Theresa May Again Demands Tech Companies Do More To Right The World's Social Media Wrongs

from the in-return,-politicians-promise-to-provide-more-bad-legislation dept

In the face of "extremist" content and other internet nasties, British PM Theresa May keeps doing something. That something is telling social media companies to do something. Move fast and break speech. Nerd harder. Do whatever isn't working well already, but with more people and processing power.

May has been shifting her anti-speech, anti-social media tirades towards the Orwellian in recent months. Her speeches and platform stances have tried to make direct government control of internet communications sound like a gift to the unwashed masses. May's desire to bend US social media companies to the UK's laws has been presented as nothing more than as a "balancing" of freedom of speech against some imagined right to go through life without being overly troubled by social media posts.

Then there's the terrorism. Terrorists use social media platforms to connect with like-minded people. May would like this to stop. She's not sure how this should be accomplished but she's completely certain smart people at tech companies could bring an end to world terrorism with a couple of well-placed filters. So sure of this is May that she wants "extremist" content classified, located, and removed within two hours of its posting.

May's crusade against logic and reality continues with her comments at the Davos Conference. Her planned speech/presentation contains more of her predictable demand that everyone who isn't a UK government agency needs to start doing things better and faster.

Although she is expected to praise the potential of technology to "transform lives", she will also call on social media companies to do much more to stop allowing content that promotes terror, extremism and child abuse.

She will say: "Technology companies still need to go further in stepping up to their responsibilities for dealing with harmful and illegal online activity.

"These companies simply cannot stand by while their platforms are used to facilitate child abuse, modern slavery or the spreading of terrorist and extremist content.

"We need to go further, so that ultimately this content is removed automatically. These companies have some of the best brains in the world. They must focus their brightest and best on meeting these fundamental social responsibilities."

"Go further…" but to what point? This is all May has said for years. Social media companies continue to struggle with moderating content, but it's not for a lack of trying. They're dealing with contradictory demands from multiple world governments, each of them declaring different types of speech to be unacceptable. The pressure isn't imaginary. Twitter has taken proactive measures in response to Germany's new hate speech law, resulting in some spectacular collateral damage. Other platforms are doing the same thing, even if the damage hasn't been as ironically glorious.

May wants harder nerding, up to and including all-knowing bots that kill objectionable content before it reaches human eyeballs. She wants the impossible. Even if it were theoretically possible to police speech better with AI, that's still years away from being the deployed at scale. Efforts that have been deployed have been routinely disastrous. Ask anyone how YouTube's Content ID is doing handling copyright infringement and you'll get a general idea of just how well algorithms police content.

For now, the problem is handled by a mixture of algorithms, human moderators, and crowd sourcing. The algorithms can't reliably target unwanted content. The humans are, well, human -- prone to error and bias. The last part -- reporting functions for users -- basically give every heckler a veto button, resulting in abuse of the system to bury content certain users don't want to see. All these efforts work well for the governments demanding them -- and these governments are the entities most likely to abuse them to silence dissent.

This is what the argument has been reduced to: calls for "more" without any interest in determining whether "more" will be helpful or even possible. The result will be the suppression of speech, rather than a victory over terrorism.

Filed Under: censorship, filtering, magic wand, social media, tech companies, theresa may

To Avoid Being Cut Out Of The Market, US Tech Companies Are Allowing Russian Vetting Of Source Code

from the backdoors-for-all dept

Nobody trusts anybody, and it's probably going to end up affecting end users the most. The Snowden leaks showed the NSA's Tailored Access Operations routinely intercepted network hardware to insert backdoors. The exploits leaked by the Shadow Brokers indicated the NSA was very active on the software exploit front as well.

In response to the Snowden leaks, it appears the Russian hardware/software purchasers are stepping up their due diligence efforts. This comes at a time when the Russian government is suspected of hacking away at the American democratic process, as Reuters reports.

