China's Solution To The VPN Quandary: Only Authorized, And Presumably Backdoored, Crypto Links Allowed

from the will-Russia-follow-suit? dept

Two of the most important developments in China's clampdown on the digital world took place last year, when the country's Ministry of Industry and Information Technology declared that all VPN providers needed prior government approval to operate, and then apps stores were forced to remove the many VPNs on offer there. In some parts of China, VPNs were banned completely, but such a total shutdown is not really an option for cities with many businesses that require secure overseas communication channels. That put the Chinese authorities in something of a quandary: how could they reconcile their desire to prevent VPNs being used to circumvent online controls, while ensuring that the country's increasingly important corporate sector had access to the encryption tools it needed for operating globally? An article in the FT provides us with the answer (paywall). In recent months, international companies and organizations have found their VPNs blocked more frequently:

regulators have been pushing multinationals to buy and use state-approved VPNs. The state-approved versions can cost tens of thousands of dollars a month and expose users' communications to Beijing's scrutiny.

"China's intention is to control the flow of information entirely, making people use only government-approved VPNs by making it difficult, if not impossible, to use alternatives," said Lester Ross, partner at legal firm WilmerHale in Beijing.

The great thing about state-approved VPNs is that they can include backdoors for the government to use, and can be to shut down quickly if really serious problems arise that require even more stringent controls.

Backdoored crypto is inherently vulnerable to attacks against those built-in weaknesses, but the Chinese authorities are doubtless willing to let companies run that risk for the sake of maintaining overall control. Since Russia's views on VPNs are closely aligned with those of China, it will be interesting to see if it decides to adopt Beijing's solution to the VPN dilemma to tidy up its own rather clumsy approach.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: backdoors, china, encryption, vpn

Marriott Freezes Its Social Media Globally, And Makes Grovelling Apology To China, All For A Drop-Down Menu And Liking A Tweet

from the rectification-of-names dept

As Techdirt readers are well aware, China is rapidly growing more powerful, both economically and politically. Its economic rise has been clear enough for some time, not least in its technological prowess. Its political might, however, has only recently become more evident, as it begins to assert itself in various ways around the world. China's sense of its own power, and its increasing impatience with anyone that dares to go against it, is nicely illustrated in a recent incident. It concerns a drop-down menu and a like on a tweet, both belonging to the "global lodging company" Marriott International, which issued the following corporate statement a few days ago:

Marriott International respects and supports the sovereignty and territorial integrity of China. Unfortunately, twice this week, we had incidents that suggested the opposite: First, by incorrectly labelling certain regions within China, including Tibet, as countries in a drop-down menu on a survey we sent out to our loyalty members; and second, in the careless "like" by an associate of a tweet that incorrectly suggested our support of this position [that Tibet is a country in its own right]. Nothing could be further from the truth: we don't support anyone who subverts the sovereignty and territorial integrity of China and we do not intend in any way to encourage or incite any such people or groups. We recognize the severity of the situation and sincerely apologize.

In addition to this grovelling apology, Marriott publicly punished itself by shutting down large chunks of its digital activities, as China Daily, the English-language news organ of the Chinese government, reported:

After identifying its errors, the company has taken the survey offline, "unliked" the post, shut down its six websites and apps in Chinese, and put a freeze on its social media across the world. The CEO has volunteered to issue an apology.

It has also terminated the contract with the third-party vendor that built the survey, a Canadian company that Marriott has been working with for a long time, and with the US-based employee who "liked" the tweet.

It's not clear whether Marriott was ordered directly to take these actions, or decided to carry them out voluntarily. Either way, it's striking that Marriott is apologizing so abjectly for actions taken in the US and Canada -- not in China -- and even shut down its social media activity globally, for a while. That's a striking demonstration of China's reach today: no matter where something happens, if the Chinese authorities don't like it, they now expect businesses that want to work in China to come up with a "rectification plan" for these slips, just as Marriott has done, according to China Daily. That's probably a reference to a concept in Confucian philosophy, the "rectification of names", which means making words correspond to reality -- in this case, the policies of the Chinese government. An article in Business Insider notes that other multinationals have received loud and clear the message China wishes to send by its humiliation of Marriott:

A number of international companies, including Zara, Marriott, Qantas, and Delta Air Lines, have apologized to China in the last week for listing Taiwan and Hong Kong as "countries" on their websites.

