Hacking for ca$h

Is China still stealing Western IP?

Introduction

In September 2015, following mounting pressure exerted by the US on China, Chinese President Xi Jinping agreed to a US proposal that neither country would steal the other’s intellectual property (IP) for commercial gain. This bilateral agreement was quickly expanded when the US succeeded in inserting similar language into the November 2015 G20 communique. A handful of other countries also pursued their own bilateral agreements.

Three years after the inking of the US–China agreement, this report examines China’s adherence to those agreements in three countries: the US, Germany and Australia. This work involved a combination of desktop research as well as interviews with senior government officials in all three countries.

The rationale for this multi-country report was to examine patterns and trends among countries that had struck agreements with China.

In all three countries, it was found that China was clearly, or likely to be, in breach of its agreements. China has adapted its approach to commercial cyber espionage, and attacks are becoming more targeted and use more sophisticated tradecraft. This improved tradecraft may also be leading to an underestimation of the scale of ongoing activity.

Despite initial hopes that China had accepted a distinction between (legitimate) traditional political–military espionage and (illegal) espionage to advantage commercial companies, assessments from the three countries suggest that this might be wishful thinking.

China appears to have come to the conclusion that the combination of improved techniques and more focused efforts have reduced Western frustration to levels that will be tolerated. Unless the targeted states ramp up pressure and potential costs, China is likely to continue its current approach.

United States

By Adam Segal

In September 2015, presidents Barack Obama and Xi Jinping stood next to each other and declared that neither the US nor the Chinese government ‘will conduct or knowingly support cyber-enabled theft of intellectual property, including trade secrets or other confidential business information for commercial advantage’.1 Despite significant scepticism about whether China would uphold its pledge, cybersecurity companies and US officials suggested that the number of attacks did in fact decline
in the first year of the agreement. China inked similar deals with Australia, Canada, Germany and the UK, and, in November 2015, China, Brazil, Russia, the US and other members of the Group of Twenty accepted the norm against conducting cyber-enabled theft of IP.2 The agreement has been held up as evidence that a policy of public ‘naming and shaming’ tied to a threat of sanctions can change state actions, and as a success by the US and its allies in defining a norm of state behaviour in cyberspace.

There is, however, increasing evidence that Chinese hackers re-emerged in 2017 and are now violating both the letter and the spirit of the agreement. CrowdStrike, FireEye, PwC, Symantec and other companies have reported attacks on US companies, and the Trump administration has claimed that ‘Evidence indicates that China continues its policy and practice, spanning more than a decade, of using cyber intrusions to target US firms to access their sensitive commercial information and trade secrets.’3 The initial downturn in activity appears less to be the result of US pressure and more of an internal reorganisation of cyber forces in the People’s Liberation Army (PLA). Moreover, it’s increasingly clear that the number of attacks isn’t the correct metric for the Sino-US cyber relationship. A decline in the number of attacks doesn’t necessarily mean a decrease in their impact on US economic interests, as Chinese operators have significantly improved their tradecraft.

Washington and its allies will soon have to decide what they’re going to do (again) about Chinese industrial cyber espionage. The Trump administration’s approach so far has been indirect, raising China-based hacking in the context of a larger critique of Beijing’s industrial policy and failure to protect IP. Without significant pushback, China is likely to believe that it has reached a new equilibrium with Washington defined by an absolute smaller number of higher impact cyber operations.

The challenge of industrial cyber espionage

For at least a decade and a half, Chinese hackers have conducted a widespread campaign of industrial cyber espionage, targeting private sector companies in an effort to steal IP, trade secrets and other information that could help China become economically more competitive. President Xi has set the goal for China to become a ‘world leading’ science and technology power by 2049, and the country has significantly ramped-up spending on research and development, expanded enrolment in science, technology, engineering and mathematics disciplines at universities, and pushed industrial policy in areas such as semiconductors, artificial intelligence and quantum computing. However, the country also continues to rely on industrial espionage directed at high-technology and advanced manufacturing companies. Hackers have also reportedly targeted the negotiation strategies and financial information of energy, banking, law, pharmaceuticals and other companies. In 2013, the Commission on the Theft of American Intellectual Property, chaired by former Director of National Intelligence Admiral Dennis Blair and former US Ambassador to China Jon Huntsman, estimated that the theft of IP totalled US$300 billion (A$412 billion, €257 billion) annually, and that 50–80% of thefts
were by China.4

The US responded to state-sponsored Chinese cyberattacks with a two-step process. First, Washington created a distinction between legitimate espionage for political and military purposes and the cyber-enabled theft of IP. As President Obama framed it:

Every country in the world, large and small, engages in intelligence gathering. There’s a big difference between China wanting to figure out how can they find out what my talking points are when I’m meeting with the Japanese which is standard and a hacker directly connected with the Chinese government or the Chinese military breaking into Apple’s software systems to see if they can obtain the designs for the latest Apple product. That’s theft. And we can’t tolerate that.5

Espionage against defence industries, such as the theft of highly sensitive data related to undersea warfare, first reported in June 2018, would be considered legitimate, and the onus would be on the defender to keep hackers out of its systems.6

Second, Washington directly and increasingly publicly confronted Beijing. In the winter of 2013, the incident response firm Mandiant, now part of FireEye, put out a report tracing cyber espionage on American companies to Unit 61938 of the PLA, located in a building on the outskirts of Shanghai.7 A few days later, the Department of Homeland Security provided internet service providers with the IPs of hacking groups in China. In March 2013, at a speech at the Asia Society, National Security Advisor Tom Donilon spoke of ‘serious concerns about sophisticated, targeted theft of confidential business information and proprietary technologies through cyber intrusions emanating from China on an unprecedented scale’.8 When the two met at Sunnylands in June 2013, then President Obama warned President Xi that the hacking could severely damage the bilateral relationship.

In May 2014, the Federal Bureau of Investigation indicted five PLA hackers for stealing the business plans and other IP of Westinghouse Electric, United States Steel Corporation and other companies.9 In April 2015, the President signed an executive order that would allow for economic sanctions against companies or individuals that profited from the ill-gotten gains of cyber theft. The order threatened to block financial transactions routed through the US, limit access to the US market and prevent company executives from travelling through the US. The Washington Post reported in August 2015 that the administration planned to levy those sanctions against Chinese companies.10 Worried that sanctions or indictments would cast a pall over the September presidential summit, Meng Jianzhu, a member of the political bureau of the Central Committee of the Chinese Communist Party, flew to Washington to make a deal.

First year decline

In the first year, the available evidence suggested that Beijing was upholding the agreement and that the overall level of Chinese hacking had declined. FireEye released a report in June 2016 that showed the number of network compromises by the China-based hacking groups that it was tracking dropping from 60 in February 2013 to fewer than 10 by May 2016.11 However, FireEye noted that Chinese hackers could drop the total number of attacks while increasing their sophistication. Around the same time, US Assistant Attorney General John Carlin confirmed the company’s findings that attacks were fewer but more focused and calculated.

As the report also noted, the decline began before September 2015, undermining the causal link between US policy and Chinese behaviour. There were two internal factors in play. First, soon after taking office, Xi launched a massive and sustained anticorruption campaign. Many hackers were launching attacks for private gain after work, misappropriating state resources by using the infrastructure they had built during official hours. Hacking for personal profit was caught up in a broad
clampdown on illegal activities.

Second, the PLA was engaged in an internal reorganisation, consolidating forces and control over activities. Cyber operations had been spread across 3PLA and 4PLA units, and the General Staff Department Third Department had been managing at least 12 operational bureaus and three research institutes. In December 2015, China established its new Strategic Support Force, whose responsibilities include electronic warfare, cyber offence and defence, and psychological warfare. In effect, PLA cyber forces were told to concentrate on operations in support of military goals and move out of industrial espionage.

The first publicly reported cyber espionage attempts in the wake of the agreement were either against military targets or involved the theft of dual-use technologies that would fall in the grey zone. Cyber industrial espionage attacks didn’t end, but instead were transferred to units connected with the Ministry of State Security.12 While the organisation of these groups is less well understood, the ministry appears more willing than PLA groups to use contractors to maintain plausible deniability and reduce the risk of attribution.

Several US cybersecurity company analysts have described the ministry groups’ tradecraft as significantly better than that displayed by the PLA.13 Hackers have made more use of encryption and gone after cloud providers and other IT services that would provide access to numerous targets. In April 2017, for example, security researchers at PwC UK and BAE Systems claimed that China-based hackers were targeting companies through their managed IT service providers.14 The Israeli cybersecurity company Intezer Labs concluded that Chinese hackers embedded malware in the popular file-cleaning program CCleaner.15 In June 2018, Symantec attributed attacks on satellite communications and telecommunication companies in the US and Southeast Asia to a China-based group.16

Outlook

Almost three years after the agreement, judgements on its effectiveness are much harsher. While a former intelligence official argued that US efforts did succeed in getting Beijing to acknowledge a difference between the cyber-enabled theft of IP and political–military espionage, other security researchers were more sceptical. As one put it, ‘Beijing never intended to stop commercial espionage. They just intended to stop getting caught.’ Another believed that Chinese policymakers decided to get credit for a decline in activity that was inevitable in the wake of the PLA reorganisation—a move that had been long in the works.

The Trump administration has pressed Beijing on cyberespionage but as part of much bigger push on trade policy and economic security. In November 2017, the Justice Department indicted three Chinese nationals employed by Chinese cybersecurity firm Boyusec, charging them with hacking into the computer systems of Moody’s Analytics, Siemens AG, and GPS developer Trimble Inc. ‘for the purpose of commercial advantage and private financial gain’.17 US Government officials reportedly asked for Chinese Government help in stopping Boyusec’s activities, but received no reply. Despite Recorded Future and FireEye claiming a connection between Boyusec and the Ministry of State Security, the indictment didn’t call out Chinese Government support for the hackers.18

The US Trade Representative’s March 2018 investigation of China’s policies and practices related to tech transfer and IP states that the US:

has been closely monitoring China’s cyber activities since this [the September 2015] consensus was reached, and the evidence indicates that cyber intrusions into US commercial networks in line with Chinese industrial policy goals continue. Beijing’s cyber espionage against US companies persists and continues to evolve.19

A draft trade framework allegedly provided by US negotiators to their Chinese counterparts, which circulated on Twitter and Weibo in May 2018, calls on Beijing to ‘immediately cease the targeting of American technology and intellectual property through cyber operations, economic espionage, counterfeiting, and piracy’.20

The current trade war with China has two sources: US concern about the bilateral trade deficit, and opposition to Beijing’s use of industrial policy and the theft of IP to compete in high-technology areas. While President Trump has been focused on the deficit, those within the administration pressuring Beijing on its mercantilism should push the cyber issue further up the bilateral agenda. A more direct policy would include a statement from a high-level US official, perhaps Secretary of State Michael Pompeo, that the hacking has resumed and that the US is prepared to use Executive Order 13694, ‘Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled Activities’.21 Soon after, Washington would sanction individuals involved in the hacking as well as the firms that benefit from it.

Even if the White House were to follow such a policy line, it’s likely that Beijing will continue industrial cyber espionage. James Mulvenon argues that Chinese policymakers now believe that they’ve reached a new equilibrium with the US. Shifting industrial cyber espionage to the Ministry of State Security and deploying a higher level of tradecraft have created an equivalent of the hacking conducted by the US National Security Agency. If this is the case, it means that Beijing never truly accepted the distinction that Washington promoted between ‘good’ and ‘bad’ hacking, between cyber-enabled theft to support the competitiveness of Chinese industry and political–military espionage. Instead, Chinese policymakers saw the issue in terms of a high level of relatively ‘noisy’ activity (for which they were likely to get caught and be called out on). Bringing the hacking more in line with what it believes the National Security Agency conducts—a smaller number of hacks that nevertheless give the US large-scale access to Chinese assets—has, in Beijing’s view, resolved the issue. This isn’t the resolution the US hoped for when it first announced the September 2015 agreement, but it may be the one it has to live with now.