Russian authorities are asking Western tech companies to allow them to review source code for security products such as firewalls, anti-virus applications and software containing encryption before permitting the products to be imported and sold in the country. The requests, which have increased since 2014, are ostensibly done to ensure foreign spy agencies have not hidden any "backdoors" that would allow them to burrow into Russian systems.

According to the article, multiple US officials and company executives are tracing the uptick in review demands to a downturn in US-Russian relations following Russia's 2014 annexation of Crimea. But the NSA's hardware operations were exposed in mid-2014, so it's hard to believe the Snowden effect isn't in play.

[Some] reviews are… conducted by the Federal Service for Technical and Export Control (FSTEC), a Russian defense agency tasked with countering cyber espionage and protecting state secrets. Records published by FSTEC and reviewed by Reuters show that from 1996 to 2013, it conducted source code reviews as part of approvals for 13 technology products from Western companies. In the past three years alone it carried out 28 reviews.

Since these companies aren't willing to give up their share of an $18.4 billion market, compromises are being made. Examinations of code are being done in "clean rooms," with conditions somewhat controlled by the companies being vetted. But this isn't always the case. Nor are these precautions necessarily enough to prevent those doing the vetting -- some linked to the Russian government -- from finding undiscovered security holes and flaws. The vetting may help keep Russian government agencies and private companies from being spied on by the US, but it's not going to do much to keep the Russian government from spying on Russian companies and Russian computer users.

So far, only one company has publicly announced its refusal to submit its software for vetting. Symantec has rejected testing by Echelon, a Moscow-based lab with some tenuous ties to the Russian military.

But for Symantec, the lab "didn't meet our bar" for independence, said spokeswoman Kristen Batch.

“In the case of Russia, we decided the protection of our customer base through the deployment of uncompromised security products was more important than pursuing an increase in market share in Russia,” said Batch, who added that the company did not believe Russia had tried to hack into its products.

The company also provides testing for the Russian Ministry of Defense and multiple law enforcement agencies. Echelon claims it's wholly independent from the Russian government, but those assertions haven't been enough to overcome Symantec's objections. Other companies (the article lists HP and IBM) have allowed their products to be tested by Echelon, but neither were willing to comment on this story.

The Russians are checking for US backdoors while potentially seeking to install their own. US companies are given the choice of possibly aiding in Russian domestic surveillance or being locked out of the market. Any lost sales here can at least be partially chalked up to the Snowden leaks. If so, the fallout from the leaks is still causing harm to US companies, years down the road.

Filed Under: russia, source code, tech companies

Tech Companies Continue To Tell Courts To Reject Trump Travel Exec Order

from the speaking-up dept

Earlier this week we noted that 162 tech companies (including us) had signed an amicus brief for the appeal in the 4th Circuit (in Virginia) arguing that President Trump's travel ban executive order was unlawful. The same group of companies (plus one more -- as it looks like Pandora was added to the latest) have filed basically the same amicus brief in the appeal in the 9th Circuit (which is the appeal of the decision in Hawaii that a smaller group had filed an amicus brief on as well). As with last time, people are going to come up with all sorts of conspiracy theories over this, but the fact is this is an issue that matters to many, many people who work at these companies, and the companies have committed to speaking out about it.

Filed Under: donald trump, executive order, immigration, tech companies, travel ban

162 Tech Companies Tell Appeals Court That Trump's 2nd Travel Ban Is Illegal

from the speaking-up dept

As you'll recall, back in early February, over 100 tech companies signed onto an amicus brief, arguing that President Trump's initial plan to bar immigration from certain countries was unconstitutional and illegal. A month later, a smaller group of companies signed onto an amicus brief in the district court in Hawaii concerning the revised travel ban (and a few people noted that some of the companies that signed onto the first brief had not signed onto the second one -- wondering if that meant many companies weren't as worried about the revised ban. Except, yesterday an even larger group of tech companies (162 in total) signed onto a new amicus brief for the 4th Circuit court of appeals which is the next appeals court hearing a case on the revised travel ban. And, yes, we at the Copia Institute signed onto this one as well (we also signed onto the first two).