Zara, Marriott and Delta Air Lines all deleted references to these regions as countries and were publicly reprimanded by Chinese authorities, while Qantas discovered and fixed the same type of "error" during a routine review of its website.

Expect much more of this kind of thing, as a newly-confident, and increasingly arrogant, China starts to swing its weight around. It will doubtless seize on even the most trivial "hurt", real or perceived, as a pretext for humbling Western companies and thus, implicitly, their governments -- just as they did to China once upon a time.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: china, free speech, social media
Companies: marriott

US Telcos Threatened With Loss Of Government Contracts If They Do Business With Huawei

from the evidence-schmevidence dept

Last week we noted how AT&T was forced to scrap a partnership with Huawei to sell the company's smartphones here in the States, just hours before it was set to be announced at CES. The reason? Apparently a few members of the Senate and House Intelligence Committees fired off a letter to the FCC demanding that they pressure US telcos into avoiding Huawei. The letter, which nobody has published, allegedly accuses the company of being little more than an intelligence proxy for the Chinese government.

There are several problems with this. While it's certainly possible that Huawei helps the Chinese government spy, there's been no hard evidence of this. In fact, numerous investigations (including one eighteen months long) found no evidence of any spying whatsoever. What inquiries did find is that these allegations pretty consistently originate with U.S. hardware vendors like Cisco, who routinely enjoy playing up the threat simply because they don't want to compete with Chinese hardware vendors. You know, the very same thing we routinely (often quite accurately) complain about China doing.

Despite no real evidence, a new Reuters report indicates this new pressure is much greater than just AT&T's smartphone partnership. In fact, the report suggests that the government is now urging all US telcos and ISPs to avoid using any Huawei gear whatsoever if they want to continue winning government contracts (and as an NSA BFF, AT&T has plenty of contracts to protect). From the report:

"The lawmakers are also advising U.S. firms that if they have ties to Huawei or China Mobile, it could hamper their ability to do business with the U.S. government, one aide said, requesting anonymity because they were not authorized to speak publicly.

One of the commercial ties senators and House members want AT&T to cut is its collaboration with Huawei over standards for the high-speed next generation 5G network, the aides said. Another is the use of Huawei handsets by AT&T’s discount subsidiary Cricket, the aides said.

And while Reuters mentioned that there have been investigations, it oddly forgets to mention what the outcome of those investigations were (again, zero evidence of spying). Also ignored is the fact that Chinese networking hardware is absolutely everywhere in the States, including being embedded in many of the products sold by U.S. manufacturers. If China wants to spy on America, it only need turn to the ocean of poorly secured IOT devices, the lion's share of which are now made in China by companies with a complete and total disinterest in anything even vaguely resembling security standards.

Similarly and comedically ignored is the fact the United States government engages in this kind of behavior all of the time. You might recal the NSA was caught intercepting Cisco hardware to install surveillance technology a few years ago. The Snowden documents also revealed how the NSA hacked into Huawei and stole company source code as early as 2007, all in the hopes of planting backdoors in network hardware used by countries who avoid buying American gear. Everyone but the most ardently myopic patriots realize that the United States' credibility on this subject was dismantled decades ago.

This latest wave of hysteria comes simultaneously and not-coincidentally as Representatives Michael Conaway and Liz Cheney introduced a bill banning US carriers from doing any business whatsoever with Huawei or ZTE Corp (two guesses on which companies are pushing for that law). Again, it's perfectly possible that Huawei helps the Chinese government spy. But if that's the case, it shouldn't be too difficult to provide some hard evidence supporting this position. Unless, of course, this is all little more than an adorable little stage play concocted simply to protect US hardware vendors from having to actually compete.