Australia

By Fergus Hanson and Tom Uren

The agreement

On 21 April 2017, Following the groundbreaking Obama–Xi agreement in September 2015 and the G20’s acceptance of the norm against the ‘ICT-enabled theft of intellectual property’,22 Australia and China reached their own bilateral agreement. Buried somewhat within the joint statement that followed the inaugural Australia–China High-Level Security Dialogue was a paragraph on commercial cyber espionage:

Australia and China agreed not to conduct or support cyber-enabled theft of intellectual property, trade secrets or confidential business information with the intent of obtaining competitive advantage.23 

As with previous agreements, the statement made an implicit distinction between tolerable espionage for political–military reasons and unacceptable espionage for commercial gain.

Both countries also agreed to act in accordance with the reports of the UN Group of Governmental Experts. The two countries agreed to establish a mechanism to discuss cybersecurity and cybercrime issues with a view to preventing cyber incidents that could create problems between them. This was highlighted in Australia’s International Cyber Engagement Strategy, in which Australia’s dialogues with other states, including China, were characterised as ‘an opportunity to deepen understanding of responsible state behaviour in cyberspace and foster cooperation to deter and respond to malicious cyber activities’.24

In China, the agreement received very limited attention. Xinhua produced a translation of the joint statement, which was then reproduced by the People’s Daily and posted on the Minister of Justice’s website.25

In Australia it received more attention, but the government wasn’t naive about the prospects for success. The Ambassador for Cyber Affairs, Tobias Feakin, was reported as saying ‘We do go into these things with our eyes wide open.’26

Pre-agreement commercial cyber espionage

Reliable public accounts of nation-state cyber espionage in Australia are hard to come by. Both government and industry have been reticent about openly attributing hacks and data breaches to particular nations. The Australian Government has also only more recently begun to ramp up its efforts to deal with the challenge of cybersecurity. The 2009–10 annual report of the Australian Security Intelligence Organisation (ASIO) stated that ‘cyber espionage is an emerging issue’.27 Since that time, ASIO’s annual reports have consistently mentioned that cyber espionage affecting commercial interests and for commercial intelligence is occurring, although details of what’s been stolen and by whom are omitted.

The Australian Cyber Security Centre (ACSC) Threat reports, issued from 2015, have also consistently mentioned threats to commercial IP and to other sensitive information, such as negotiation strategies or business plans.28 But, again, the reports fail to provide enough detail to determine whether it was Chinese espionage that occurred for commercial advantage.

While not publicly named, China is regarded as Australia’s primary cyber adversary, including in the area of IP theft. The fact that it remains unnamed in public statements from the government is perhaps the start of the explanation of why Australia’s policy response so far has been ineffective.

The miners

Australia is a large and significant exporter of iron ore, nickel, coal and other mineral resources to China. Iron ore is particularly significant in the trading relationship—China is the world’s largest importer and Australia the largest exporter, and in 2017 over 80% of Australian iron ore exports were to China.29

Although iron ore contracts are now based on monthly average prices, in the lead-up to 2010 iron ore prices were negotiated between buyers and sellers in fixed one-year contracts.30 Iron ore exports to China were large and growing rapidly, and the price negotiations had tremendous importance for the companies, economies and governments involved. Furthermore, a possible takeover bid for Rio Tinto from BHP led the state-owned Aluminium Corporation of China, Chinalco, to take an overnight 9% stake in Rio Tinto.

In this high-stakes environment, all three major iron ore miners in Australia were the victims of cyber espionage that was informally attributed to China.31 Given the large volume of iron ore trade, any information that could provide advantage in negotiations would be tremendously valuable. In 2012, MI5 Director-General Jonathan Evans revealed that an attack had cost a company—subsequently revealed to be Rio Tinto—an estimated £800 million (US$1.04 billion, A$1.43 billion, €891 million) in lost revenue, ‘not just through intellectual property loss but also from commercial disadvantage in contractual negotiations’.32

It also seems that a bribery case against a Rio Tinto executive and Chinese-born Australian citizen was used to enable further cyber espionage. It’s reported that their Rio Tinto credentials were used to download material from the Rio Tinto corporate network after they were arrested in China.33 If true, this sensational allegation directly links Chinese law enforcement actions to commercial espionage.

Since 2010, the mechanisms that determine prices are now based on market fluctuations, so the very strong incentives to gather information on annual price negotiations have been diminished. However, the high priority that the Chinese Communist Party gives to the secure supply of raw materials means there’s still an ongoing interest in gathering commercial intelligence on Australian mining companies.

The Bureau of Meteorology

In 2015, the Australian Bureau of Meteorology was compromised and a foreign intelligence service — subsequently reported to be Chinese34 — searched for and copied ‘an unknown quantity of documents from the Bureau’s network’.35 In this case it’s hard to definitively categorise the underlying motive. There doesn’t seem to be a direct motive to gather government or defence intelligence, but the bureau’s network could have been used as a launching point for further attacks into government networks. IP theft seems likely, as the bureau is a leading science-based services organisation in Australia, has strong international research partnerships and is involved in international research and development programs. Its compromise also provides the opportunity for widespread economic disruption, given that airlines, logistics organisations and industries such as agriculture rely on its services to operate. Its significant weather forecasting and supercomputer expertise would be valuable, too. But for all that this potential IP would be worth, it’s hard to confirm that it was both stolen and used for commercial advantage.

Operation Cloud Hopper

In April 2017, BAE Systems and PwC UK released a report into what they called Operation Cloud Hopper,36 a systematic global espionage campaign that compromised managed IT service providers, which remotely manage customer IT and end-user systems and generally have direct and unfettered access to client networks. The successful compromise of managed service providers for espionage allows considerable access to client networks and data.

This operation was attributed to a China-based group that’s widely known as APT 10 and Stone Panda. CERT Australia identified 144 partner companies that could have been affected.37 However, it isn’t publicly known which companies were affected and what was stolen. 

Summary

Official statements from ASIO and the ACSC indicate that commercial espionage before 2017 was a large and growing concern, but several factors make it difficult to determine who was stealing data and why they were doing it.

First, both government and business remain reluctant to formally attribute attacks to states because of both technical uncertainty (it takes time, skill and effort to develop high levels of confidence) and because of fears of damaging possibly important diplomatic, economic and intelligence relationships. 

Second, Australia implemented a data breach notification law only in February 2018, and that law doesn’t apply to the theft of IP and commercial-in-confidence data. 

Finally, before the ACSC was formally assigned whole-of-economy responsibilities in July 2018, there was no cybersecurity centre of gravity that could determine whether formal attribution was desirable and necessary.

Post-agreement commercial cyber espionage

The Australian National University hack

In July 2018, it was reported that Chinese hackers had ‘successfully infiltrated the IT systems at the Australian National University’ (ANU)38 and that a remediation effort had been ongoing for several months. As with the Bureau of Meteorology, it’s hard to definitively determine what was stolen and for what purpose. The ANU conducts research that has a wide range of applications, including defence, strategic and commercial applications, and it isn’t known what was stolen.

Many ANU graduates subsequently work in the Australian Government, and the ANU also hosts the National Security College, which conducts courses for defence and intelligence officials. Access to ANU IT systems would possibly be of value to enable follow-on espionage. Disentangling all the possible uses that access to ANU could have been used for is impossible without a forensic accounting of what was stolen. In August, the university advised that ‘current advice is that no staff, student or research data has been taken’, although that assessment was questioned by the International Cyber Policy Centre.39

The only publicly known target of Chinese hacking—the ANU—isn’t directly a government or military espionage target, but it’s possible the stolen data won’t be used for commercial gain (and therefore falls outside the scope of China’s agreement with Australia).

Outlook

Despite China’s commitments to Australia and the limited public evidence of commercial cyber espionage, Beijing doesn’t appear to have ceased commercial cyber espionage activities in Australia. However, assessing the scale of China’s ongoing commercial cyber espionage activity is difficult. The Australian Government has been reluctant to publicly name and shame adversary states engaging in cyber theft for commercial gain. China has also improved its tradecraft, making detection
harder and perhaps leading to a mistaken perception that activity has become more focused. This professionalisation followed the exposure of the PLA’s previously sloppy tradecraft and probably the internal restructure (mentioned in the ‘United States’ section of this report) that shifted responsibility for commercial cyber espionage from the PLA to the Ministry of State Security. Australia also has relatively less commercially attractive IP than countries such as the US and Germany, so few examples come to light.

Official statements from ASIO and the ACSC don’t reflect a significant decline in the threat of IP or commercial-in-confidence data theft. Public statements from government officials and the publicly known target—a university—don’t indicate a significant change in the nature of Chinese cyber espionage. While this review indicates how difficult it is to clearly identify cyber espionage for competitive advantage, China remains Australia’s primary cyber adversary and is making greater
efforts to disguise and focus its commercial cyber espionage.

In a partial nod to keeping its agreements, China seems to be focusing on the theft of dual-use and national security related data. For China, this seems to incorporate a fairly wide range of sectors (such as mining) that goes well beyond sectors such as defence. To begin the process of increasing pressure on China to adhere to its agreements, Australia should identify opportunities to formally name adversary states, including China, in public documents and statements. A good place to start is the annual ACSC Threat report. Australia should also consider partnering with states subjected to similar IP theft by China to build and sustain pressure on Beijing to
adhere to its agreements. The G20 offers a multilateral venue for keeping up pressure, but other ad hoc opportunities should also be identified.

Germany

By Dr Samantha Hoffman

Consultation mechanism

No formal bilateral agreement on preventing commercial cyber espionage exists between Germany and China. However, a joint declaration from the June 2016 4th China–Germany Intergovernmental Consultations stated that the two governments would set up a ‘bilateral cyber security consultation mechanism’.40 Both sides also agreed that neither operates or knowingly supports ‘the infringement of intellectual property, trade or business secrets through the use of cyberspace in order to attain
competitive advantage for their businesses or commercial sectors’.

The first cybersecurity consultation wasn’t held until 17 May 2018.41 Efforts to establish the consultation were delayed, in part because the two sides had different expectations regarding topics and participants. The delays also led to a public exchange between German Ambassador to China Michael Clauss and the Chinese Foreign Ministry. In a December 2017 interview with the Hong Kong-based South China Morning Post, Clauss was quoted saying that he expected the Chinese Government to join Germany in setting up the agreed consultation mechanism. He also said, ‘Our repeated requests to have a meaningful dialogue on [virtual private networks] and cyber-related questions with the relevant Chinese authorities have regrettably not yet received a positive response.’ The comments prompted a reply from Chinese Foreign Ministry spokeswoman Hua Chunying, who claimed, ‘China has repeatedly invited a German delegation to China for consultation, but Germany has never responded on time … It’s unreasonable for Germany now to criticise Beijing for not being sincere.’

The eventual May 2018 consultation, which took place in Beijing, was co-chaired by Chinese Vice Minister of Public Security Shi Jun and German Parliamentary State Secretary at the Federal Ministry of the Interior Professor Dr Günter Krings. The German Government insisted that the Ministry of Public Security and a member of the Central Political and Legal Affairs Commission were also present.

Although the meeting was officially described as a success,42 no tangible progress was made during the consultation to substantively address key issues. The German Government insisted that discussion focus on commercial cyber espionage and issues such as data protection and virtual private networks. These were all topics that the Chinese Government preferred to avoid. The Chinese Government instead wanted to discuss cybercrime and cyber terrorism, but there are major differences in the way those concepts are defined. Chinese officials have regularly pushed the German Government to deport political opponents in the Uygur community, which Berlin has continually refused to do because Beijing can provide no evidence to support its claims.