It seems likely that some companies just sat out the Hawaii case because it's in a district court, and amicus briefs aren't always as welcome in district courts, and some lawyers view them as wasteful at that stage. Amicus briefs tend to really only matter in appeals courts (or, of course, the Supreme Court). You can read the full brief here (or below), as it makes the case that even the revised ban doesn't solve the problems of the original ban. It's worth reading carefully. It's good to see all of these companies continue to stand up for what's right, especially when it would be easy to sit back, do nothing, and play nice with the new administration.

And, because I know that some people will insist that the only reason that tech companies have signed onto this is because it gets them cheap labor or some other such criticisms, I can assure you that in many cases, the participation in these amicus briefs is being driven by the employees at these companies, demanding that management stand up and speak out, rather than a top down decision. Many people feel strongly -- as I do -- that being a country that is welcoming to immigrants is an important part of being American. No one's arguing that there shouldn't be background checks and "vetting" and the like -- but the executive order goes way beyond that.

Filed Under: donald trump, immigration, tech companies, travel ban

Tech Companies File Amicus Brief, Still Opposed To New Trump Immigration Order

from the same-problems dept

Last month, we noted that a ton of tech companies -- including us at the Copia Institute -- had signed on to amicus brief opposing the Trump Executive Order on immigration. As you know, the administration came out with a new executive order a few weeks later, trying to get around the multiple courts that had blocked the original order. The new order is just a cosmetic rewriting of the original one with a few small changes that the administration hopes will survive judicial scrutiny. A number of challenges have already been filed to the new order, and in one of them, brought by the state of Hawaii, a bunch of tech companies (again, including the Copia Institute) have now filed an amicus brief opposing the order. In particular, this brief focuses on the harms to the tech industry, including actual examples of harms created by this exec order:

• A U.S. resident employed at a cutting-edge software company fears that he cannot leave the U.S. because he is a national of a Muslim majority country targeted by President Trump’s travel ban. If he attempts to travel outside the country, he could be detained and refused re-entry. After the travel ban went into effect, he canceled plans to bring his mother to the U.S. to visit him, out of concern that she might be detained or turned away. He has not been home for five years. The U.S. company he works for, which employs over 100 people and has raised hundreds of millions of dollars in capital, was founded by an immigrant.
• A high-tech, U.S.-based software company devoted significant resources to an event it scheduled in February 2017 where it planned to host owners of small businesses and tech start-ups based overseas. Before these entrepreneurs became business and start-up owners, they were Syrian refugees. After President Trump’s travel ban went into effect on January 27, 2017, the event was abruptly postponed, because the guests were unable to travel to the U.S. on account of their status as Syrian refugees. The U.S.- based software company plans to reschedule the event at a location outside the U.S., so the Syrian refugees and entrepreneurs can safely attend.
• A U.S.-based mobile app and website development company with millions of users worldwide employs U.S. residents who are nationals of the Muslim-majority countries targeted by President Trump’s travel ban. In late January and February 2017, some of these employees had planned to fly outside the U.S. for business or personal reasons. Since the travel ban was announced, these employees canceled their flights for fear they would be detained or not permitted to re-enter the U.S.
• A U.S.-based technology company courted promising job candidates overseas and was prepared to offer them employment when the prospects suddenly withdrew from consideration because they were worried about immigration issues in light of President Trump’s travel ban.
• After the implementation of President Trump’s travel ban, foreign born founders of a U.S.-based technology company began exploring the possibility of moving their company outside of the U.S.—and taking the company’s jobs with them.

