Tech sector hopes to focus US attention on China's cybersecurity law
As more businesses weigh in on the accelerating US-China trade war, a group representing Apple, Google, Samsung and other global technology giants is telling the Trump administration that they support its objectives where their sector is concerned. It's just that there's a better way to go about it.
That's the message the sector's trade association, the Information Technology Industry Council (ITI), is delivering to as many governmental officials as it can.
The White House is determined to push Beijing to abandon a controversial industrial policy known as Made in China 2025 (MIC 2025), which provides massive financial support for indigenous tech innovation. But to Naomi Wilson, ITI's director of global policy for China and Greater Asia, that programme is not nearly as consequential as China's new cybersecurity law (CSL) " and thus, the wrong initiative to target.
US President Donald Trump and Chinese President Xi Jinping shaking hands during a joint news conference in Beijing in November 2017. The US trade war that began with threats this spring has focused on the Made in China 2025 programme. Photo: AP
ITI advocates on behalf of global tech giants on issues that affect them broadly, partly because its constituents " which also include Toyota, Nokia and even China's Lenovo " are reluctant to be public about the differences with the governments that regulate them.
"It's really not helpful to tell China, 'you need to change or walk back Made in China 2025.' Frankly, it's not helpful to us," Wilson told the South China Morning Post.
"If China were to just sweep Made in China 2025 under the rug, all of these other regulations and laws still exist. China will proceed with implementation and enforcement of those laws."
While China's cybersecurity law was enacted in June 2017, associated regulations have been published by various governing bodies since then, setting punishments including fines for individuals of up to 100,000 yuan (US$14,600) for not properly censoring content, and the revocation of permits and business licenses. MIC 2025 is a set of guidelines that do not enumerate punishments for companies or individuals.
China pushes through cybersecurity law despite foreign business fears
The CSL creates more risk than the merely "aspirational" MIC 2025 for foreign companies operating in China, particularly as rules stipulating how companies must comply with the new law are still being rolled out, Wilson said.
Other experts agree.
China's cybersecurity law "will present an unprecedented challenge for international businesses with operations in China", according to a white paper published by the international law firm Reed Smith after it went into effect.
Apple's chief executive Tim Cook at a conference in June. Apple has begun storing the iCloud accounts of its Chinese users at a new data centre ahead of new cybersecurity provisions in China that go into effect at the end of the year. Photo: Reuters
The Cyberspace Administration of China, the primary authority charged with supervising and enforcing the CSL, "has been focusing its enforcement effort on user-content monitoring ... as part of the effort to 'clean up' the internet", Reed Smith said.
"Already, the Chinese government has imposed maximum fines on technology giants operating in China for failing to adequately censor banned user content on their websites."
China's tough cyber rules 'raise risk of infiltration'
Wilson said that Trump's use of punitive tariffs on Chinese imports to end Beijing's MIC 2025 programme and reverse the US trade deficit with China sidelines government on global cybersecurity regulation, who understand better how to protect the interests of tech companies that global supply chains.
"There are absolutely experts within the US government, many of them civil servants, who have been working on these issues for years and understand the complexities of these policies and regulations very well," Wilson said. "I think US government senior leadership would be well advised to listen to those who have been working on this for decades.
"It's dangerous to assume that an outside perspective just shed new light on the US-China relationship and what the problems are and people who have not been working on these issues are going to come in and just fix it because they're going to use a tactic that no one has used before."
Some ITI member companies have already begun trying to accord with China's CSL.
In March, Apple began storing the iCloud accounts of its Chinese users at a new data centre in southwestern Guizhou province run by a local company to get ahead of the CSL's data localisation provision, which takes effect on December 31 this year.
That move sparked criticism that Apple was kowtowing to Beijing. The company said it had transferred the cryptographic keys needed to unlock users' iCloud accounts to Chinese regulators to comply with the new cybersecurity law.
Wilson said that ITI is trying to persuade regulators in China and elsewhere that data localisation requirements can create more vulnerabilities than cloud storage because they force companies to keep their network's data in one place. This gives hackers a single point of entry.
China's CSL requires all "network operators" and operators of "critical information infrastructure" " the latter including companies in the transport, energy and finance sectors " to undergo security reviews to ensure that their data systems are "secure and controllable".
According to the Reed Smith document, the phrase "secure and controllable" "has not been formally defined, but appears to be understood by commentaries to mean preference of domestic products with back door access to the government over foreign products and technologies".
Last spring, testifying at a Senate hearing reviewing China's rules regarding information technology practices, Dean Garfield, the ITI chief executive, said that China is "doing things that are both legitimate and illegitimate to put its thumb on the scale in favour of its local champions so they can corner the market on the frontier innovations of the future".
Dean Garfield, the chief executive of the Information Technology Industry Council, in 2013. The trade association is urging the Trump administration to press China to revise its new cybersecurity law. Photo: AFP
The organisation is delivering its message wherever it can. "We are regularly talking to lawmakers on the Hill and folks in the administration," said ITI communications manager Jose Castaneda. "In addition, Dean sits on the USTR Trade Advisory Committee, where we have raised our concerns as well."
On Tuesday, ITI's Wilson gave testimony at a public hearing before the inter-agency "301 committee" in Washington concerning the possible imposition of duties on an additional US$200 billion of Chinese goods. Tariffs on US$50 billion worth of goods are already in effect or about to be imposed.
Lenovo warns it may raise prices if US-China trade war drags on
Product categories under discussion for the next round include printed circuits " key components in the products many ITI member companies sell.
New tariffs on these components "would directly increase the cost and resources required to build data centres in the United States, yet the consequences extend well beyond increasing the cost of construction", Wilson told the committee. It would raise costs for both American small- and medium-sized businesses that rely upon these data and cloud services to run their day-to-day systems.
"While the administration's threat of tariffs has achieved the first step of getting China's attention, we have yet to see a change in China's behaviour or evidence of serious negotiations," she said.
This article originally appeared on the South China Morning Post (SCMP).
Copyright (c) 2018. South China Morning Post Publishers Ltd. All rights reserved.