The cyber consultation was again discussed during the July 2018 5th China–Germany Intergovernmental Consultations in Berlin. A joint statement said that the consultation would continue as a key platform for discussing cyber issues, including cross-border data protection and IP and trade infringements.43

Dealing with commercial cyber espionage

The 2016 and 2017 editions of the German Federal Ministry of the Interior’s Annual report on the protection of the Constitution (published in July 2017 and July 2018, respectively) both specifically identified China alongside Russia and Iran as the primary countries responsible for espionage and cyberattacks against Germany.44 The reports said that ‘Chinese intelligence services focus on industry, research, technology and the armed forces (structure, armament and training of the Bundeswehr, modern weapons technology).’45 A separate July 2017 report by Bitkom, Germany’s digital industry association, found that German companies lose €55 billion (US$64 billion, A$88 billion) annually due to commercial cyber espionage affecting about 53% of German companies.46

The number of known China-originated commercial cyber espionage attacks against German companies dropped in the past two years, according to the head of the Federal Office for the Protection of the Constitution (BfV), the German domestic intelligence agency.47 Other German Government officials confirmed the appearance of a decrease, but added that they’re unsure whether there had been one. There’s an equally high likelihood that cyber espionage has become more sophisticated, and better targeted, and therefore has been undetected.

The decline in known cyber espionage incidents has also been linked to a sharp increase in Chinese foreign direct investment in high-tech and advanced manufacturing industries in 2016. The BfV head, Hans-Georg Maassen, made a similar claim and linked the decline with an increase in the use of legal tools for obtaining the same information, such as corporate takeovers. Maassen said ‘industrial espionage is no longer necessary if one can simply take advantage of liberal economic regulations to buy companies and then disembowel them or cannibalise them to gain access to their know-how.’48 The German Government took steps in July 2017 to address concern by amending the Foreign Trade and Payments Ordinance to tighten restrictions on non-EU foreign investment in Germany. The move was partly triggered by the €4.5 billion (US$5.3 billion, A$7.2 billion) takeover of German industrial robotics maker Kuka by Chinese appliance maker Midea.

The amendment identified several sectors that would be subject to higher scrutiny. They include companies operating critical infrastructure, IT and  telecommunications, and certain cloud computing providers. Previously, non-EU companies weren’t obliged to inform the government of an acquisition (of 25% or more of voting rights) of a German company unless they were involved in the development and manufacturing of defence and encryption technology. The July 2017 amendment, however, expanded the notification requirement to include critical infrastructure and other security-related technology.49 The amendment refers to sectors identified in the 2013 Foreign Trade and Payments Ordinance section 55, which include energy, water, IT, financial services, insurance, transportation, food and health.50

The amendment also extended the period for the Ministry of Economic Affairs and Energy to conduct reviews. There are two foreign investment review categories: ‘cross-sectoral investment review’ and ‘sector-specific investment review’. Cross-sector reviews apply to the acquisition of any company where the investor is located outside the EU or the European Free Trade Association and plans to acquire ownership of 25% or more.51 Sector-specific reviews apply to the acquisition of a company that operates in sensitive security areas. In addition to military weapons and equipment, this includes ‘products with IT security features that are used for processing classified government information’. 52

Similar rules apply for companies that operate high-grade remote sensing systems under the Act on Satellite Data Security.53 Previously, the ministry was required to conduct a cross-sectoral investment review within two months, but is now given four months.54 For sector-specific reviews, it was previously required to conduct a review within one month and is now given three months.55 The German Government has further identified a need to tighten controls on the loss of sensitive information in the area of cross-border data protection.

Outlook

Assessing the scale of Chinese commercial espionage activity is difficult, and very little information is made publicly available. The German Government remains sceptical about China’s commitment to cease the infringement of IP, trade or business secrets through the use of cyberspace. However, the government feels that some dialogue is better than no dialogue. It hopes to leave open the possibility of a more intensive dialogue in future. One German official said that the government is pushing for the Chinese side to ‘behave as [it would] wish to be treated’ in an increasingly interconnected world.


What is ASPI?

The Australian Strategic Policy Institute (ASPI) was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally.

ASPI International Cyber Policy Centre

The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society. It seeks to improve debate, policy and understanding on cyber issues by:

  1. conducting applied, original empirical research
  2. linking government, business and civil society
  3. leading debates and influencing policy in Australia and the Asia–Pacific.

We thank all of those who contribute to the ICPC with their time, intellect and passion for the subject matter. The work of the ICPC would be impossible without the financial support of our various sponsors.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.

© The Australian Strategic Policy Institute Limited 2018
This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers.

First published September 2018

Cover image: Illustration by Wes Mountain. ASPI ICPC and Wes Mountain allow this image to be re-published under the Creative Common License Attribution-Share Alike. Users of the image should use this sentence for image attribution: ‘Illustration by Wes Mountain, commissioned by ASPI’s International Cyber Policy Centre’.

Sydney Recommendations – Practical Futures for Cyber Confidence Building in the ASEAN region

In the lead-up to the ASEAN–Australia Special Summit, ASPI’s International Cyber Policy Centre launched an initiative with partners across the region to develop the Sydney
Recommendations on Practical Futures for Cyber Confidence Building in the ASEAN region.

These recommendations build on the extensive work undertaken by the think-tank community in the region starting in the early 2010s.

Cybersecurity and electoral integrity

Address on Cyber Security and threats to Australian Elections given by Tom Uren at the Australian Parliament House research group meeting. 

Video here: https://www.aph.gov.au/About_Parliament/Parliamentary_Departments/Parliamentary_Library/pubs/Vis/vis1819/Cybersecurity .

Defining offensive cyber capabilities

Introduction

States are developing and exercising offensive cyber capabilities. The United States, the United Kingdom and Australia have declared that they have used offensive cyber operations against Islamic State,1 but some smaller nations, such as the Netherlands, Denmark, Sweden and Greece, are also relatively transparent about the fact that they have offensive cyber capabilities.2 North Korea, Russia and Iran have also launched destructive offensive cyber operations, some of which have caused widespread damage.3 The US intelligence community reported that as of late 2016 more than 30 states were developing offensive cyber capabilities.4

There is considerable concern about state-sponsored offensive cyber operations, which this paper defines as operations to manipulate, deny, disrupt, degrade, or destroy targeted computers, information systems or networks.

It is assumed that common definitions of offensive cyber capabilities and cyber weapons would be helpful in norm formation and discussions on responsible use.

This paper proposes a definition of offensive cyber operations that is grounded in research into published state doctrine, is compatible with definitions of non-kinetic dual-use weapons from various weapons conventions and matches observed state behaviour.

In this memo, we clearly differentiate offensive cyber operations from cyber espionage. We address espionage only in so far as it relates to and illuminates offensive operations. Only offensive cyber operations below the threshold of armed attack are considered, as no cyber operation thus far has been classified as an armed attack, and it appears that states are deliberately operating below the threshold of armed conflict to gain advantage.5

This paper examines the usefulness of defining cyber weapons for discussions of responsible use of offensive cyber capabilities. Two potential definitions of cyber weapons are explored—one very narrow and one relatively broad—before we conclude that both definitions are problematic and that a focus on effects is more fruitful.

Finally, the paper proposes normative courses of action that will promote greater strategic stability and reduce the risk of offensive cyber operations causing extensive collateral damage.

Definitions of offensive cyber capabilities

This section examines definitions of offensive cyber capabilities and operations in published military doctrine and proposes a definition consistent with state practice and behaviour. We first define operations and capabilities to clarify the language used in this report.

What are capabilities? In the context of cyber operations, having a capability means possessing the resources, skills, knowledge, operational concepts and procedures to be able to have an effect in cyberspace. In general, capabilities are the building blocks that can be employed in operations to achieve some desired objective. Offensive cyber operations use offensive cyber capabilities to achieve objectives in or through cyberspace.

US military joint doctrine defines offensive cyber operations as ‘operations intended to project power by the application of force in and through cyberspace’. One category of offensive cyber operations that US doctrine defines is ‘cyberspace attack’—actions that manipulate, degrade, disrupt or destroy targets.6

UK military doctrine defines offensive cyber operations as ‘activities that project power to achieve military objectives in, or through, cyberspace. They can be used to inflict temporary or permanent effects, thus reducing an adversary’s confidence in networks or capabilities. Such action can support deterrence by communicating intent or threats.’7 UK doctrine further notes that ‘cyber effects will primarily be in the virtual or physical domain, although some may also be in the cognitive domain, as we seek to deny, disrupt, degrade or destroy.’

In both UK and US military doctrine, offensive operations are a distinct subset of cyberspace operations that also include defensive actions; intelligence surveillance and reconnaissance and operational preparation of the environment—non-intelligence enabling activities conducted to plan and prepare for potential follow-on military operations.

This is consistent with the Australian definition, which is that offensive cyber operations ‘manipulate, deny, disrupt, degrade or destroy targeted computers, information systems or networks’.8

The Netherlands’ defence organisation sees offensive cyber operations as ‘digital resources whose purpose it is to influence or pre-empt the actions of an opponent by infiltrating computers, computer networks and weapons and sensor systems so as to influence information and systems’.9

Two common threads in state definitions are identified. Offensive cyber operations:

  • are intended to deny, disrupt, degrade, destroy or manipulate targets to achieve broader objectives (henceforth called denial and manipulation effects)
  • have a ‘direct real-world impact’.10

Another observation is that these definitions stress that ‘while cyber operations can produce stand-alone tactical, operational, and strategic effects and achieve objectives, they must be integrated’ in a military commander’s overall plan.6  This doctrine, however, originates from military establishments within a relatively narrow range of countries. In other states, offensive cyber operations may well be less integrated into military planning and will occur to achieve the political and/or strategic goals of the state leadership.11

This paper proposes that offensive cyber operations manipulate, deny, disrupt, degrade, or destroy targeted computers, information systems or networks.

offensive cyber operations manipulate, deny, disrupt, degrade, or destroy targeted computers, information systems or networks.

There are relatively few publicly available offensive cyber doctrine documents, but observed behaviour indicates that states such as Iran, North Korea and Russia are using operations that cause denial and manipulation effects to support broader strategic or military objectives.

By definition, offensive cyber operations are distinct from cyber-enabled espionage, in which the goal is to gather information without having an effect. When information gathering is a primary objective, stealth is needed to avoid detection in order to maintain persistent access that allows longer term intelligence gathering.

This definition does classify relatively common events, such as ransomware attacks, website defacements and distributed denial of service (DDoS) attacks, as offensive cyber operations.

Although the ‘manipulate, deny, disrupt, degrade or destroy’ element of the definition lends itself to segmentation into different levels, further examination shows that segmentation based on the type of attack is not particularly useful. Information and communication technology (ICT) infrastructure is inherently interconnected, and even modest disruption can cause relatively drastic second-order effects. Modifying the state of a control system, for example, could lock a person’s garage or launch a nuclear missile.

Conversely, seriously destructive attacks, such as data wipers, can have damaging effects on different scales. Compare the damage caused when North Korea infiltrated the Sony Pictures Entertainment network12 with the damage caused during the Russian-launched NotPetya attack’13 At Sony Pictures, more than 4,000 computers were wiped and, although that cost US$35 million to investigate and repair, it did not significantly affect the broader Sony corporation14 and did not directly affect other entities. The NotPetya event also involved data destruction, but it was probably the most damaging cyberattack thus far: US$300 million in damages for FedEx; US$250–300 million for Danish shipper Maersk15; more than US$310 million for American pharmaceutical giant Merck; US$387 million for French construction giant Saint-Gobain; and US$150 million for UK chocolate maker Mondelez International. It is possible that flow-on effects from the disruption to the logistics and pharmaceutical industries may have affected the broader global economy.