The filing goes through the history of the initial ban, and then notes that the new version is still just as bad:

President Trump’s new travel ban is no different. It will inflict the same substantial and irreparable harm upon U.S. companies and their employees. And in implementing the promise of a “Muslim ban,” the new travel ban suffers from many of the same defects as the first travel ban. It violates the prohibition against nationality-based discrimination that Congress established through the Immigration and Nationality Act. It exceeds the authority granted to the Executive. It is arbitrary and overbroad in scope. And it impermissibly discriminates on the basis of religion and deprives individuals of Due Process rights, thus violating the U.S. Constitution. In sum, President Trump’s new travel ban has not overcome the constitutional and legal deficiencies that led courts to enjoin his first travel ban. Accordingly, the new travel ban should meet the same fate as the first travel ban— it should be enjoined nationwide.

This amicus brief is at the district court level, so it's still quite early in the process -- and there are other legal challenges in other courts. This will still take a while to sort itself out, but we're proud to stand alongside others in the industry in speaking up for why these immigration executive orders are illegal and unconstitutional, not to mention bad for innovation and the economy.

Update: Oh, and just an hour or so after I posted this, the judge has granted a temporary restraining order, blocking the executive order from going into effect...

Filed Under: donald trump, hawaii, immigration, tech companies
Companies: copia institute

Rather Than Coming Up With Brand New Taxes For Tech Companies, The EU Just Issues A Massive Fine On Apple

from the double-irish-with-a-dutch-sandwich dept

For quite some time now, we've seen EU regulators talk fairly openly about their desires to harm American internet companies, mostly in a misguided attempt to boost local European companies (and to collect more money). It's why we keep hearing about weird, carefully targeted regulations designed to pump up how much money companies like Google, Apple and others pay.

At the same time, parts of Europe (Ireland, in particular) have been doing basically everything they can think of to woo American tech companies. Ireland has successfully offered ridiculously friendly policies, leading many large internet companies to set up offices in Dublin, and then use that as the place where they "recognize" all their revenue. There are a variety of tax dodges employed here, which go by fun names like Dutch Sandwich and Double Irish.

US Companies have been doing this for many years, and while it (frankly) looks pretty sleazy, they do seem to mostly play by the rules. We can argue over whether or not the tax breaks they get are worth it, but the whole thing just feels sketchy in that it's clearly playing some jurisdictional games to get lower tax rates. Of course, there's also been another looming issue on all of this, which is that these giant internet companies have been pushing heavily to be able to get the cash that they've been accumulating in Ireland back into the US, without then having to pay all those taxes on it. So they've been pushing for some sort of "amnesty" period or "holiday" where they can bring the cash back in.

Frankly, the whole thing is a little ridiculous. With so much money on the line, you can see why these companies play games, but that still doesn't make it right. The internet giants often seem to put this issue at the top of their lobbying priority list, and that's unfortunate. The thing that I like about Silicon Valley is that much of the industry comes from actually creating new and useful things and building stuff up. Playing tax dodging games is the opposite of that. It's playing political games and it feels super counterproductive.

Now, add on top of that the fact that the EU has realized that rather than just create new laws that will tax internet giants, it can just go ahead and hit Apple with a massive tax increase all by itself.

Apple Inc. was ordered to pay as much as 13 billion euros ($14.5 billion) plus interest after the European Commission said Ireland illegally slashed the iPhone maker’s tax bill, in a record crackdown on fiscal loopholes that also risks inflaming tensions with the U.S.

The world’s richest company benefited from selective tax treatment that gave it an unfair advantage over other businesses, the European Union regulator said Tuesday. It’s the largest tax penalty in a three-year campaign against corporate tax avoidance. Apple and Ireland both vowed to fight the decision in the EU courts.

No one comes out of this looking very good. The tech companies playing tax haven games look bad -- even if you think the tax rate is too high and they should be trying to get it lowered. The EU government looks typically jealous and petty towards American companies. And of course, people are already talking about a possible trade war over this issue.

Frankly, I'd much rather tech companies be focused on innovation in their products, rather than in their tax strategies.

