Measures”).218 There are numerous
references to a new body to oversee technical matters – the
Cyber Security Review Committee (“Committee”) in Articles
5–8.219 Under the Committee, a Cyber Security Review Office
(“Office”) will be established to handle the actual review work.220
217
A regulatory sandbox is a ‘safe space’ where businesses can test
innovative products, services, business models without the threat
of regulatory action.
218
《网络产品和服务安全审查办法征求意见 (草案征求意见稿)》 [Mea-
sures for Security Reviews of Network Products and Services (Draft
for Solicitation of Comments)] (People’s Republic of China) State
Internet Information Office, 4 February 2017.
219
See: “Article 5: The State Internet Information Office, in con-
junction with relevant departments, shall set up a Cyber Security
Review Committee to review important policies of the cyber se-
curity review, organise cyber security review work, and coordinate
the relevant important issues related to the cyber security review.
The Cyber Security Review Office shall concretely organise and
implement the cyber security review.Article 6: The Cyber Security
Review Committee shall appoint relevant experts to form a Cyber
Security Review Experts Committee to conduct a comprehensive
evaluation on the security risks of network products and services
and the security and trustworthiness of suppliers on the basis of
the third-party evaluation.Article 7: The State shall determine in
a unified manner the third-party institutions, and entrust the third-
party institutions to conduct work during the cyber security
review.Article 8: In accordance with the requirements of relevant
state departments, national industry association proposals, market
reactions, and enterprise applications, the Cyber Security Review
Office will organise third-party organisations and experts to conduct
the cyber security review of network products and services, and
publish or circulate within certain limits the results of the reviews.”
220
The Security Review Measures provide that the Office can ini-
tiate security reviews in response to requests made by government
agencies, suggestions made by trade associations, or incidents in
the market. Companies can also voluntarily submit their prod-
ucts or services for review (Article 8). The review will consist of four
elements: lab testing, on-site inspection, online monitoring, and
review of background information (Article 3). No further detail was
provided with respect to how these elements will be carried out
and the overall timeframe for the entire review.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
In assisting the Office’s review, two more groups will be in-
volved in the process: designated third party evaluation centers,
providing technical evaluation reports; and an expert panel as-
sembled by the Committee, to evaluate whether the suppliers
are “secure and controllable,” on the basis of third party reports.
The Office then decides based on the third party reports and
the panel’s recommendations.
The English version of the Global Times, a state-owned tabloid
newspaper, reported that yet another cyber organisation will
be created from the Security Review Measures.221 Will these new
organs include representatives from foreign technology com-
panies? Will the “third-party institutions”222 in Article 7 include
foreign technology companies?223
On 2 May 2017 China released the Interim Security Review
Measures for Network Products and Services. Again there are
multiple references to accredited third parties in Cyber Security
221
According to the Global Times yet another cyber organisation
will be created: “A proposed new cyber security watchdog
will prevent online products and services from being manipu-
lated by foreign forces and safeguard Party and government
departments and key industries from national security threats,
experts said. The Cyberspace Administration of China (CAC)
is seeking the public’s opinion on a draft regulation of online
products and services that will see China set up an Internet
security review body to examine policies and coordinate nation-
wide practices on cyber security.”Liu Caiyu, ‘China eyes new
cyber security watchdog’ (Global Times, 2 February 2017) <http://
www.globaltimes.cn/content/1031517.shtml> accessed 2 February
2017.Comments made in the English language press reflect
how the Chinese Government intends the world to understand
its intent. The report went on: “[b]ecause China now still heavily
relies on foreign core technology, the Web review body will examine
loopholes that may have been intentionally installed into
online products or services, which might pose a threat to national
security”.
222
In Chinese the phrasing “第三方评价” third party appraisals and
“第三方机构” third party organisations or institutions suggests an
air of objectivity in Chinese language usage.
223
It could be that only Chinese organisations are capable of
providing the necessary technical support. There is a precedent.
Foreign cloud service providers in China are currently required
to obtain a mobile service licence, for which issuance is re-
stricted by regulation, and are largely held by domestic data service
operators. Therefore, a sino-foreign joint venture needs to be es-
tablished in order to obtain the licence.This dynamic is typified
in IBM’s cooperation with Tencent Cloud and 21Vianet, which has
enabled it to offer its services to the Chinese market and partici-
pate in the construction of a large data center just outside of Beijing.
Microsoft and Amazon have also established partnerships with do-
mestic Chinese companies in order to offer their cloud services
in China. Intel and Oracle are two Western companies that bought
into China’s existing cloud systems.For a cloud services review,
it was China Academy of Information and Communications
Technology (CAICT), China Information Technology Security Cer-
tification Center (CNITSEC), a source code review lab, and China
Electronic Standardization Institute (CESI). These bodies will
likely be included as third party reviewers for Cyber Security
Reviews.Nevertheless TC260 was involved in drafting standards for
China’s cloud security review regime. See “TC260 Drafts New Stan-
dard for China’s Cloud Security Review Regime” (United States
Information Technology Office, June 26 2015) <http://www.usito.org/
news/tc260-drafts-new-standard -chinas-cloud-security-review
-regime> accessed 2 May 2017.
