Executive Summary​​ 

On June 1, 2017, after years of domestic and international debate, China’s national cybersecurity law finally went into effect. Much of the law focused on the protection of Chinese users’ data, while assessments of the law emphasized the potential negative impacts to foreign companies and technologies and the difficulties in complying with the onerous, vague, and broad new legal requirements.​​ 

La investigación de Recorded Future se centró en los amplios poderes que la ley de ciberseguridad otorga al Centro de Evaluación de Tecnologías de la Información de China (CNITSEC), una oficina del principal servicio de inteligencia exterior de China, el Ministerio de Seguridad del Estado (MSS). La ley otorga a los "departamentos de información de red", incluido el CNITSEC, el poder de realizar "revisiones de seguridad nacional" (ver el Artículo 35) de la tecnología que las compañías extranjeras desean emplear o vender en el mercado chino.​​ 

The MSS’s integration into the information security architecture of China via CNITSEC will (1) possibly allow it to identify vulnerabilities in foreign technologies that China could then exploit in their own intelligence operations, and (2) create an impossible choice for foreign companies between giving their proprietary technology or intellectual property to the MSS and being cut out of the mainland Chinese information technology market, which is projected to reach $242 billion in 2018.​​ 

Background​​ 

In our May 2017 blog post attributing the threat actor group APT3 to the Chinese MSS, we also identified a Chinese information security organization that is actually run by the MSS — CNITSEC, also referred to in this piece as “the center.”​​ 

According to academic research published in “China and Cybersecurity: Espionage, Strategy, and Politics in the Digital Domain,” CNITSEC is run by the MSS and houses much of the intelligence service’s technical cyber expertise. CNITSEC is used by the MSS to “conduct vulnerability testing and software reliability assessments.” Per a 2009 U.S. State Department cable, it is believed China may also use vulnerabilities derived from CNITSEC’s activities in intelligence operations. CNITSEC’s former Director and current party secretary, Wu Shizhong, even self-identifies as MSS, including his work as a deputy head of China’s National Information Security Standards Committee as recently as January 2016.​​ 

Analysis​​ 

CNITSEC’s role in the new information technology regulatory regime has become apparent only over the last few months as the Chinese state began to finalize and publicize regulations in support of the CSL.​​ 

Cybersecurity Law Is Broad and Language Is Vague​​ 

Before delving into CNITSEC’s role, it is important to first review relevant sections of the CSL and the obligations foreign companies are likely to incur (for a good English-language translation, please see China Law Translate). It is important for companies to note the imprecision and breadth of the CSL as well as the 2015 National Security Law, because both contain vague language that can be invoked by Chinese authorities to compel national security reviews, data sharing with government authorities, and even inspections into proprietary technology or intellectual property.​​ 

Upon its passage in November 2016, one of the poorest-defined sections of the law was “Chapter Three: Network Operations Security.” Chapter three includes 18 articles which define the “network security protection” responsibilities of “network operators” and additional legal responsibilities for companies that operate “critical information infrastructure.”​​ 

Solo uno de los tres términos mencionados anteriormente estaba definido en la propia ley. La CSL establece que los "operadores de red" son "propietarios, gestores y proveedores de servicios de red". Según un análisis de KPMG sobre la ley:​​ 

Enterprises and institutions that provide services and conduct business activities through networks may also be defined as “network operators.” In addition to traditional telecom operators and internet firms, network operators may also include:​​ 

• Financial institutions that collect citizens’ personal information and provide online services, such as banking institutions, insurance companies, securities companies, and foundations.​​ 
• Providers of cybersecurity products and services.​​ 
• Enterprises that have websites and provide network services.​​ 

This is such a broad interpretation of the term that it could encompass any business that uses the internet or collects user data in China. Further, companies that are categorized as “network operators” are subject to a review by government regulators if they ever wish to transfer large amounts of user data abroad (see Article 37).​​ 

Según el Artículo 28 de la CSL, los "operadores de red" también están obligados a proporcionar asistencia para "preservar la seguridad nacional e investigar delitos" a las agencias de seguridad pública y estatal. Esto podría poner a las compañías en la situación de tener que proporcionar información a las fuerzas del orden chinas y a organizaciones de seguridad estatal sobre usuarios o actividades que no se consideran delitos en Occidente, especialmente "delitos relacionados con Internet". Algunos de estos "delitos relacionados con Internet" incluyen usar Internet para "fabricar o distorsionar hechos, difundir rumores, alterar el orden social", "insultar o difamar a otros" y propagar "información dañina". Un subconjunto de "operadores de red" está clasificado por la ley como operador de "infraestructura crítica de información" y sujeto a regulaciones y revisiones aún más estrictas. El texto de la CSL clasifica la "infraestructura crítica de información" como:​​ 