Filed Under: china, fcc, fud, house intelligence committee, surveillance, threats
Companies: at&t, huawei

Chinese Internet Users Start To Rebel Against Lack Of Online Privacy

from the just-a-blip-or-the-start-of-something-bigger? dept

We recently reported how China continues to turn the online world into the ultimate surveillance system, which hardly comes as a surprise, since China has been relentlessly moving in this direction for years. What is rather more surprising is that Chinese citizens are beginning to push back, at least in certain areas. For example, The New York Times reports on an "outcry" provoked by a division of the Alibaba behemoth when it assumed that its users wouldn't worry too much if they were enrolled automatically in one of China's commercially-run tracking systems:

Ant Financial, an affiliate of the e-commerce giant Alibaba Group, apologized to users on Thursday after prompting an outcry by automatically enrolling in its social credit program those who wanted to see the breakdown [of their spending made via Ant Financial's online payment system]. The program, called Sesame Credit, tracks personal relationships and behavior patterns to help determine lending decisions.

When one of China's business leaders complained publicly about the lack of privacy in China, and how Tencent's hugely-popular WeChat program spied on users, the company's denials were met with another outcry:

Tencent said that the company did not store the chat history of users and that it would never use chat history for big data analytics. The comments were met with widespread disbelief: WeChat users have been arrested over what they've said on the app, conversations have turned up as evidence in court proceedings, and activists have reported being followed based on WeChat conversations.

Meanwhile, the third of China's Big Three Internet companies -- Baidu -- has been hit with legal action over privacy concerns, reported here by Caixin:

Baidu Inc., China’s largest search-engine operator, is being sued by a consumer-protection organization that claims it collected users' information without consent, in the latest privacy dispute involving the country's tech giants.

Two mobile apps operated by New York-listed Baidu, a search engine and a web browser, could access a user's calls, location data, messages and contacts without notifying the user, the Jiangsu Consumer Council, a government-backed consumer rights association, claimed in a statement on its website.

The Chinese government may not worry too much about these calls for more privacy provided they remain directed at companies, since they offer a useful way for citizens to express their concerns about surveillance without challenging the state. It looks happy to encourage users to demand more control over how online services use their personal data -- so long as the authorities can still access everything themselves.

As well as government acquiescence in these moves, there's another reason why Chinese companies may well start to take online privacy more seriously. Аn article in the South China Morning Post points out that if Chinese online giants want to move beyond their fast-saturating home market, and start operating in the US and EU, they will need to pay much more attention to privacy to satisfy local laws. As Techdirt reported, an important partnership between AT&T and Huawei, China's biggest hardware company, has just been blocked because of unproven accusations that data handled by Huawei's products might make its way back to the Chinese government.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: china, internet, privacy, wechat
Companies: baidu, tencent

China Plans To Turn Country's Most Popular App, WeChat, Into An Official ID System

from the won't-that-be-convenient? dept

In one respect at least, China's embrace of digital technology is far deeper and arguably more advanced than that of the West. Mobile phones are not only ubiquitous, but they are routinely used for just about every kind of daily transaction, especially for those involving digital payments. At the heart of that ecosystem sits Tencent's WeChat program, which has around a billion users in China. It has evolved from a simple chat application to a complete platform running hugely popular apps that are now an essential part of everyday life for most Chinese citizens. The centrality of WeChat makes the following move, reported here by the South China Morning Post, entirely logical:

The government of Guangzhou, capital of the southern coastal province of Guangdong, started on Monday a pilot programme that creates a virtual ID card, which serves the same purpose as the traditional state-issued ID cards, through the WeChat accounts of registered users in the city's Nansha district, according to a report by state news agency Xinhua.

It said that trial will soon cover the entire province and further expand across the country from January next year.

The Wall Street Journal has some details of how people register:

Under the pilot program, funded by the National Development and Reform Commission, people create a basic identity card by scanning an image of their face into a WeChat mini program, reading aloud four numbers that pop up on the screen and entering their identification number as well as other information.