Table 1 is a selected list of state activities that this paper defines as offensive cyber operations. Those operations are assessed for the scale, seriousness, duration and specificity of their effect.

Ultimately, the seriousness of a cyberattack is based on its ultimate effects or on the effects that it enables. The scale and seriousness of incidents should be based upon measuring the ultimate consequences of an incident and the economic and flow-on effects.

Table 1: State offensive cyber operations

OperationSeriousnessScaleDurationSpecific
NotPetyaHigh—data destructionGlobal. Affected organisations in Europe, US and Asia (Maersk, Merck, Rosneft, Beiersdorf, DHL and others) but also a concentration in Ukraine (banking, nuclear power plant, airports, metro services).Short-term, with recovery over months to a year.No
WannaCryHigh—data destructionGlobal, but primarily in Russia, Ukraine, India and Taiwan, affecting multinationals, critical infrastructure and government.Short-term, with recovery over months to a year.No
Sony Pictures EntertainmentHigh—data destructionFocused on Sony Pictures Entertainment (<7,600 employees), a subsidiary of Sony Corporation (131,700 employees in 2015) (a)Short-term, with recovery in months.Yes
StuxnetHigh—destruction of centrifugesFocused on Iran’s nuclear weapon development programme<1 yearYes
Various offensive cyber operations against ISIS by US, Australia, UKVaried—some data destruction but also denial and manipulation effectsFocused on Islamic StateUnknownYes
Estonia 2007Medium—temporary denial of servicePrincipally Estonian electronic services, affecting many European telcos and US universities3 weeksYes

(a)  Sony Corporation, US Securities and Exchange Commission Form 20-F, FY 2016 [online]

Cyber weapons and arms control

Cyber weapons are often conceived of as ‘powerful strategic capabilities with the potential to cause significant death and destruction’,16 and in an increasingly interconnected world it is easy to speculate about catastrophic effects. It is also difficult to categorically rule out even seemingly outlandish offensive cyber scenarios; for example, it seems unlikely that a fleet of self-driving cars could be hacked to cause mass destruction, but it is hard to say with certainty that it is impossible.17 Although the reality is that offensive cyber operations have never caused a confirmed death, this ‘uncertainty of effect’ is potentially destabilising, as states may develop responses based on practically impossible worst-case scenarios.

In a Global Commission on the Stability of Cyberspace issue brief, Morgus et al. look at countering the proliferation of offensive cyber capabilities and conclude that limiting the development of cyber weapons through traditional arms control or export control is unlikely to be effective.18 This paper agrees, and contends that previous arms or export control agreements may succeed where the following three conditions are present:

  1. Capability development is limited to states, usually because weapons development is complex and highly industrialised.
  2. There is a common interest in limiting proliferation.
  3. Verification of compliance is possible.

Perhaps only one of these three conditions—a common interest in limiting proliferation—exists in the world of cyber weapons, although even this is not immediately self-evident.

In the context of international arms control, a limited number of capability developers usually means that only states (and ideally only a small number of states) have the ability to develop weapons of concern, that states have effective means to control proliferation, or both. In cyberspace, however, there are many non-state actors—in the cybersecurity industry and in the criminal underworld19—developing significant cyber capability. Additionally, the exchange of purely digital goods is relatively difficult for states to control compared to exchanges of physical goods. States do not have a monopoly on capability development and find it difficult to effectively control the spread of digital goods, and so therefore cannot credibly limit broader capability development.

For chemical, biological and nuclear weapons, the human suffering caused by their use is generally abhorred and there is a very broad interest in restraining the use of those weapons. Offensive cyber operations, by contrast, could achieve military objectives without causing human suffering; for example, the warfighting capability of an adversary could be degraded by disrupting their logistics such that military objectives could be achieved without fighting. It has been suggested that states have a ‘duty to hack’ when the application of offensive cyber operations will result in less harm than all other applications of force,20 and the UK’s Minister of State for the Armed Forces, Nick Harvey, noted in 2012 that offensive cyber operations could be ‘quite a civilised option’ for that reason.21

Additionally, cyber weapons can be developed entirely in environments where visibility for verification is impossible, such as in air-gapped networks in nondescript office buildings. Unlike for weapons of mass destruction, there are no factories or supply chains that can be examined to determine whether capabilities exist and stockpiles are being generated.22

Unlike many military capabilities—say, nuclear-armed submarines or ballistic missiles—offensive cyber capabilities are unique in that once defenders have technical knowledge of the potential attack, effective countermeasures can be developed and deployed relatively easily.23

For this reason, states already have considerable interest in limiting the proliferation of offensive cyber capabilities—they want to keep those capabilities secret so they can exploit them. The US Vulnerabilities Equities Process (VEP) policy document24 states that when the US Government discovers vulnerabilities25 most are disclosed, but some will be kept secret to satisfy law enforcement or national intelligence purposes where the risk of the vulnerability is judged to be outweighed by possible intelligence or other benefits. Undoubtedly, all states that engage in vulnerability discovery will have a common interest in keeping at least some secret so that they can be exploited for national security purposes.

Defining cyber weapons

Despite scepticism about the effectiveness of traditional arms control, this paper develops both a narrow and a broad definition of cyber weapons to test whether those definitions could be useful in arms control discussions. The definitions have been developed by examining selected international weapons conventions and previously published definitions.

One problem with defining cyber weapons is that cyber technologies are primarily dual-use: they can be used for both attack and defence, for peaceful and aggressive purposes, for legal and illegal activities. Software can also be quite modular, such that many cybersecurity or administrative tools can be brought together to form malware.

Weapons in the physical domain have been categorised into three groups: small arms and light weapons; conventional arms; and weapons of mass destruction (WMD).26 Given that cyber weapons are often conceived of as potentially causing mass destruction and because WMDs are subject to the most rigorous international counter-proliferation regimes, this paper examines definitions through the perspective of the dual-use WMD counter-proliferation Chemical Weapons Convention and Biological Weapons Convention.27

Biological weapons, a class of WMD, are described as (our emphasis):28

  1. microbial or other biological agents, or toxins whatever their origin or method of production, of types and in quantities that have no justification for prophylactic, protective or other peaceful purposes;
  2. weapons, equipment or means of delivery designed to use such agents or toxins for hostile purposes or in armed conflict.

The Chemical Weapons Convention defines chemical weapons as (our emphasis):29

  • toxic chemicals and their precursors, except where intended for purposes not prohibited under the Convention and as long as the types and quantities are consistent with such purposes; and
  • munitions and devices, specifically designed to cause death or other harm through the toxic properties of those chemicals …

These conventions, both of which deal with dual-use goods, define by exclusion: only substances that do not or cannot have peaceful purposes are defined as weapons. The material of concern is not inherently a problem—it is how it is used.

In the context of armed conflict, the Tallinn Manual characterises cyber weapons by the effects they have, not by how they are constructed or their means of operation:

cyber weapons are cyber means of warfare that are used, designed, or intended to be used to cause injury to, or death of, persons or damage to, or destruction of, objects, that is, that result in the consequences required for qualification of a cyber operation as an attack.30

Herr and Rosenzweig define cyber weapons as malware that has a destructive digital or physical effect, and exclude malware used for espionage.31 Herr also considers that malware is modular and consists of a propagation element that the malware uses to move from origin to target; an exploit that will allow the malware to execute arbitrary commands on the target system; and a payload that will execute some malicious instructions.

Rid and McBurney define cyberweapons as ‘computer code that is used, or designed to be used, with the aim of threatening or causing physical, functional, or mental harm to structures, systems, or living beings’.32

A narrow definition

Following the logic of dual-use weapons conventions, a narrow definition of cyber weapons is software and information technology (IT) systems that, through ICT networks, cause destructive effects and have no other possible uses. The IT system aspect of this definition requires some level of integration and automation in a weapon: code that wipes a computer hard disk is not a weapon by itself—by itself it cannot achieve destructive effects through cyberspace—but could form part of a weapon that wipes hard drives across an entire organisation.

Based on this narrow definition, Table 2 shows our assessment of whether reported malware examples would be defined as cyber weapons.

Table 2: Cyber weapon assessment

Malware or systemDescriptionWeapon
Distributed denial of service (DDoS) systemsAggregation of components, including bots and control software, such that they have no other purpose than to disrupt internet services.Yes, although this is arguable because effects tend to be temporary (disruptive and not destructive). Each individual component is likely to have non-destructive uses.
Dragonfly a.k.a. Energetic Bear campaign (a)Espionage campaign against energy critical infrastructure operators that developed industrial control system sabotage capabilities.No. This was both manual and for espionage only; it never disrupted critical operations. However, the intent demonstrated is to develop capabilities to disrupt critical infrastructure.
Blackenergy 2015 Ukrainian energy grid attack (b)Access to Ukrainian energy company was used to disrupt electricity supply.No. Blackenergy malware was very modular and this attack was quite manual. This malware does contain destructive capability.
Industroyer a.k.a. Crashoverride malware (c)Malware in a Ukrainian energy supply company was used to disrupt electricity supply.Yes. Integrated malware disrupted electricity supply automatically.
TRISIS malware (d)Malware intended to sabotage a Saudi Arabian petrochemical plant.Yes. Malware with no espionage capability was specifically designed to destroy a petrochemical plant.
WannaCryA self-propagating data wiper.Yes. Malware with no espionage capability was designed to irreversibly encrypt computer hard drives.
MetasploitAn integrated collection of hacking tools that can be used for defence, for espionage, or for destruction and manipulation.No. Metasploit has many non-destructive uses and is not integrated into a system that causes destruction.
NotPetyaA self-propagating data wiper.Yes. Automatically destroyed data.
Flame, Snake, ReginVery advanced modular malware.No. These could cause denial and manipulation effects and could be automated but have other uses. They seem to be designed primarily for espionage.
StuxnetSelf-propagating malware that subverted industrial control systems to destroy Iranian nuclear fuel enrichment centrifuges.Yes. Highly tailored to automatically destroy targeted centrifuges.
Large-scale man-in-the-middle attack system (e.g. mass compromise of routers) (e)Compromise of many mid-points could enable large-scale access that could be used to enable intelligence, destruction or manipulation, or even to patch systems.No. Intent is everything here.
PowershellA powerful scripting and computer administration language installed by default with the Windows operating system.No. Many non-destructive uses.
A Powershell script designed to automatically move through a network and wipe computers.Destructive intent is codified within the script commands.Yes.
  • a) Symantec, Dragonfly: Western energy companies under sabotage threat, 2014, online.
  • b) Kim Zetter, ‘Inside the cunning, unprecedented hack of Ukraine’s power grid’, Wired, 3 March 2016, online.
  • c) Andy Greenburg, ‘“Crash override”: the malware that took down a power grid’, Wired, 12 June 2017, online; Robert M Lee, ‘Crashoverride’, Dragos, 12 June 2017, online; Anton Cherepanov, Robert Lipovsky, ‘Industroyer: biggest threat to industrial control systems since Stuxnet’, welivesecurity, 12 June 2017, online.
  • d) Nicole Perlroth, Clifford Krauss, ‘A cyberattack in Saudi Arabia had a deadly goal: experts fear another try’, New York Times, 15 March 2018, onlineTRISIS malware: analysis of safety system targeted malware, Dragos, online.
  • e) US CERT, Russian state-sponsored cyber actors targeting network infrastructure devices, Alert TA18-106A, 16 April 2018, online.

This narrow definition is consistent with the narrowness of definitions from both the Biological Weapons Convention and the Chemical Weapons Convention, both of which deal with dual-use goods.

The definition captures intent by excluding all other tools where intent is ambiguous; only tools that can only be used for destruction are included.