 ARTICLE IN PRESS
computer law & security review ■■ (2017) ■■–■■
Reviews.224 Recent regulatory updates continue to refer to third
party cyber security assessments.225
6. Conclusion
Foreign and Chinese observers are yet to see if China has ar-
ticulated a new vision for an innovative and inclusive
entrepreneurial ecosystem embodied by Informatisation and
Internet Plus; or a more rigid one embodied by Network Sov-
ereignty. Vague regulations famously allow regulators leeway
to suit their aims. The Cyber Security Law may be the oppor-
tune time for China to decide which way it is heading toward:
further innovation or further restriction.
As CAC is under heavy pressure to implement the Law and
supporting regulations, it seemed unlikely that there would be
any delay in the Law coming into force on 1 June 2017. However
Reuters reported on 19 May 2017, that: CAC called a meeting
– with around 100 participants, including representatives from
global technology firms – to present last-minute changes to
implementation rules for China’s new Cyber Security Law.
It was reported that possible changes being considered by
CAC, included a new 18-month phase-in period from June 2017.
This would mean that the law would not be fully imple-
mented until the end of 2018, allowing time for further clarity
to be provided.226 The Chinese government has now delayed
224
《《网络产品和服务安全审查办法 （试行）》 [Interim Security
Review Measures for Network Products and Services] (People’s Re-
public of China) Cyberspace Administration of China, 2 May 2017.See
for example: Article 6: The Cyber Security Review Committee shall
engage relevant experts to establish a Cyber Security Review Experts
Committee, which shall, based on third-party assessments, perform
comprehensive assessment on the security risks of network prod-
ucts and services, and the security and trustworthiness of the
suppliers.
225
The Interim Security Review Measures for Network Products and
Services also contain the following provisions:Article 7: The third-
party organisations involved in cyber Security review shall be
accredited by the State according to the law, to perform third-
party assessments as part of Cyber Security review work.Article
8: The Cyber Security Review Office shall, in line with the require-
ments of relevant national departments, at the request of any
national industry association, or based on user responses, iden-
tify the entities for review according to procedures, organise third-
party organisations and the Experts Committee to conduct cyber
security reviews on network products or services, and then release
review results or report these results within a certain scope.Article
11: The third-party organisations performing cyber security review
shall conduct the assessment on an objective, just and fair basis,
in line with relevant national rules, by referring to relevant stan-
dards, and with a focus on the security and controllability of network
products and services and their supply chains, and transparency
of security mechanism and technologies, and assume responsi-
bility for assessment results.
226
Michael Martina and Cate Cadell ‘Amid industry pushback, China
offers changes to cyber rules: sources’ (Reuters, 19 May 2017) <http://
www.reuters.com/article/us-china-cyber-law-idUSKCN18F1VZ>
accessed 21 May 2017.
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
31
localisation227 requirements until 31 December 2018. The im-
plications for the location of cloud servers are yet to be
announced.228 Nonetheless, many internet companies have re-
portedly already begun to comply with China’s policy toward
data storage.229 Like the Anti-Terror Law, China will be careful
not to harm its innovation agenda.
The concept of a Smart City means very different things to
different cities. China has a very different ecosystem from other
countries. China’s innovation ecosystem possesses many
elements many countries lack. These elements include: deep
capital reserves, the world’s largest population for product
scaling, strong governmental will and a large military that is
actively seeking cutting-edge communication technology in-
novations. Increased development is a necessity for a Party-
State keen to appease a populace frustrated by environmental
and employment and other developmental issues.
As noted, there is a complete circle to be drawn here. The
Chinese Government in seeking to retain power needs to
appease a population now expecting more from its leader-
ship in terms of economic development and better quality of
life. These are complex policy considerations to balance.
The statement that “cyber security and informatisation
are two wings of one body” may explain why the Chinese Gov-
ernment is interested in providing the public with improved
secure big data solutions. More public information, increased
transparency and accountability are crucial to eliminating cor-
ruption, critical to the Party maintaining power. Thus, despite
the occasional heavy-handed efforts at exerting control over
internet-driven innovation, there are sufficient interests at stake
to ensure that innovation will continue to change gover-
nance and ultimately perhaps change the government itself.
Premier Li Keqiang’s March 2016 Government Work Report,230
articulated that China is attempting to remove unclear lines
227
The law will be subject to a phase-in period. “The Cybersecurity
Law and the revised draft measures both take effect on June 1, 2017.
However, cross-border data transfers will not be required to conform
to the revised draft measures until December 31, 2018”. It was widely
reported that Cyberspace Administration officials briefed foreign
embassies and trade organisations about revisions to the cyber se-
curity provisions. See: Yang Ge and Wu Gang, ‘Foreigners Get Minor
Concessions in Cybersecurity Law’, (Caixin, 29 May 2017)
<http://www.caixinglobal.com/2017-05-31/101096399.html> ac-
cessed 1 June 2017.