Filed Under: eu, ireland, tax, tax avoidance, tech companies
Companies: apple

US Government Has Apparently Demanded, And Obtained, Tech Companies' Source Code In The Past

from the ask-(FISC_)-and-ye-shall-receive dept

From Zack Whittaker at ZDNet comes the alarming revelation that it's not just Apple looking at possibly having to turn over its source code and/or encryption keys to the government, much like what happened to Lavabit. Many other companies have done this previously as the result of orders granted by the nation's most opaque, non-adversarial court.

The US government has made numerous attempts to obtain source code from tech companies in an effort to find security flaws that could be used for surveillance or investigations.

The government has demanded source code in civil cases filed under seal but also by seeking clandestine rulings authorized under the secretive Foreign Intelligence Surveillance Act (FISA), a person with direct knowledge of these demands told ZDNet. We're not naming the person as they relayed information that is likely classified.

With these hearings held in secret and away from the public gaze, the person said that the tech companies hit by these demands are losing "most of the time."

That's hardly heartening. The DOJ would only go so far as to confirm this has happened before, likely because there's no way to deny it. The documents from the Lavabit case have been made public -- with the DOJ using a formerly-sealed document to hint at what could be in store for Apple if it refuses to write FBiOS for it.

Unfortunately, because of the secrecy surrounding the government's requests for source code -- and the court where those requests have been made -- it's extremely difficult to obtain outside confirmation. Whittaker contacted more than a dozen Fortune 500 companies about the unnamed official's claims and received zero comments.

A few, however, flatly denied ever having handed over source code to the US government.

Cisco said in an emailed statement: "We have not and we will not hand over source code to any customers, especially governments."

IBM referred to a 2014 statement saying that the company does not provide "software source code or encryption keys to the NSA or any other government agency for the purpose of accessing client data." A spokesperson confirmed that the statement is still valid, but did not comment further on whether source code had been handed over to a government agency for any other reason.

Cisco is likely still stinging from leaked documents showing its unwitting participation in an NSA unboxing photo shoot and has undoubtedly decided to take a stronger stance against government meddling since that point. As for IBM, its statement is a couple of years old and contains a major qualifying statement.

Previously-leaked documents somewhat confirm the existence of court orders allowing the NSA to perform its own hardware/software surgery. Presumably, the introduction of backdoors and exploits is made much easier with access to source code. Whittaker points to a Kaspersky Lab's apparent discovery of evidence pointing to the NSA being in possession of "several hard drive manufacturers'" source code -- another indication that the government's history of demanding source code from manufacturers and software creators didn't begin (or end) with Lavabit.

The government may be able to talk the FISA court into granting these requests, given that its purview generally only covers foreign surveillance (except for all the domestic dragnets and "inadvertent" collections) and national security issues. The FBI's open air battle with Apple has already proceeded far past the point that any quasi-hearing in front of the FISC would have. That's the sort of thing an actually adversarial system -- unlike the mostly-closed loop of the FISA court -- tends to result in: a give-and-take played out (mostly) in public, rather than one party saying "we need this" and the other applying ink to the stamp.

Filed Under: doj, fbi, fisa, fisa court, fisc, privacy, security, signing keys, software, source code, tech companies

FBI's Scorched Earth Approach To Apple Means That Tech Companies Now Have Even Less Incentive To Help Feds

from the stupid-and-shortsighted dept

On Friday, we debunked a key FBI talking point, which the press has been parroting, that Apple had helped the FBI in 70 previous cases, and only changed its mind now for "marketing" or "business model" reasons. As we explained, that's not even remotely true. In the past, Apple helped out because it had access to the content, and so it got it and turned it over following a lawful search warrant/court order. In this case, the situation is entirely different. Apple does not have access to the content that the FBI wants, and is now being forced to create a backdoor -- build an entirely revamped operating system -- that undermines some key security features found on iPhones today. That's quite different.