This narrow definition is problematic for at three reasons.

First, it does not map directly onto state definitions of offensive cyber activities—actions that manipulate, disrupt, deny and degrade would likely not be captured and so much offensive cyber activity will not involve cyber weapons. The offensive cyber operation, for example, that US Cyber Command conducted against Islamic State’s propaganda operations did not require cyber weapons. Cyber Command obtained Islamic State administrator passwords and deleted content and changed passwords to lock out the original owners.33 This offensive cyber operation could have been entirely conducted using standard computer administration tools. No malware, no exploit, no software vulnerability and certainly no cyber weapon was needed.

Second, even the most destructive offensive cyber operations could be executed without ever using a cyber weapon. For example, a cyber operation that triggered the launch of conventional or nuclear weapons would not require a cyber weapon.

Third, this definition could easily be gamed by adding non-destructive functionality to otherwise malicious code.

A broader definition

A broader definition of cyber weapons could be software and IT systems that, through ICT networks, manipulate, deny, disrupt, degrade or destroy targeted information systems or networks.

This definition has the advantage that it would capture the entirety of tools that could be used for offensive cyber operations.

Many cyber operations techniques, however, take advantage of computer administration tools, and the difference between espionage and offensive action is essentially a difference in intent; for example, the difference between issuing a command to copy files and issuing one to delete files. Indeed, it is possible to conduct cyber operations—both intelligence and offensive operations—using only legitimate tools such as the scripting language Windows Powershell.34 Yet it makes no sense to define what could be used for destructive effects as a cyber weapon; it is nonsensical to label Powershell as a cyber weapon.

This definition would also include perfectly legitimate tools that state authorities and the cybersecurity community use for law enforcement, cyber defence, or both.

These two definitions highlight the dilemma involved in defining cyber weapons. A narrow definition can perhaps be more readily agreed to by states, but excludes so much potential offensive cyber activity that efforts to limit cyber weapons based on that definition seem pointless. The broader definition would capture tools used for so many legitimate purposes that agreement on their status as weapons is unlikely, and limitations could well harm network defenders more than attackers.

Options for control

This paper therefore agrees with Morgus et al.35 that limiting the development of cyber weapons by controlling the development of defined classes of weapons is unlikely to be effective. There are, however, options for more effective responses that focus on affecting the economics of offensive cyber operations and the norms surrounding their application.

Affecting the markets involved in offensive cyber capability development would raise the cost of capability development and encourage states to conduct operations sparingly.

One market associated with cyber capabilities is that for software vulnerabilities and their associated exploits (code that takes advantage of a vulnerability). Software vulnerabilities are often exploited by malware to gain unauthorised access to computer systems and are often—although not always—required for offensive cyber capabilities. Ablon and Bogart have found that the market price for software exploits is sensitive to supply and that prices can rise dramatically for in-demand, low-supply products.36 A multifaceted approach to restricting supply could raise the cost of acquiring exploits and therefore the cost of building offensive cyber capabilities.

Shifting the balance of vulnerability discovery towards patching (rather than exploitation for malicious purposes) would raise the value of all vulnerabilities. As suggested by Morgus et al., one possibility is that software vulnerabilities are bought for the express purpose of developing fixes and patches, as suggested by Dan Geer in a 2014 BlackHat conference keynote.37

A secondary response would be to enable more effective repair of vulnerabilities that would close the loopholes that enable computer exploitation. NotPetya, assessed by the US Government to be the most destructive cyberattack thus far,38 used publicly known vulnerabilities for which patches had been available for months. Effective cyber hygiene would have prevented much of the damage that NotPetya caused.

From a policy point of view, this could be attacked at several levels by encouraging research into vulnerability mitigation and more effective patching processes; educating decision-makers to prioritise and resource vulnerability discovery and patching; government policy to encourage more effective patching regimes; and promoting VEP policies in other states (discussed below).

Whenever a vulnerability is exploited for any purpose—including cyber espionage, offensive operations and cybercrime—there is a risk of discovery, which could ultimately result in patching and loss of the ability to exploit the vulnerability. Raising the value of all vulnerabilities will encourage states to use offensive cyber capabilities sparingly to avoid discovery and hence loss of capability via patching.

A complementary approach would be to change incentives within software development to encourage secure application development. Again, this could be approached at many levels: altering computer science curriculums; promulgating secure coding standards;39 and altering the balance of liability in commercial code, for example.

Reducing the supply of exploits and raising their cost encourages states to conduct cyber operations in a way that avoids attracting attention to mitigate the risk of discovery and loss of capability. This effort to operate quietly would vastly reduce the risk of inadvertent large-scale damaging events.40

Recommendation: Encourage the establishment of national vulnerabilities equities processes

There is a common interest among all states that are conducting cyber operations—defensive or offensive—in actively assessing the risk and benefits of keeping vulnerabilities secret for exploitation. The US VEP document states that in ‘the vast majority of cases, responsibly disclosing a newly discovered vulnerability is clearly in the national interest’. Assuming this is true, the presence of VEP policies in many states would tend to result in more responsible disclosure and patching and therefore result in a reduced supply of vulnerabilities and exploits.

This reduced supply of vulnerabilities would raise the cost of offensive capability development and therefore restrict proliferation and reduce the use of offensive operations.

Recommendation: Promote focused operations

Unlike a kinetic weapon, for which direct consequences such as blast radius may be well understood, offensive cyber operations can easily have unintended consequences. Since states are conducting offensive cyber operations below the threshold of armed conflict, another option to limit offensive operations is to promote operations that are tightly focused so that operations do not affect innocent bystanders.

We have assessed that both the Sony Pictures and Stuxnet attacks were specific, as both affected specific targets and did not cause direct effects elsewhere (Table 1). The NotPetya and WannaCry incidents were not specific: they affected many organisations world-wide.

It is possible, therefore, to conduct focused offensive cyber operations that are specific and limit collateral damage; it is not an inherent fact of cyberspace that operations cannot be targeted and specific. To reduce the risks of collateral damage, there would be merit in promoting a norm of ‘due diligence’ for offensive cyber operations, requiring that states invest in rigorous testing to ensure that effects are contained before engaging in offensive cyber operations.

Recommendation: Measure damage for more effective responses

In addition to altering the computer vulnerability lifecycle, governments should also respond directly to cyber operations. Effective responses should be both directed against perpetrators and proportionate. Currently, both the identification of perpetrators (attribution) and the assessment of damage (to determine a proportionate response) are suboptimal. Much has been said about attribution, and this paper will not cover it further.

When state-sponsored operations such as NotPetya and WannaCry occur, there is no independent assessment of damage. An accurate accounting of harm could be used to justify an appropriately proportionate response.

NotPetya has been called ‘the most destructive and costly cyber-attack in history’.41 It seems that total cost estimates of over US$1 billion are based on collating the financial reports of public companies such as Merck,42 Maersk,43 Mondelez International44 and FedEx,45 and then adding a ‘fudge factor’ to account for all other affected entities. Publicly listed companies have formal reporting obligations, but the vast majority of entities affected by NotPetya do not, and it seems likely that the cost of NotPetya has been significantly understated.

An independent body that identifies common standards, rules and procedures for assessing the cost of cyberattacks could enable a more accurate measure of damage. The International Civil Aviation Organization’s system for air crash investigations may provide a framework.46 It assigns a role for various stakeholders, including the airline, the manufacturer, the registrar and so on. The investigation is assigned to an autonomous safety board with the task of assessing what happened, not who was at fault.47 For a cyber incident, an investigation board could include a national cybersecurity centre, the affected entity, the manufacturer of the affected IT system, relevant software developers and other stakeholders.

Using assessments of scope and seriousness to develop proportionate responses would encourage attackers to construct focused and proportionate offensive cyber operations.

Recommendation: Invest in transparency and confidence building

We have noted above that uncertainty about the effects caused by offensive cyber operations has the potential to be destabilising. State transparency in the use of offensive cyber operations could address this concern and help promote norms of responsible state behaviour.

Figure 1 shows the lifecycle of an offensive cyber capability, starting at the point that a state forms an intent to develop capability. Resources are committed; intelligence is gathered to support capability development; capability is developed; the environment is prepared (by deploying malware, for example); and finally the operation is launched and effects are observed. Crucially, there are distinct elements during this lifecycle that require operation on the public internet and are therefore potentially observable: intelligence gathering, operational preparation of the environment, and offensive cyber effects (in orange).48

Figure 1: Offensive cyber capability lifecycle

Although it is not possible to see or measure cyber weapons, to quantify them or inspect ‘cyber weapon factories’, a level of confidence-building transparency can still be achieved. Public doctrine that defines a nation’s strategic intent and its assessment of acceptable and responsible uses of offensive cyber operations would be extremely helpful.

This visibility may be sufficient to enhance confidence building as predictability is increased. Many responsible states will be reluctant to deviate from public statements regarding offensive cyber capability development because effects will possibly become visible at a later stage that will prompt incident response, forensic analysis and maybe political attribution and embarrassment.

There is already some public documentation of offensive cyber capabilities. There are unclassified doctrines, official statements and unofficial reporting on the states that have—or are developing—offensive capability. There are also voluntary national reports in the context of the UNGGE. Additionally, open source verification by research institutes such as the SIPRI Yearbook, IISS Military Balance and reports similar to the Small Arms Survey are authoritative and credible sources that inform policy actions by states. Finally, independent analysis and reporting from cybersecurity companies such as Symantec, Crowdstrike, BAE Systems and FireEye provides invaluable technical information. These firms also play a key role in early detection and response.

Summary and conclusion

Offensive cyber capabilities are defined as operations in cyberspace to manipulate, deny, disrupt, degrade, or destroy targeted computers, information systems or networks.

This paper has examined narrow and broad definitions of cyber weapons and found them problematic for use in control discussions.

However, a range of other measures would help limit the use of offensive cyber capabilities and reduce the risk of collateral damage when they are used:

  • Markets for the vulnerabilities that are used to create offensive cyber capabilities can be affected to make capability development more expensive. VEP processes would form one element of a broader effort to patch vulnerabilities and restrict supply.
  • Promoting the principle that offensive cyber operations should be focused and taking active steps to limit unintended consequences could limit the effects of operations on innocent bystanders, including through the promotion of the concept of ‘due diligence’.
  • Responses to cyber incidents could also be improved by better accounting of the damage incurred. A robust assessment of damage using agreed standards would enable a more directly proportionate response and would help reinforce the expectation of specific and proportionate offensive cyber operations.

Finally, increased state transparency would promote acceptable norms of behaviour. Although monitoring and verification are difficult, this paper presents an offensive cyber operation lifecycle that indicates that various stages provide some visibility, which could build confidence.


Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.

© The Australian Strategic Policy Institute Limited 2018

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers.

  1. Michael S Rogers, Commander US Cyber Command, statement to the Senate Committee on Armed Services, 27 February 2018, online; Prime Minister Malcolm Turnbull, ‘Offensive cyber capability to fight cyber criminals’, media release, 30 June 2017, online; Director GCHQ, speech at CyberUK18, 12 April 2018. ↩︎
  2. Council on Foreign Relations, Europe is developing offensive cyber capabilities: the United States should pay attention, 26 April 2017, online. ↩︎
  3. Council on Foreign Relations Cyber Operations Tracker, online. ↩︎
  4. James Clapper, Marcel Lettre, Michael S Rogers, Foreign cyber threats to the United States, joint statement for the record to the Senate Armed Services Committee, 5 January 2017. ↩︎
  5. Although offensive cyber operations have been used by combatants in the context of armed conflicts. ↩︎

Technological entanglement

Cooperation, competition and the dual-use dilemma in artificial intelligence

What’s the problem?