It obviously makes a lot of sense to use the WeChat platform to provide a virtual identity card. It's convenient for users who already turn to WeChat apps to handle most aspects of their lives. It means they don't need to carry around a physical ID card, but can let the software handle the necessary authentication when needed. That's also good news for businesses that want to confirm a person's identity.

But it's also an extremely powerful way for the Chinese government to implement its real-name policy for online activities, something that it has so far failed to push through. It will mean that the daily posts and transactions carried out using a mobile will not only be available to the Chinese authorities, but will be unambiguously linked to an individual once such digital IDs become obligatory for WeChat users, as they surely will. That, in its turn, will be very handy for implementing the proposed "citizen score" framework. Once this has been rolled out nationwide, it will form one of the most effective means of control available to the Chinese government, especially if combined with a similarly comprehensive plan to collect everyone's DNA.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: china, id card, identity, privacy, virtual id
Companies: wechat

Germany Accuses Chinese Intelligence Services Of Using Fake LinkedIn Profiles To Recruit Informants And Extract Sensitive Information

from the well,-of-course-it's-not-just-Russia dept

Over the last year, the scale of Russia's disinformation activities has become clearer. Its Internet Research Agency has deployed an astonishing range of sophisticated techniques, included accounts on Twitter and Facebook, and hiring activists within the US without the latter being aware they were working for the Russian government. We also now know that the same organization has been buying Facebook ads on a large scale that were seen by over a hundred million US citizens. But it would be naïve to think that Russia is the only foreign power engaged in this kind of activity. In fact, it would be surprising if any intelligence agency worth its salt were not carrying out similar activities around the globe. The first detailed information about China's use of fake social media accounts to recruit informants and extract sensitive information has just been published by the Bundesamt für Verfassungsschutz (BfV), Germany's domestic intelligence service. As Reuters reports:

Nine months of research had found that more than 10,000 German citizens had been contacted on the LinkedIn professional networking site by fake profiles disguised as headhunters, consultants, think-tankers or scholars, the BfV said.

Quartz quotes the BfV's president, Hans-Georg Maaßen, as saying:

"We are dealing with a broad attempt to infiltrate parliaments, ministries and administrations," said Maaßen. “Chinese intelligence services are using new strategies of attack in the digital space."

An interim report on the analysis that appeared on the BfV site in July (original in German) explains how the Chinese operated. The supposed headhunters, scholars and Chinese officials claimed that there were interested in the specialism of the person being approached. They inquired about a possible exchange of professional views on the topic, and spoke of an "important customer" in China:

the Chinese contact persons ask those involved for a curriculum vitae and offered to pay for a trial project. If this was completed satisfactorily, an invitation is made to go to China to meet with the "important customer", with the costs of the stay being covered by the Chinese side. In fact, however, the "important customer" never appears and is not explicitly named. In due course, the persons involved are usually asked regularly to write reports in return for appropriate remuneration, or to pass on internal, sensitive information from the respective work area.

As part of its report, the BfV published a selection of the fake profies. Reuters explains:

Many of the profile pictures show stylish and visually appealing young men and women. The picture of "Laeticia Chen", a manager at the "China Center of International Politics and Economy" was nicked from an online fashion catalogue, an official said.

The Chinese Foreign Ministry spokesman Lu Kang was, of course shocked by the accusations, which he called "baseless":

"We hope the relevant German organizations, particularly government departments, can speak and act more responsibly, and not do things that are not beneficial to the development of bilateral relations," Lu said.

The implicit threat there chimes with two other stories about China that Techdirt published last month. In one of them, the Chinese authorities put pressure on the academic publisher Springer Nature to censor thousands of papers that dealt with topics that showed China in a less than flattering light. Similarly, Allen & Unwin was "persuaded" by the Chinese authorities not to publish a book about China's growing but covert influence in Australia. The row between Australia and China has since escalated further. The latter denounced remarks by Australian politicians as being "full of prejudices against China", and lodged a formal protest. Taken with the latest news of China's attempts to recruit informants using social media, these recent events are evidence of a newly aggressive China on the world scene -- and of what The Economist calls China's "sharp power".