But here's something we didn't point out -- but which was highlighted by Chris Soghoian. The FBI's scorched earth policy here in pushing that talking point is really going to backfire in a big bad way. The lesson the entire tech industry is going to get from this is: if you ever help the FBI and if you ever push back later, they'll use your earlier cooperation against you.

Tech companies: If you provide any voluntarily assistance to the gov, they will use that help against you if you try to fight a demand later

— Christopher Soghoian (@csoghoian) February 19, 2016

Indeed, the FBI is going on and on in the press and in court filings pointing to those "previous" times, as if it's proof that Apple has suddenly "changed its mind" for "marketing" reasons. From the motion to compel on Friday: Given all that, why would any tech company voluntarily help the FBI going forward? It's only going to be used against them if they ever protest an overbroad request. We keep hearing government folks say that Silicon Valley has to stop treating the government as an adversary -- and I think the only proper response to that is: you first.

Filed Under: doj, encryption, fbi, going dark, help, tech companies
Companies: apple

UK Legislators Want To Toss Tech Company Officials In Jail If They Inform Users About Government Surveillance Efforts

from the this-won't-make-it-far dept

Default mode at tech companies these days is to inform users of government surveillance. Unless explicitly forbidden to do so, multiple companies have stated they will inform users of requests for data or suspected state-sponsored hacking attempts.

The mechanisms inherent in US law usually prevent notification. Requests made by foreign governments, however, operate in a much grayer area. UK legislators are trying to close perceived loopholes with new legislation that would make it illegal to notify users of UK agencies' requests for data. (via Boing Boing)

Bosses at Twitter and other communications companies face up to two years in prison if they tip off customers that spies or the police are monitoring them under a proposed new law.

Ministers want to make it a criminal offence to notify the subject of a surveillance operation that requests of their data have been made, unless expressly allowed.

The move follows concerns some communications and social media firms will alert users if MI5, MI6, GCHQ or the police have asked for their records.

Even if this dubious proposal becomes law, it's unclear exactly how the UK plans to enforce this. Does it send cops to arrest the top exec at the offending company? Or would it go after a lower-level representative -- one that hopefully resides in UK to better avoid the diplomatic awkwardness of extradition proceedings? In all likelihood, if this proposal survives, the jail term will be replaced with a suitably large fine.

This stipulation has been added to the draft version of the Investigatory Powers Bill -- another attempt to broaden the UK's surveillance powers while codifying the quasi-legal spy efforts GCHQ and others already engage in.

This addition would close the "loophole" tech companies are using by shifting the legal burden. Tech companies say they'll notify users unless "expressly forbidden" to do so. The draft bill addition says companies can only notify users if they're "expressly permitted" to do so. With everything hanging on the government's permission, agencies will rarely have to provide justification for secrecy. Instead, the onus will be on tech companies to remain tight-lipped unless the UK government gives them the nod -- something that will undoubtedly be a rarity.

On the plus side, it's not just tech companies being targeted by additions to the draft bill. Similar consequences await those who abuse their surveillance powers.

The bill also proposes a new offence of knowingly or recklessly obtaining communications data without lawful authority.

The measure is aimed at ensuring those officials, officers and spies who access the personal data do so legitimately and appropriately.

Those who break the law will also face up to two years in prison.

Of course, enforcement of this proposed addition sounds just as unlikely as UK police officers handcuffing Google execs for informing a surveillance target of the UK government's interest in them.

I'd say we'll just have to wait and see, but the draft bill is becoming a dumping ground for every wild-eyed legislator's idea on how to better "secure" the UK against the threat of terrorism. There are certainly more, equally-terrible ideas on the way. The only hope is that most of these will be discarded as the bill moves forward. It's a given that far too many bad ideas will still survive, but with any luck, the worst suggestions won't make it into the final version.