Despite frequent allusions to a race—or even an ‘arms race’—in artificial intelligence (AI), US leadership and China’s rapid emergence as an AI powerhouse also reflect the reality of cooperation and engagement that extend across the boundaries of strategic competition.1 Even as China and the US, the world’s emergent ‘AI superpowers’,2 are increasingly competing in AI at the national level, their business, technology and research sectors are also deeply ‘entangled’ through a range of linkages and collaborations. That dynamic stems from and reflects the nature of AI research and commercialisation—despite active competition, it is open and often quite collaborative.3 These engagements can, of course, be mutually beneficial, but they can also be exploited through licit and illicit means to further China’s indigenous innovation and provide an asymmetric advantage.4 The core dilemma is that the Chinese party-state has demonstrated the capacity and intention to co-opt private tech companies and academic research to advance national and defence objectives in ways that are far from transparent. 

This has resulted in a ‘dual-use dilemma’ in which the openness that’s characteristic of science and innovation in democracies can result in unforeseen consequences, undermining the values, interests and competitiveness of the US, Australia and other like-minded nations in these strategic technologies.5 These ‘entanglements’ have included ties between US tech firms and Chinese partners with military connections,6 as well as cooperation between Australian universities and the Chinese People’s Liberation Army (PLA).7 Despite the genuine advantages they may offer, such problematic partnerships can also result in the transfer of dual-use research and technologies that advance Chinese military modernisation, perhaps disrupting the future balance of power in the Indo-Pacific, or facilitate the party-state’s construction of surveillance capabilities that are starting to diffuse globally.

These adverse externalities have troubling implications for US military advantage, authoritarian regime resilience and even the future of democracy.8 How should policymakers balance the risks and benefits of such entanglement,9 while enhancing competitiveness in this strategic technology?

What’s the solution?

These unique and complex dynamics require a range of policy responses that balance the risks and benefits of these partnerships, collaborations and engagements. To enhance situational awareness, policymakers should examine closely research, academic and commercial partnerships that may prove problematic, and then consider updates and revisions to national export controls, defence trade controls and investment review mechanisms as targeted countermeasures. While there is a rationale for visa screening of foreign nationals who plan to study or research sensitive technologies, restrictions should be imposed only on the basis of evidence of direct and clear connections to foreign militaries, governments or intelligence services,10 and scrutiny should focus more on organisations engaging in talent recruitment that are linked to the Chinese central and local governments or to the Chinese Communist Party (CCP). At the same time, there are compelling reasons to sustain scientific cooperation, with safeguards for risk mitigation, including transparency and the protection of sensitive data.

Critically, the US and Australia must pursue policies that actively enhance the dynamism of their own innovation ecosystems to ensure future competitiveness. It is vital to bolster declining support for science and commit to increasing funding for basic research and the long-term development of strategic technologies. Given the criticality of human capital, governments should prioritise improving the accessibility and affordability of STEM education at all levels, while attracting and welcoming talent through favourable immigration policies. In this quest for competitive advantage, the US and Australia must also pursue closer public–private partnerships and expand alliance cooperation on defence innovation.

AI ‘without borders’

Today, national competition in AI is intensifying at a time when the engine for technological innovation in such dual-use technologies has shifted from governments to commercial enterprises. In today’s complex, globalised world, flows of talent, capital and technologies are rapid, dynamic and not readily constrained by borders. Chinese investments and acquisitions in Silicon Valley—and US investments in China—are sizable and increasing, despite intense concerns about the security risks of such investments,11 which have motivated reforms to the Committee on Foreign Investment in the United States (CFIUS) and could result in discretionary implementation of China’s national security review mechanism in response.12 This increased globalisation of innovation ecosystems has proven beneficial to AI development, and dynamic US and Chinese companies are emerging as world leaders in the field.

Increasingly, these enterprises are quite international in their outlook, presence and workforce while engaging in a global quest for talent.13 For the time being, the US remains the centre of gravity for the top talent in AI, and Silicon Valley is the epicentre of this talent ‘arms race’.14 While currently confronting major bottlenecks in human capital, China has great potential, given the number of graduates in science and engineering and the range of new training and educational programs dedicated to cultivating AI talent.15 At the same time, the Chinese government is actively incentivising the return and recruitment of ‘strategic scientists’ via state talent plans.16 At the forefront of the AI revolution, Baidu and Google epitomise in their strategic decisions and activities the linkages and interconnectivity among such global centres of innovation as Silicon Valley and Beijing.17

Baidu has prioritised AI and has emerged as a leading player in this domain. It created the Institute for Deep Learning in Beijing in 2013 and then established its Silicon Valley Artificial Intelligence Laboratory (SVAIL), which employs about 200 people, in 2014.18 Baidu’s CEO, Li Yanhong (李彦宏, or Robin Li), advocated as early as 2015, prior to the Chinese Government’s decision to prioritise AI, for a ‘China Brain’ plan that would involve a massive national initiative in AI, including welcoming military funding and involvement.19

Increasingly, Baidu has actively invested in and acquired US AI start-ups, including xPerception and Kitt.ai,20 while seeking to expand its US-based workforce. The company has stated that Silicon Valley ‘is becoming increasingly important in Baidu’s global strategy as a base for attracting world-class talent.’21 In March 2017, Baidu announced plans to establish a second laboratory in Silicon Valley, which is expected to add another 150 employees.22 Notably, Baidu has also launched the Apollo project, which is a collaborative initiative to advance the development of self-driving cars that involves more than 100 tech companies and automakers, including Ford, NVIDIA, and Microsoft.23 At the same time, Baidu is engaged in research on military applications of AI, particularly command and control.24

Google remains at the forefront of AI development, leveraging an international presence and global workforce. Beyond Silicon Valley, Google has opened AI research centres in Paris, New York and Tokyo,25 and it will soon add Beijing and then Accra, Ghana.26 When Google announced the opening of the Google AI China Center in December 2017, chief scientist Fei-Fei Li declared, ‘I believe AI and its benefits have no borders. Whether a breakthrough occurs in Silicon Valley, Beijing, or anywhere else, it has the potential to make everyone’s life better for the entire world.’27 She emphasised, ‘we want to work with the best AI talent, wherever that talent is, to achieve’ Google’s mission.28

Google’s decision to expand its presence and activities in China, after withdrawing its search product from the market due to concerns over censorship, surveillance and the theft of intellectual property via cyber espionage in 2010,29 reflects this enthusiasm for the potential of future talent in China—and probably the availability of a sizable market and massive amounts of data as well.30 At the same time, this decision presents an interesting counterpoint to Google’s recent issuing of a statement of principles that included a commitment not to build technologies used for surveillance.31 Given the dual-use nature of these technologies, Google’s choice to engage in China may involve risks and raise ethical concerns,32 especially considering the Chinese party-state’s agenda for and approach to AI.

China’s global AI strategy and ambitions

At the highest levels, the Chinese Government is prioritising and directing strong state support to AI development, leveraging and harnessing the dynamism of tech companies that are at the forefront of China’s AI revolution. The New Generation Artificial Intelligence Development Plan (新一代人工 智能发展规划), released in July 2017, recognised this strategic technology as a ‘new focal point of international competition’, declaring China’s intention to emerge as the world’s ‘premier AI innovation centre’ by 2030.33 The Three-Year Action Plan to Promote the Development of New-Generation Artificial Intelligence Industry (促进新一代人工智能产业发展三年行动计划) (2018–2020), released in December 2017, called for China to achieve ‘major breakthroughs in a series of landmark AI products’ and ‘establish international competitive advantage’ by 2020.34 China’s central and local governments are providing high and ever-rising levels of funding for research and  development on next-generation AI technologies, while seeking to create a robust foundation for innovation by introducing new talent and education initiatives, developing standards and regulatory frameworks, and supporting the availability of data, testing and cloud platforms.35

China’s ambition to ‘lead the world’ in AI is self-evident.

China’s ambition to ‘lead the world’ in AI is self-evident.36 These plans and policies should be contextualised by its tradition of techno-nationalism and current aspirations to emerge as a ‘science and technology superpower’ (科技强国).37 In recent history, indigenous Chinese innovations, particularly defence technological developments, have been advanced and accelerated through licit and illicit means of tech transfer, including extensive industrial espionage.38 However, pursuing a new strategy of innovation-driven development,39 China is actively seeking to progress beyond more absorptive approaches to innovation and instead become a pioneer in emerging technologies, including through increasing investment in basic research.40 To further this agenda, the Chinese government is avidly targeting overseas students and scientists, offering considerable incentives via talent plans and engaging in recruitment via ‘talent bases’ and organisations that are often linked to the CCP or to central or local governments.4142

At this point, the success of these initiatives remains to be seen, and there are even reasons to question whether an AI bubble may arise due to excessive enthusiasm and investments. Although China’s future potential for innovation shouldn’t be dismissed or discounted, this ‘rise’ in AI often generates alarm and exuberance that can distract from recognition of major obstacles that remain. As its plans openly admit, China continues to lag behind the US in cutting-edge research and is attempting to compensate for current shortfalls in human capital.43 Notably, China confronts continued difficulties in the development of indigenous semiconductors,44 which will be critical to the hardware dimension of future advances in AI,45 despite billions in investment and quite flagrant attempts to steal intellectual property from US companies.46

While gradually becoming more capable of truly independent innovation, China also intends to coordinate and optimise its use of both domestic and international ‘innovation resources’.47 Notably, the New Generation AI Development Plan calls for an approach of ‘going out’ (走出去) involving overseas mergers and acquisitions, equity investments and venture capital, along with the establishment of R&D centres abroad.48 For instance, a subsidiary of the China Electronics Technology Group Corporation (CETC), a state-owned defence conglomerate, established an ‘innovation centre’ in Silicon Valley in 2014, which seeks to take advantage of that ecosystem with a focus on big data and other advanced information technologies.49 In Australia,50 CETC established a joint research centre with the University of Technology Sydney (UTS), which will focus on AI, autonomous systems and quantum computing, in April 2017.51 Starting in 2018, CETC’s Information Science Academy is also funding a project at UTS on ‘A Complex Data Condition Based Public Security Online Video Retrieval System’, which could have clear applications in surveillance.52 There have been extensive collaborations on dual-use AI technologies between PLA researchers from the National University of Defence Technology and academics at UTS, the University of New South Wales and the Australian National University.53

Meanwhile, Huawei is actively funding research and pursuing academic partnerships in the US and Australia, including through its Huawei Innovation Research Program.54 China’s ‘One Belt, One Road’ strategy is also concentrating on scientific and technological cooperation, including educational exchanges and research partnerships, such as a new Sino-German joint AI laboratory.55 Some of these new collaborations will focus on robotics and AI technologies, often enabling access to new sources of data that may facilitate China’s emergence as a global leader in AI development.56 In certain instances, China’s provision of funding to these initiatives may also reorient the direction of research based on its own priorities.57

As China seeks to advance indigenous innovation, the strategy of ‘going out’ is complemented by a focus on ‘bringing in’ (引进来) to ensure that vital talent and technologies are drawn back into China.58 At the same time, the Chinese government is evidently seeking to ensure that innovation ‘made in China’ will stay in China. As the US undertakes reforms to CFIUS, China could respond by recalibrating the implementation of its own national security review process, which is ambiguous enough to allow for great discretion in its application, pursuant to an expansive concept of national or state security (国家安全).59 Notably, the State Council has also issued a new notice that requires that scientific data generated within China be submitted to state data centres for review and approval before publication.60 The policy purports to promote open access to and sharing of scientific data within China, while creating ambiguous new restrictions that, depending upon their implementation, could render future cooperation asymmetrical in its benefits.61 Given these factors, while opportunities for research cooperation should often be welcomed, it is also important to ensure transparency regarding the research and intellectual property that may result from it, as well as the security of valuable or
sensitive datasets.