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: china, espionage, fake profiles, germany, surveillance
Companies: linkedin

China Is Building The Ultimate Surveillance Tool: A DNA Database Of Every Adult Resident In Troubled Xinjiang Region

from the purely-for-scientific-decision-making,-of-course dept

It's no secret that the two regions most affected by China's strict controls are Tibet and Xinjiang, the vast and troubled Western region where the turkic-speaking Uyghurs form the largest ethnic group. Earlier this year, we wrote about one fairly extreme surveillance technique in Xinjiang: a requirement for every vehicle there to be fitted with a tracking device. Now Human Rights Watch reports that an even more intrusive surveillance measure is being implemented for the region's 24 million inhabitants:

Chinese authorities in Xinjiang are collecting DNA samples, fingerprints, iris scans, and blood types of all residents in the region between the age of 12 and 65, Human Rights Watch said today. This campaign significantly expands authorities' collection of biodata beyond previous government efforts in the region, which only required all passport applicants in Xinjiang to supply biometrics.

For so-called "focus personnel" -- those individuals that the authorities consider a threat to political stability -- the biometrics will be taken from everyone in their family, regardless of age. Here's what all that highly-personal information from the "Population Registration Program" will be used for, according to the Chinese government:

Authorities state that the Population Registration Program is meant for "scientific decision-making" that promotes poverty alleviation, better management, and "social stability." Authorities have offered the annual Physicals for All program since 2016, characterizing it as a benefit for the relatively economically poor region. The program's stated goals are to improve the service delivery of health authorities, to screen and detect for major diseases, and to establish digital health records for all residents. Press reports about Physicals for All include testimonies from participants describing how they received treatments for previously undiagnosed illnesses, and in some cases saving their lives.

Who could possibly object to such a well-intentioned health initiative? But as Human Rights Watch emphasizes:

Coercing people to give blood samples, or taking blood samples without informed consent or justification can violate an individual's privacy, dignity, and right to bodily integrity; it can also in some circumstances constitute degrading treatment. Compelled DNA sampling of an entire region or population for purposes of security maintenance is a serious human rights violation in that it cannot be justified as necessary or proportionate.

It would be naïve to think that the authorities won't use this massive DNA database in order to increase their surveillance of the Uyghur population. DNA is the ultimate identity number. It is present in nearly every cell in the body; it is difficult to change in a non-random way unless you have lots of money and top-flight CRISPR scientists at your disposal -- unlikely in the case of Xinjiang residents; and we leave it everywhere we go, and on everything we touch. DNA also has the virtue -- for the authorities -- that it provides information about related individuals, since they all have some of their genetic code in common. That means it would be possible to determine everyone in the close family of a someone under investigation, by finding related DNA sequences. It's the kind of information that could be abused by the police in multiple ways.

As well as concerns about the human rights of Uyghurs being harmed, another issue is that Xinjiang's Population Registration Program may be used as a trial before rolling out DNA collection to the entire Chinese adult population, just as is happening with a national facial recognition database. Although such a large-scale genetic database would have been infeasible a few years ago, advances in sequencing and dramatic falls in data storage and processing costs mean that it could probably be built now. And if China goes down this route, the fear has to be other countries will follow, just as they are doing in the realm of online surveillance.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: china, dna, dna database, privacy, surveillance, xinjiang

Why Does China Love The 'Sharing Economy'? Not Because Of Communism...

from the if-you-rent-a-cheap-bike,-you-may-be-the-product dept

Something strange has been happening in China. People have been going nuts about bicycles. Specifically, investors have gone crazy over startups that allow people to rent bikes for a fraction of a dollar per hour, and then leave them anywhere, rather than only at special bike stations -- what is known as "dockless" bike-sharing. And now that sector is in trouble, as Bloomberg reports:

In the space of 18 months, dockless bike-sharing has become one of the hottest investment trends in China, with the two biggest players each having raised over $1 billion in venture funds, respectively. That money has funded a revolution on the traffic-choked streets of Chinese cities, giving urbanites a low-cost, carbon-free means to get around quickly. What it hasn't produced is a viable business model. A little over a year into China's bike-sharing boom, the industry's future looks precarious.