Filed Under: gag orders, surveillance, tech companies, uk

China Makes Big Push To Get American Tech Companies To Agree To Its Rules

from the this-is-getting-interesting dept

China is a big -- and quite appealing -- market. I think just about everyone recognizes that. But it's also a troubling market for a variety of reasons, and American tech companies have struggled with how to handle China. Beyond the fact that China often requires American firms to "partner" with a local Chinese firm, China often helps local firms get a leg up on American firms. And, then, of course, there's the whole "Great Firewall" censorship issue, and concerns about the Chinese government's desire for greater surveillance powers. Google famously left China about five years ago after it got tired of pressure to change its search results. However, just recently it was reported that Google has (at least somewhat) caved to China with a plan to bring a censored version of the Android Play store to China.

On the flipside, however, after years of appearing somewhat hostile to American tech firms, China is now making a big push to "open" its doors to those companies -- but with a few conditions baked in. It appears that China recognizes that it's in the power position with American tech companies, and it's going to use that to its advantage. China's President Xi Jinping is making his first state visit to the US shortly, and the Chinese government surprised (and annoyed) a bunch of folks by announcing that it is hosting its own tech/internet forum in Seattle, inviting basically all the big US tech firms: Apple, Microsoft, Facebook, Google, Uber, IBM and more. Apple's Tim Cook is likely to appear.

Apparently the White House isn't at all happy about this, as it was planning to use the visit to put pressure on China over its online spying and its anti-competitive practices against US companies. Having those very same US companies slobbering all over Chinese politicians that same week sort of takes away from the White House's talking points.

The meeting is rankling the Obama administration by veering off the script agreed to for Mr. Xi’s carefully stage-managed visit, two American officials said. There are also concerns the meeting could undercut President Obama’s stern line on China by portraying its leadership as constructively engaging American companies about doing business in China, even as the administration suggests American companies are hurt by anticompetitive Chinese practices.

And then there's... "the pledge." China is pushing US tech firms to sign this pledge to commit to certain data practices if they're to operate in China. It's believed that China is hoping to highlight companies signing the pledge at that forum. And if you look at the basic text of the pledge, much of it looks and sounds like really good things. The kinds of things companies should be proud to do and users should be happy to see companies commit to. It includes things like making sure users have control over their own data, that companies are clear and transparent in how that data is used, and that they can stop allowing companies to use their data. It also requires companies not to "install hidden functionalities" that users are unaware of inside products.

But it's really the last two items that everyone knows are the key here, and where China is really trying to flex its power. They're both worded somewhat innocuously, such that they might sound fine after a quick read, but it's the details that concern people.

Guarantee the security of user information. To employ effective measures to guarantee that any user information that is collected or processed isn't illegally altered, leaked, or used; to not transfer, store or process any sensitive user information collected within the China market outside China's borders without express permission of the user or approval from relevant authorities.

Accept the supervision of all parts of society. To promise to accept supervision from all parts of society, to cooperate with third-party institutions for assessment and verification that products are secure and controllable and that user information is protected etc. to prove actual compliance with these commitments.

The first one is a big concern because it's saying all data has to be kept within China. While it's likely that some companies would want to keep data within China, there are also good reasons to keep the data elsewhere -- including to protect users from the prying eyes of the Chinese government. And, of course, many other countries have been pushing for these kinds of "localization" requirements that actually take away many of the advantages of a global internet.

The second point above is the really concerning one, and all of the concern is focused on the single word: "controllable." Many are taking this to mean you're agreeing to backdoor encryption for the Chinese government. In the past few months, China has been much more aggressive in pushing for backdoors to encryption, and this is the next step in that process.

This is why it's actually more important than ever for the Obama administration to stop twiddling its thumbs over the issue of backdoors, and to come out with a clear and strong position that it is absolutely against backdoors, because that harms the public and puts them at risk. Anything less than that will clearly give the Chinese extra cover in pushing US tech companies to give them backdoors.

Either way, how American tech companies deal with China over the next few years is going to be an increasingly important issue, and so far, it seems like China has the upper hand, while the US is still struggling to come up with a coherent policy.

Filed Under: china, encryption, markets, privacy, tech companies