China’s integrated approach to indigenous innovation

In pursuit of its dreams of AI dominance, China is pioneering a new paradigm of indigenous innovation that takes advantage of critical synergies through creating mechanisms for deeper integration among the party-state, technology companies and the military. The CCP seeks not only to support private Chinese companies in their quest for innovation but also to control and guide them, ensuring that the companies serve the needs of the party and don’t become a threat to it. China’s ‘champions’ in AI— Baidu, Alibaba, Tencent and iFlytek—are at the forefront of innovation in the field, and this ‘national team’ will be supported and leveraged to advance state objectives and national competitiveness.62

For instance, Baidu is leading China’s National Engineering Laboratory for Deep Learning Technologies and Applications (深度学习技术及应用国家工程实验室),63 and iFlytek is leading the State Key Laboratory of Cognitive Intelligence (认知智能国家重点实验室).64 It seems likely that the research in these new laboratories will be directed to dual-use purposes. These champions will also undertake the development of new open innovation platforms in AI: Baidu will be responsible for autonomous vehicles, Alibaba Cloud (Aliyun) for smart cities, Tencent for medical imaging and iFlytek for smart voice (e.g., speech recognition, natural-language processing, machine translation, etc.).65 The platforms will be piloted in the Xiong’an New Area, a development southwest of Beijing that’s intended to be a futuristic demonstration of Chinese innovation and to showcase AI technologies and applications in action.66

Meanwhile, Xi Jinping has recently reaffirmed the Mao-era sentiment that ‘the party leads everything’, and China’s advances in AI must also be understood in the context of this system, in which the CCP is steadily increasing its control over private companies.67 In recent years, the CCP has introduced representatives of party branches and committees into notionally private companies,68 which have started to undertake more active ‘party building’ (党建) activities that are intended to expand the CCP’s presence and influence.69 Just about every major tech company, including Baidu, Alibaba, Tencent, Sohu, Sina and NetEase, has a party secretary, who is often a fairly senior figure within the company, and new requirements may even require all listed companies to ‘beef up party building’.70 For example, in March 2017, the CCP Capital Internet Association Commission (中共首都互联网协会 委员会) convened a party committee expansion meeting and a work meeting on grassroots party building that brought together the leaders of many prominent companies.71 At the meeting, Baidu Party Secretary Zhu Guang (朱光), who is also a Senior Vice President responsible for public relations and government affairs,72 talked about innovation in ‘party building work’, including the development of a mobile solution for ‘party building’. He committed Baidu to leveraging its capabilities in big data and AI applications, as well as its ‘ecological advantage’, to enhance the effectiveness of such efforts.73

This blurring of the boundaries between the party-state and its champions may create a tension between national strategic objectives and these companies’ global commercial interests.74 Increasingly, the CCP is even attempting to extend its reach into, and authority over, foreign companies operating in China.75

The dual-use dilemma in China’s AI development

The future trajectory of AI in China will inherently be shaped and constrained by the interests and imperatives of the party-state, and international collaboration with Chinese research institutions and corporate actors needs to be understood, and engaged in, with this important context in mind. Critically, AI will enhance both economic development and military modernization, while reinforcing the party’s ability to control its population through domestic surveillance, all of which are integral to the regime’s security and legitimacy. China’s AI plans and policies include the concern that AI will remain ‘secure and controllable’ (安全 , 可控), given the risks of societal disruption, while highlighting the importance of AI ‘to elevate significantly the capability and level of social governance, playing an irreplaceable role in effectively maintaining social stability’, thus bolstering regime security.76

Indeed, the pursuit of such ‘innovations’ in social governance through big data and AI has included the construction of predictive policing and surveillance capabilities, often developed with the assistance of start-ups such as SenseTime and Yitu Tech, that have often been abused, particularly in Xinjiang.77 Given the party’s attempts to extend its reach—and the trend towards deeper integration in civilian and military AI efforts in China—it can be difficult to disentangle notionally commercial activities from those directly linked to the party-state’s agendas for social control, indigenous innovation and military modernisation.

… a national strategy of ‘military–civil fusion’…

China seeks to take full advantage of the dual-use nature of AI technologies through a national strategy of ‘military–civil fusion’ (军民融合). This high-level agenda is directed by the CCP’s Military–Civil Fusion Development Commission (中央军民融合发展委员会) under the leadership of President Xi Jinping himself.78 Through a range of policy initiatives, China intends to ensure that advances in AI can be readily turned to dual-use applications to enhance national defence innovation. Although the effective implementation of military–civil fusion in AI may involve major challenges, this approach is presently advancing the creation of mechanisms and institutions that can integrate and coordinate R&D among scientific research institutes, universities, commercial enterprises, the defence industry and military units.79 For instance, in June 2017, Tsinghua University announced its plans to establish a Military–Civil Fusion National Defence Peak Technologies Laboratory (清华大学军民融合国防尖端技术实验室) that will create a platform for the pursuit of dual-use applications of emerging technologies, especially AI.80 Notably, in March 2018, China’s first ‘national defence science and technology innovation rapid response small group’ (国防科技创新快速响应小组) was launched by the CMC Science and Technology Commission in Shenzhen,81 and is intended to ‘use advanced commercial technologies to serve the military.’82

China’s AI ‘national champions’ may often be engaged in support of this agenda of military-civil fusion. Notably, in January 2018, Baidu and the 28th Research Institute of the China Electronics Technology Group’s (CETC), a state-owned defence conglomerate, established the Joint Laboratory for Intelligent Command and Control Technologies (智能指挥控制技术联合实验室), located in Nanjing.83 The CETC 28th Research Institute is known as a leading enterprise in the development of military information systems, specializing in the development of command automation systems,84 and it seeks to advance the use of new-generation information technology in defence ‘informatization’ (信息化).85

This partnership is directly linked to China’s national strategy of military-civil fusion, leveraging the respective advantages of CETC and Baidu to take advantage of the potential of big data, artificial intelligence, and cloud computing. Going forward, the new joint laboratory will focus on increasing the level of ‘intelligentization’ (智能化) in command information systems, as well as designing and developing new-generation command information systems ‘with intelligentization as the core.’ Baidu’s involvement in this new laboratory reflects its active contribution to military-civil fusion, a strategy that is resulting in a further blurring of boundaries between commercial and defence developments.

Policy considerations and recommendations

There is no single or simple solution, and policy responses must take into account the inherent complexities of these global dynamics, which necessitate highly targeted and nuanced measures to mitigate risk.86 At the same time, real and serious concerns about China’s exploitation of the openness of our democracies must not lead to reactive or indiscriminate approaches that could cause collateral damage to the inclusivity and engagement that are critical to innovation.

The benefits of scientific collaboration are compelling, and continued cooperation should be supported, with appropriate awareness and safeguards. In future, the quest to achieve an advantage in emerging technologies will only intensify, and the US and Australia must also look to enhance their own competitiveness in these strategic technologies.87

The options for policy response include, but aren’t limited to, the measures detailed below.

Strengthen targeted, coordinated countermeasures.

1: Review recent and existing research and commercial partnerships on strategic technologies that involve support and funding from foreign militaries, governments or state-owned/supported enterprises, evaluating the dual-use risks and potential externality outcomes in each case.

  • ​​Evaluate early-stage research to determine the likelihood that it may turn out to have disruptive dual-use implications in the future.
  • Present a public report with findings and recommendations to raise awareness and ensure transparency.
  • Continue to push back against forced tech transfer in joint ventures.88

2: Explore updates and revisions to national export controls, defence trade controls and investment review mechanisms that take into account the unique challenges of dual-use commercial technologies; communicate those updates clearly and publicly to relevant stakeholders.

  • Share lessons learned and pursue coordination with allies and partners to account for the global scope and scale of these dynamics.
  • Ensure that these restrictions are applied to sensitive datasets associated with AI development, including data used for training purposes.

3: Engage in visa screening of foreign nationals who plan to study or research sensitive or strategic technologies, targeting scrutiny on the basis of whether or not students or researchers have direct and clear connections to foreign militaries, governments or intelligence services.

  • Deny visas to those who are determined to be likely to leverage their studies or research in support of a foreign military that is not a security partner.
  • Incorporate an independent review mechanism into the process to assess evidentiary standards and mitigate risks of bias in visa determinations.

4: Identify organisations engaging in talent recruitment that are linked to the Chinese central and local governments or to the CCP, and require their registration as foreign agents where appropriate.

5: Enhance counterintelligence capabilities, particularly by augmenting language and technical expertise.

Encourage best practices and safeguards for risk mitigation in partnerships and collaborations, with a particular focus on universities.

6: Introduce stricter accountability and reporting requirements, managed by departments of education, which make transparent international sources of funding for research strategic technologies

7: Engage in outreach to companies, universities and think tanks in order to highlight the potential for risk or unintended externalities in joint ventures and partnerships, including through developing and presenting a series of case studies based on past incidents.

8: Propose best practices for future academic collaborations and commercial partnerships, including transparency about the terms for scientific data and intellectual property, as well as clear standards on ethics and academic freedom.

  • Identify favourable domains to sustain open collaboration and engagement, such as issues of safety and standards.

9: Introduce, or where appropriate adjust, policies or guidelines restricting those who work for national or military research institutes and laboratories or receive public funding at a certain level from organisations accepting funding from or collaborating with a foreign military, state-owned enterprise or ‘national champion’ that is not an ally.

Go on the offensive through policies to enhance national competitiveness in technological innovation.

10: Increase and commit to sustaining funding for basic research and the long-term development of AI technologies.

11: Prioritise improving the accessibility and affordability of STEM education at all levels, including creating new scholarships to support those studying computer science, AI and other priority disciplines.

12: Sustain openness to immigration, welcoming graduating students and talented researchers, while potentially offering a fast-track option to citizenship.

13: Pursue closer public–private partnerships through creating new incubators and institutions that create a more diverse and dynamic community for innovation.89

  • Encourage dialogue and engagement between the tech and defence communities on issues of law, ethics and safety.

14: Explore the expansion of alliance coordination and cooperation in defence innovation, including collaboration in research, development and experimentation with new technologies and their applications.

15: Engage with like-minded nations to advance discussions of AI ethics and standards, as well as potential normative and governance frameworks.


Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.

© The Australian Strategic Policy Institute Limited 2018

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers.