Public communication and information services, power, traffic, water, finance, public services, electronic government (e-gov), and other critical information infrastructure that if destroyed, lost functionality, or leaked data, might seriously endanger national security, the national economy and the people’s livelihood, or the public interest.​​ 

The Chinese state’s definition of “national security” was formalized in the July 2015 “National Security Law” as:​​ 

The relative absence of international or domestic threats to the state’s power to govern, sovereignty, unity and territorial integrity, the welfare of the people, sustainable economic and social development, and other major national interests, and the ability to ensure a continued state of security.​​ 

Las compañías de este sector, y cualquier producto o servicio adquirido por ellas, también estarán sujetos a una "revisión de seguridad nacional", que según informó el Financial Times permite al gobierno "aplicar código fuente de programas informáticos" y "profundizar en la propiedad intelectual de las compañías." El artículo también afirma que "incluso las compañías de reparto de comida rápida podrían considerar infraestructuras críticas", dictaminaron los reguladores de Shanghái durante una prueba piloto para la ley", probablemente porque poseen información personal de millones de usuarios chinos.​​ 

CNITSEC’s Role in CLS Provides MSS Collection Opportunities As outlined in our blog on APT3 and the MSS and detailed again above, CNITSEC has never officially acknowledged its relationship with the MSS, but the center’s mandate to serve the Chinese state, party, and government organizations, as well as conduct reviews under the CSL, is well-documented.​​ 

• CNITSEC’s website describes the center as having a broad mandate, bestowed by the central government, to conduct security vulnerability evaluations and risk assessments of party and government information networks; security testing of information technology, products, and systems; boasts “first-class” vulnerability analysis resources and equipment; and professional research and development technical labs.​​ 
• In a June 2017 interview given to the Chinese-language paper Southern Metropolitan, CNITSEC’s Chief Engineer Wang Jun confirmed that CNITSEC had been certified by the Chinese government to conduct the national security reviews under the CSL. Wang further explained that a review could be initiated by a relevant state department, a national industry, or by the market, which included users and the public.​​ 
• At a conference later in the month, Wang delivered a keynote address on the same topic, making an explicit link between Article 59 of the 2015 National Security Law, which established the legal requirement for a national security review and oversight of foreign commercial investments, technologies, products, and services; the security reviews mandated under China’s 13th Five-Year Plan; and the national security reviews mandated under the CSL.​​ 

Wang (photo below) also emphasized in this speech that the CSL national security reviews would focus on the possible impact on national security, security risks, security reliability, control, security mechanisms, and technological transparency. He continued to maintain that the reviews would be conducted by professional “third parties” that were ostensibly objective and independent, however, with CNITSEC, an office within the MSS, emerging as a certified national security reviewer, it calls into question any other organization that has also been certified.​​ 

CNITSEC también gestiona la Base de datos Nacional de Vulnerabilidades de Seguridad de la Información de China (CNNVD), que es el centro nacional de evaluación de la seguridad de la información, y es responsable de la construcción, operación y mantenimiento de la plataforma nacional de gestión de datos de vulnerabilidades en seguridad de la información.​​ 

De forma evidente, CNNVD opera de manera similar a otras Bases de datos Nacionales de Vulnerabilidades (NVD), como el NVD del Instituto Nacional de Estándares y Tecnología (NIST) del gobierno de EE. UU., que está gestionado por una división dentro del Departamento de Seguridad Nacional (DHS), encargada de identificar públicamente, informar y crear parches para vulnerabilidades de software. Aunque no existe un equivalente exacto al DHS en China, la misión y el alcance del Ministerio de Seguridad Pública (MPS) son los más similares y se considera ampliamente el equivalente del DHS en China. La equivalente estadounidense más similar del MSS es la Agencia Central de Inteligencia (CIA); sin embargo, el MSS también está facultado para recopilar inteligencia dentro de China, con algunas funciones similares a la del Buró Federal de Investigaciones (FBI). Para comparar, el MSS que ejecuta el CNNVD sería aproximadamente el equivalente a que la CIA gestione el NVD del NIST.​​ 

