China's new data security rules Are they enough?

Welcome to World Insight. I'm Tianwei in Beijing. China's Ministry of Industry and Information Technology said on Monday it has issued a draft 3-year action plan to develop the country's cybersecurity industry, estimating the sector may be worth more than 250 billion yuan by the year 2023. Last week, China firmed up regulations on data security, proposed draft rules calling for all data-rich tech companies with over 1 million users to undergo security reviews before listing overseas. So how will these measures do the job of protecting data in China? Are they enough? What does it mean when different countries having their own rules and regulations on these? Let's loop in our panelists. For data security, in Beijing, I'm joined by Lu Chuanying, research fellow at the Shanghai Institute of International Studies. In Boston, I'm joined by Robert Siciliano, partner and head trainer at ProtectNowLLC.com. Gentlemen, welcome to the program. I want to start by asking you, what is the real essence, gentlemen, do you see the debates going on regarding data security, particularly beyond the borders? Mr. Hu.

So recently we know that the Chinese government published cybersecurity review regulations which is try to target on this, this social media platform and internet platform who stored and they collect a lot of the personal information. And it seems to be a risk posed by them to have so many data. And on the other hand, some of the companies go abroad, for example, go to the United States to list it there at the stock market, which some people believe that it will pose the national security risk because they have so many data on their hand.

So how, Mr. Siciliano, is the debate evolved in your country? You know, between the government and the business?

American corporations are always on the edge in regards to what the law will and will not allow. It is a constant battle between American corporations and the American government. And the companies themselves hire lobbyists to continually push that envelope, to extend that line in such a way where they often have politicians on the inside that are working for them in such a way that sways legislation, laws, towards the corporations themselves, coupled with the fact that Most government agencies and politicians don't understand data security or data privacy enough to even protect the consumers in which voted for them.

Mm-hmm. A very interesting situation. Mr. Lu, regarding the latest regulation, it seems that it's about Chinese companies seeking overseas IPOs. The Chinese side believe that the US side, for example, has been doubling down on the Chinese tech firms listed overseas with inspections and also with auditing and double checks. And this would involve data security regarding China's national interest. Mr. Lu, here comes the question. What would that mean for Chinese companies seeking overseas IPOs? Will tech firms still have much space to explore in that regard under the current circumstances?

Actually, those actions of the tech companies posed the risk and challenge to the government because, you know, the government wants to protect the data security. But these situations make them into a situation that— because at one hand, the tech company will be under the laws of Chinese government. On the other hand, if they listed abroad, United States in particular, it will have to under the jurisdiction of the United States. But we have the two different legal system. We have different laws. And on the other hand, we do not have multinational arrangement to solve the different of the laws of the two jurisdictions. So that's the reason why we see what happened in recent days.

Mr. Siciliano, what that mean for the industry, you know, the industry of, in which high-tech companies used to be the pioneers, but it seems that there are more and more criticism, cynicism against them?

So, all that scrutiny comes from the fact that we are now at a time when we only have, you know, a dozen or so corporations worldwide that have become monopolies in such a way where they have way too much power. They have way too much power here domestically, and they have way too much power abroad. And it's, it's only now that American companies are getting, are facing the pushback that they have been receiving overseas for quite some time. And only now are American government officials beginning to make an attempt to break up those monopolies, but they're still a long ways away from that. Where again overseas They mostly have prevented those monopolies from taking hold.

Big tech companies around the world used to have ways of storing their data in their own country, but also in the countries where they operate and have regulations regarding the data security. But now As we see these global changes, what would that mean for the big data? And will industries still be able to function on their earlier business model?

I'm not sure how much the business model will change. I think internally it might create a lot more, I guess, work internally for these organizations. Where regulation and compliance officers are going to be in quite demand due to the fact that they're going to have regulatory and compliance issues in a number of different countries opposed to just, you know, one or two. And the technologists themselves, CTOs and others, are going to have to separate and segregate a lot of that data. And that would also mean a lot of a different— the infrastructure will have to expand quite a bit, and that is gonna also increase, um, the attack surface as well for bad guys or for, you know, for criminal hackers. That will ultimately affect profit margins too. So in, in some way it will affect the business model, but if they want to gain a foothold in these countries, they're going to have to be flexible.

What I see from this issues is just the cost and efficiency. In the past, you just need to have one global data center, but recently with the requirement of the different countries of the data localization, you have to set up a lot of the data centers in different places, so which means you raise your cost. But it's not every country have the power to negotiate with those big tech companies to ask them to do that. It's only the United States, China, Russia, European Union, these big states, they have numerous of the internet users and big market who can leverage this to the tech companies, ask them to do that.

Zhu Lu, that's actually a fantastic question I was about to ask to both of you. We have seen so far, continuous failure internationally putting a commonly agreed-upon framework on data security worldwide. After all, Mr. Siciliano, I was preached, I was told as a liberal arts major decades ago that internet is bringing all of us together as a tool, as an infrastructure. Are we going to see a going back or stepping back from that concept and reality? Are we already seeing a few first steps in that regard?

You know, keeping in mind that the internet as we know it, utilized for commerce or even global commerce at this, at this time, is really only about 25 years old.

Yeah.

And it being global, um, is even younger. And so that process and standards worldwide, uh, in, uh, developing countries is all brand new to them. Uh, it is going to take time, cooperation, uh, and, um, more, uh, regulation in order for, uh, us to see standards in such a way where Europeans and Americans, Russians, Chinese, all essentially see eye to eye as to how that data is used and shared and protected.

So I want to say that to answer your question, there are 3 stakeholders in this field. One is the government. They're fighting with each other and they want to pursue their supremacy. Hegemony, but we also have other stakeholders like the company and business. Business want to have a unified market for their, you know, to reduce the cost. And also another factors I think is the technology. So the technology, if you look at the history that the technology want to have our unified standard. If you look at the 3G, 4G, 5G, Then we only have one standard. So this is the destination of the technology. It's not go to the diversified, it's actually want to go to our unified. So what about the future? It's too early to make the judgment whether the internet will still maintain as the current one or it go to the organization or split it into different models. So it depends on how these three actors are interacting with each other.

Lu Chuanying, Robert Siciliano, thank you so much, both of you, for bringing insights to all of us from your own perspective on such an important question.