Given the extremely low margins, that's no surprise. What is more surprising is that billions of dollars have been invested in these startups, and in similar ones based on renting out everyday objects for short periods of time, letting people pay by using smartphones to scan in QR codes. Other examples include companies offering umbrellas, basketballs, refrigerators, luxury handbags, phone chargers, and even sex dolls (that one didn't last long). An illuminating article in the New York Times has a plausible explanation for China's fascination with the so-called "sharing economy", even though it has nothing to do with real sharing:

None of China's bike-sharing companies are turning a profit yet. But even as they fight for market share, the data is the destination. "Collecting data is the first goal of the sharing economy," says William Chou, the head of Deloitte's telecoms, media and technology practice in China. Every time consumers scan the QR code on a bicycle -- or basketball, handbag, umbrella -- they provide information about habits, locations, behaviors and payment histories. That's invaluable not just to [Chinese Internet giants] Tencent and Alibaba but also to city planners seeking precise information about where to build roads, bridges and subways.

In other words, these "sharing" services are conceptually similar to Facebook or Google: they are provided (nearly) free of charge, but you pay with detailed information about what you do. In the case of Facebook and Google, it's data about your online activities; for the "sharing economy", it's about what you do in the physical world. That's highly prized by companies that want to sell something to people. In China, it's also of great interest to someone else -- the government:

what happens as this data filters into China's new social-credit system, which promises to rate every individual by her financial, social and political worth? In fact, Beijing has authorized Tencent and Alibaba to conduct social-credit pilot testing, and their bikes serve as the perfect vehicles. There are no walls of privacy. The government has the ability to access company data, good or bad, faster than you can scan a QR code.

The ability of "sharing" companies to capture, and governments to access, highly-personal data is an important issue for potential customers in the West, which currently lags behind China in the uptake of these kinds of services. However convenient some of them seem, it's worth considering whether you may be paying more than just the attractively-low fees when you use them.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: china, sharing, sharing economy

Professor Says Threats Of Retaliation By China Stopped Publication Of His Book Revealing Chinese Influence In Australia

from the expect-much-more-of-this dept

We've just written about how the Chinese government wanted to censor articles published by two academic publishers, Cambridge University Press (CUP) and Springer. After an initial wobble, CUP ultimately refused, while Springer by contrast decided to kowtow to the authorities. Those incidents concerned the publication in China of articles the Chinese didn't like. Now it seems the latter are extending their campaign against inconvenient facts to other countries, in this case Australia:

Prominent Charles Sturt University academic Clive Hamilton said Allen & Unwin was ready to publish his manuscript Silent Invasion, but last week informed him it could no longer proceed because it was worried about defamation action.

"Allen & Unwin said that they were worried about retaliation from Beijing through a number of possible avenues including legal threats, orchestrated by Beijing, and they decided it was too big a risk and so therefore pulled the plug and returned the rights to me," Professor Hamilton said.

As the article on ABC News explains, "Silent Invasion" is about the Chinese Communist Party's activities and growing influence in Australia -- obviously a highly sensitive topic for China. In an email to the company, obtained by ABC News, Professor Hamilton's former publishers, Allen & Unwin, wrote about what it saw as "potential threats" if it published his book:

The most serious of these threats was the very high chance of a vexatious defamation action against Allen & Unwin, and possibly against you personally as well.

It's a little hard to see how an entire nation might sue successfully for defamation, but that's not the point. Once again, the mere threat of litigation was enough to cause someone -- in this case a publisher -- to self-censor. Interestingly, the ABC News article notes that the Australian government is expected to unveil soon new legislation to counter foreign interference in the country, which suggests that it is becoming a serious problem. We can expect more such attempts to censor overseas sources of information it doesn't like from the increasingly self-confident and intransigent China.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: australia, censorship, china, clive hamilton, silent invasion, threats
Companies: allen & unwin