El problema fundamental con el MSS gestionando CNITSEC y CNNVD, y más ampliamente, con el papel del MSS en la infraestructura organizacional de seguridad de la información en China, es que el MSS es la "principal agencia civil de inteligencia" de China, responsable tanto de la inteligencia extranjera como de las operaciones de contrainteligencia. Según "China's Security State: Philosophy, Evolution, and Politics", el MSS es "responsable de recopilar y evaluar inteligencia civil relevante para la seguridad nacional y de llevar a cabo operaciones de contraespionaje contra países extranjeros."​​ 

This means that the MSS is using the broad language and new authorities in China’s cybersecurity law to possibly gain access to vulnerabilities in foreign technologies that they could then exploit in their own intelligence operations. The MSS has a voice in which vulnerabilities are reported via the CNNVD, because they run it; they could also easily identify and hide from the public a critical weakness in software or hardware, then turn around and use it in their own operations.​​ 

Hay dos diferencias críticas en la forma en que el MSS podría gestionar el CNNVD y cómo la CIA o la NSA interactúan con el sistema NVD del NIST. En primer lugar, aunque está ampliamente documentado que las vulnerabilidades explotadas por el serial ETERNAL de herramientas de la NSA no fueron identificadas por Microsoft ni por el NVD del NIST antes de ser adquiridas por el grupo ShadowBrokers, la NSA no está en el NVD del NIST y no censuró activamente estas vulnerabilidades de la base de datos. El MSS (a través de CNITSEC) gestiona el CNNVD y puede elegir reprimir o controlar las vulnerabilidades que se reportan al público.​​ 

Second, the MSS could leverage research conducted by the CNNVD to support their operations. U.S. intelligence agencies such as the NSA and CIA identify vulnerabilities based on their own research and are not allowed to leverage NIST NVD’s non-public research.​​ 

Impact​​ 

The vagueness and opacity of the definitions in the CSL means that many foreign companies, especially those considered part of the “critical information infrastructure,” will have to make the grim choice between giving their proprietary technology/intellectual property to the MSS and being excluded from the mainland Chinese market. Allowing their technology to be security reviewed by the MSS could have a secondary ramification of putting current customers or users at increased risk for Chinese state-sponsored cyberattacks.​​ 

Foreign companies seeking to conduct business in China, especially those in the “critical information infrastructure” sectors, now face a host of technical, legal, and ethical decisions about operating in China that might not have been previously considered. These decisions will impact both the tactical and strategic plans and operations for companies in a wide range of industry verticals.​​ 

First, with the knowledge that the MSS could discover and operationalize vulnerabilities in proprietary products or services, companies need to evaluate three possible risk scenarios:​​ 

• Risk to a company’s own machines or networks.​​ 
• Risk to a company’s product or service.​​ 
• Derivative risk to customers, clients, or users around the world.​​ 

Most products and services utilized in China will not be wholly unique from their global counterparts, raising the risk that vulnerabilities discovered by the MSS could be utilized to exploit international users of these machines, networks, products, and services. Companies in this loosely defined “critical information infrastructure” sector are at greatest risk. These likely include software and hardware vendors; SaaS (software as a service), IaaS (infrastructure as a service), PaaS (platform as a service) companies; cloud, security, and network providers; and many more.​​ 

En segundo lugar, cooperar con las autoridades chinas proporcionando información sobre los sujetos de investigaciones nacionales podría exponer a las compañías a críticas públicas en Europa y Norteamérica, demandas y posible censura de múltiples niveles de gobierno. En 2007, Yahoo se vio en el punto de mira de una audiencia bipartidista en el Congreso tras proporcionar a las autoridades chinas información relacionada con el encarcelamiento de un periodista disidente. El CEO de la compañía y el Consejo General fueron calificados de "pigmeos morales" e "irresponsables" por el presidente del Comité de Asuntos exteriores de la Cámara, y se vio obligado a defender su reputación ante los grupos de derechos civiles desde el incidente. Yahoo incluso se vio obligada a llegar a un acuerdo en una demanda privada derivada de su cooperación con el gobierno chino. De cara al futuro, aún más compañías se verán obligadas a equilibrar entre el cumplimiento de las normativas chinas y el seguimiento de la ética empresarial occidental para evitar dificultades similares en el futuro.​​ 

Editor’s Note​​ 

This is not meant to replace legal advice or counsel. Please make sure to consult local legal counsel for additional concerns regarding China’s cybersecurity law.​​