228
Caixin reported that: the US Chamber of Commerce wrote an
email detailing a number of changes to the Cyber Security Law in-
cluding a revised provision that “internal company data transfers
will not be subject to a security review if the company does not
use its network to commercialize data externally”; and that “implied
consent will be a sufficient standard for processing cross-border
data transfers.” This is an ongoing regulatory discussion. See: ibid.
229
In December 2016, AirBnB made the public announcement
stating that it had begun storing data for its Chinese users on do-
mestic Chinese servers. Uber, Evernote, LinkedIn, and Apple have
also done so, before the official implementation of the Cyber Se-
curity Law: Josh Horwitz, ‘A key question is at the heart of China’s
new cybersecurity law: Where should data live?’ (Quartz, 7 June 2017)
<https://qz.com/999613/a-key-question-at-the-heart-of-chinas
-cybersecurity-law-where-should-data-live/> accessed 9 June 2017.
230
‘Li Keqiang’s March 2016 Government Work Report’, (Xinhua, 17
March 2016) <http://news.xinhuanet.com/english/china/2016-03/
17/c_135198880.htm> accessed 19 March 2016.
 ARTICLE IN PRESS
32 computer law & security review ■■ (2017) ■■–■■
of authority. In outlining the role of government, streamlin-
ing administrative approvals is a key objective:
■ Government vows to streamline administration, trans-
form the functions of the government, and improve its
performance.
■ It will release the lists of all powers and responsibilities of
local governments.
■ It will revise administrative regulations, reduce adminis-
trative levies and cut red tape to ensure that the people have
more equal opportunities and greater space for creativity.
■ Government will carry out the “Internet Plus government ser-
vices” model and promote better information sharing between
Government departments, so that the public and businesses
can make fewer visits to government departments to get things
done.
This seems counterintuitive to the idea that China’s Cyber
Security Law is planning to introduce more red tape. On the
contrary China has streamlined its cyber bureaucracies. The
weight of evidence suggests that this new Law was driven by
a desire to protect key infrastructure from cyber vulnerabili-
ties. If this is the goal, China will not stop foreign firms from
negotiating data exits from China.
The assertion that China’s Cyber Security Law and the
concept of Network Sovereignty would dampen Smart City in-
novations is also questionable. While the Chinese Government
carefully manages internet information flow in political areas,
it is open and supportive of internet commerce and Smart City
projects.There is great optimism in China’s direction and a belief
in China’s innovative capabilities. Many venture capitalists iden-
tify China as the leading Asian innovator and a competitor to
the US, including in complex technologies such as artificial
Please cite this article in press as: Max Parasol, The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams,
Computer Law & Security Review: The International Journal of Technology Law and Practice (2017), doi: 10.1016/j.clsr.2017.05.022
intelligence.231 This prediction is based on emerging technolo-
gies such as the Internet of Things and Smart City technologies.
Finally, there is also a goal of attracting foreign firms to the
Chinese innovation ecosystem.232 That goal is perhaps em-
bodied by the impression given by recent regulations that
foreign technology firms will be allowed to participate in Cyber
Security Reviews under the new Cyber Security Law.
Domestic legalism embodied by Network Sovereignty seems
like the simple answer for Chinese leaders. Slowing or even
hampering innovation, technology and technocracy233 in this
age of technology-driven innovation is a more complex problem
that Chinese leaders will have to face. It seems unlikely that
the Chinese government will really wish to stifle its innova-
tion agenda. We must therefore look to the wider policy context
for the intent behind the Cyber Security Law, namely, the urgent
need to protect China’s billions of connected devices and the
Chinese Government’s desire to improve the lives of the Chinese
people, and thereby maintain its legitimacy.
Acknowledgement
I would like to thank Professor Colin Hawes of the University
of Technology, Sydney for his editing and comments on the final
manuscript, and Paul S. Triolo of the Eurasia Group for reading
and commenting on my final draft. I would also like to thank
Professor Natalie Stoianoff of the University of Technology,
Sydney and Shaanan Cohney of the University of Pennsylva-
nia for their input and expertise. Finally, I want to thank
Professor Steve Saxby for his encouragement and support from
conception to publication of this article. This research was made
possible through funding as a Quentin Bryce Scholar.
231
See for example: Sarah Zhang, ‘China’s Artificial-Intelligence
Boom’, (The Atlantic, 26 February 2017) <https://www.theatlantic.com/
technology/archive/2017/02/china-artificial-intelligence/516615/>
accessed 19 March 2017.
232
China has long had a policy attracting “foreign talent” to China.
This has been expanded in terms of ease of obtaining visas, for
example, since President Donald Trump won the US election, in the
hope that China will draw talented expatriates to join its innova-
tion cause.
233
Technocracy is an organisational structure or system of gover-
nance where decision-makers are selected on the basis of
technological knowledge.