  1. Elsa B Kania, ‘The pursuit of AI is more than an arms race’, Defense One, 19 April 2018, online. ↩︎
  2. Kai-Fu Lee, AI superpowers: China, Silicon Valley, and the new world order, Houghton Mifflin Harcourt, 2018, forthcoming ↩︎
  3. For prior writing on these issues, see Elsa Kania, ‘Tech entanglement—China, the United States, and artificial intelligence’, Bulletin of the Atomic Scientists, 5 February 2018, online. ↩︎
  4. For a detailed study on these issues, see Office of the United States Trade Representative, Executive Office of the President, Findings of the investigation into China’s acts, policies, and practices related to technology transfer, intellectual property, and innovation under section 301 of the Trade Act of 1974, 22 March 2018, online. ↩︎
  5. Throughout this policy paper, I use the concept of ‘entanglement’ to characterise the close linkages and range of mechanisms for engagement in the research, development and commercialisation of technologies, particularly in the context of AI. In historical perspective, entanglement, whether in alliances or economics, has proven to be both a factor restraining conflict and a major source of friction. ↩︎
  6. ‘US tech companies and their Chinese partners with military ties’, New York Times, 30 October 2015, online. ↩︎
  7. Clive Hamilton, Alex Joske, ‘Australian universities are helping China’s military surpass the United States’, Sydney Morning Herald, 27 October 2017, online. ↩︎
  8. Josh Chin, Clément Bürge, ‘Twelve days in Xinjiang: how China’s surveillance state overwhelms daily life’, Wall Street Journal, 19 December 2017, online. ↩︎
  9. For the purposes of this paper, I target the proposed policy responses to the context of the US and Australia, but the suggested responses are intended to be applicable to other liberal democratic states. ↩︎
  10. These screenings should not extend to outright restrictions or unwarranted discrimination on the basis of nationality. For a compelling perspective on the imperative of keeping the door open to foreign scientists, read Yangyang Cheng, ‘Don’t close the door on Chinese scientists like me’, Foreign Policy, 4 June 2018, online. ↩︎
  11. For a notable report on these concerns, see Michael Brown, Pavneet Singh, China’s technology transfer strategy: how Chinese investments in emerging technology enable a strategic competitor to access the crown jewels of US innovation, Defense Innovation Unit Experimental (DIUx), January 2018, online. ↩︎
  12. ‘CFIUS reform: House and Senate committees unanimously clear bills that would greatly expand CFIUS authority’, Lexology, 1 June 2018, online. National/State Security Law of the People’s Republic of China [中华人民共和国国家安全法], 7 July 2015, online. For further discussion of the concept of ‘state security’, see Samantha Hoffman, ‘China’s state security strategy: “everyone is responsible”’, The Strategist, 11 December 2017, online. ↩︎
  13. For an interview that describes the campaign from the perspective of an organiser, see ‘Tech workers versus the Pentagon’, Jacobin, 6 June 2018, online. ↩︎

Social Credit

Technology-enhanced authoritarian control with global consequences

What’s the problem?

China’s ‘social credit system’ (SCS)—the use of big-data collection and analysis to monitor, shape and rate behaviour via economic and social processes1—doesn’t stop at China’s borders. Social credit regulations are already being used to force businesses to change their language to accommodate the political demands of the Chinese Communist Party (CCP). Analysis of the system is often focused on a ‘credit record’ or a domestic ranking system for individuals; however, the system is much more complicated and expansive than that. It’s part of a complex system of control—being augmented with technology—that’s embedded in the People’s Republic of China’s (PRC’s) strategy of social management and economic development.2 It will affect international businesses and overseas Chinese communities and has the potential to interfere directly in the sovereignty of other nations. Evidence of this reach was seen recently when the Chinese Civil Aviation Administration accused international airlines of ‘serious dishonesty’ for allegedly violating Chinese laws when they listed Taiwan, Hong Kong and Macau on their international websites.3 The Civil Aviation Industry Credit Management Measures (Trial Measures) that the airlines are accused of violating were written to implement two key policies on establishing the SCS.4

As businesses continue to comply, the acceptance of the CCP’s claims will eventually become an automatic decision and hence a norm that interferes with the sovereignty of other nations. For members of the public on the receiving end of such changes, the CCP’s narrative becomes the dominant ‘truth’ and alternative views and evidence are marginalised. This narrative control affects individuals in China, Chinese and international businesses, other states and their citizens.

What’s the solution?

Democratic governments must become more proactive in countering the CCP’s extension of social credit. This includes planning ahead and moving beyond reactive reciprocal responses. Democratic governments can’t force firms to refuse to comply with Beijing’s demands, but they also shouldn’t leave businesses alone to mitigate risks that are created by the Chinese state’s actions. Democratic governments should identify the potential uses of certain technologies with application to the Chinese state’s SCS that could have serious human rights or international security implications. Export controls that prevent supplying or cooperating to develop such technologies for the Chinese state would buy time, but this is only a short-term and partial solution. Where social credit extends beyond China’s borders, the penetration is often successful through the exploitation of existing weaknesses and loopholes in democratic countries. A large part of the solution for addressing these easily exploitable weaknesses is through strengthening our own democracies. Issues such as data protection, investment screening and civil liberties protection are most pressing. Transparency, while not a solution, will help to identify breaches and to prosecute abuses where necessary. Steps must be taken to shield overseas Chinese communities from the kinds of CCP encroachment that will only proliferate with a functioning and tech-enabled SCS.

China’s social credit system

China’s SCS augments the CCP’s existing political control methods. It requires big-data collection and analysis to monitor, shape and rate behaviour. It provides consequences for behaviour by companies and individuals who don’t comply with the expectations of the Chinese party-state. At its core, the system is a tool to control individuals’, companies’ and other entities’ behaviour to conform with the policies, directions and will of the CCP. It combines big-data analytic techniques with pervasive data collection to achieve that purpose.

Social credit supports the CCP’s everyday economic development and social management processes and ideally contributes to problem solving. That doesn’t make social credit less political, less of a security issue or less challenging to civil liberties. Instead, it means that the threats that this new system creates are masked through ambiguity. For the system to function, it must provide punishments for acting outside set behavioural boundaries and benefits to incentivise people and entities to voluntary conform, or at least make participation the only rational choice.

Social credit and the technology behind it help the Chinese party-state to:

  • Control discourse that promotes the party-state leadership’s version of the truth, both inside and outside China’s geographical borders
  • integrate information from market and government sources, optimising the party-state’s capacity to pre-empt and solve problems, including preventing emerging threats to the CCP’s control
  • improve situational awareness with real-time data collection, both inside and outside China’s geographical borders, to inform decision-making
  • use solutions to social and economic development problems to simultaneously augment political control.

Source: Created by Samantha Hoffman, June 2018.

Extending control outside the PRC’s borders

For decades, the CCP has reached beyond its borders to control political opponents. Tactics are not changing under Xi Jinping, but techniques and technology are. For example, in several liberal democracies, Chinese officials have harassed ‘Xi Jinping is not my president’ activists and their families after messages were posted to WeChat.5 Research for this report also found other examples of harassment, including attempts by Chinese officials to coerce overseas Chinese citizens to install surveillance devices in their businesses.6 More commonly, the CCP doesn’t exert control overseas with direct coercion. Instead, it uses ‘cooperative’ versions of control.

For example, a function of Chinese student and scholar associations — which are typically ties to the CCP7 — is to offer services such as airport pick-up.8 Beyond providing necessary services, these techniques reinforce the simple message that the CCP is everywhere (and so are its rules). Social credit embeds such existing processes in a new toolkit for regulatory and legal enforcement.

On 25 April 2018, the Chinese Civil Aviation Administration accused United Airlines, Qantas and dozens of other international airlines of ‘serious dishonesty’ for allegedly violating Chinese laws in how they listed Taiwan, Hong Kong and Macau on their websites.9 To clarify: those websites, which belong to international companies, are for global clients. The Chinese authorities said failure to classify the places as Chinese property would count against the airlines’ credit records and would lead to penalties under other laws, such as the Cybersecurity Law.

The Planning Outline for the Construction of a Social Credit System (2014–2020) (the Social Credit Plan) specifically identified ‘improving the country’s soft power and international influence’ and ‘establishing an objective, fair, reasonable and balanced international credit rating system’ as goals.10

The goals aren’t credit ratings like those done by Standard & Poor’s or Moody’s, but are instead about ensuring state security. State security here, though, is not the simple protection of domestic and foreign security.11 It’s also about protecting the CCP and securing the ideological space both inside and outside the party. That task transcends geographical borders.

The Civil Aviation Industry Credit Management Measures that the airlines are accused of violating were written to implement two key policy guidelines on establishing China’s SCS. The measures are among many other implementing regulations of the Social Credit Plan. Social credit was used specifically in these cases to compel international airlines to acknowledge and adopt the CCP’s version of the truth, and so repress alternative perspectives on Taiwan. Shaping and influencing decision-making is a pre-emptive tactic for ensuring state security and party control. The CCP deals with threats by ‘combining treatment with prevention, but primarily focusing on prevention.’12 That doesn’t make the outcome less coercive.

Social credit records (for individuals and entities) are the outcome of data integration. Technical capacity for data collection and management, therefore, is the key to realising the envisioned SCS.13 Data integration and management don’t simply aid the process of putting individuals or entities on lists. They also support decision-making—some of which ideally will be done automatically through algorithms—and enhance the CCP’s awareness of the PRC’s internal and external environments. The key to understanding this aspect of social credit is the first line of the Social Credit Plan. The document says that social credit supports ‘China’s economic system and social governance system’.14 Social credit is about problem-solving but it’s also designed to thrive on its own contradictions, just like the social governance process (hereafter ‘social management’) that it supports.15 Social management isn’t simply the management of civil unrest. Social management as a concept requires the provision of services and the use of normal economic and social management to exert political control. Yet therein lies the contradiction: the Chinese state does not prioritise solving problems above political security. In fact, problem solving is simultaneously directed at political security. The system will also increasingly rely on technology embedded in everyday life to manage social and economic development problems while simultaneously using the same resources to expand control. Understanding this dual-use nature of the SCS is the key: the system’s ability to solve and manage problems does not diminish its political or coercive capacity.

Credit records are global and political

A January 2018 article published by the Overseas Chinese Affairs Office of the State Council for the attention of ‘overseas Chinese and ethnic Chinese’ (华侨华人) warned that the Civil Aviation Industry Credit Management Measures also applied to them.16 Violations would lead to greylisting and blacklisting and would be included in individuals’ and organisations’ overall credit records, it said. Importantly, ‘overseas Chinese and ethnic Chinese’ can cover anyone who the CCP claims is ‘Chinese’, whether or not they have PRC citizenship. In addition to expatriates, it can include someone who was never a PRC citizen, such as citizens of Taiwan.17 A PRC-born person with citizenship in another country is also considered subject to the rules.18

Political uses for social credit’s implementing regulations might seem disconnected from the idea that credit records should create trust and encourage moral behaviour, but they are not. ‘Trust’ and ‘morality’ have dual meanings in the context of social credit. One side is focused on the reliability of an individual or entity, and the other on making the CCP’s position in power reliably secure. Trust and& morality serve their purpose only if they’re created on the party’s terms and if they produce reliability in the CCP’s capacity to govern. So the language itself promotes the party’s authority and control.

The market and legal data that make up a person’s or entity’s credit record is intrinsically political, while input sources can be simultaneously political and non-political.19 For instance, Article 8, Section 3 of the Civil Aviation Industry Credit Management Measures sanction individuals and entities for ‘a terrorist event’ or a ‘serious illegal disturbance’. Such disturbances could include safety incidents, such as a passenger opening an emergency exit door in a non-emergency.20 They could also include false terrorism charges against those considered political opponents, such as Uygurs (the CCP already uses false-charge tactics against individuals and NGOs).21 This year’s civil aviation cases are not an irregularity. Similar demands on companies have accumulated since January 2018. For instance, the Shanghai Administration for Industry and Commerce fined Japanese retailer Muji’s Shanghai branch 200,000 yuan (A$41,381) over packaging that listed Taiwan as a country.22 The fine cited a violation of Article 9, Section 4 of the PRC advertising law, which sanctions any activity ‘damaging the dignity or interests of the state or divulging any state secret’. The violation was then recorded on the National Enterprise Credit Information Publicity System.

The timing of these cases coincides with a regulation that took effect on 1 January 2018, under which every company with a business licence in China was required to have an 18-digit ‘unified social credit code’. Every company without a business licence designating its code was required to update its licence.23 Euphemistically, the code is to ‘improve administrative efficiency’.24 ‘Efficiency’ includes the meaning that any sanction against a company filed on the company’s credit record could trigger sanctions under other relevant legislation. Similar cases may multiply after 30 June 2018 because unified social credit codes will also be required for government-backed public institutions, social organisations, foundations, private non-enterprise units, grassroots self-governing mass organisations and trade unions.25

Generating ‘discourse power’ through data

An overlooked purpose of the SCS is to strengthen the PRC’s ‘discourse power’ or ‘right to speak’ (话语权).26 This can also be understood as the idea of creating the CCP’s narrative control. Discourse power is ‘an extension of soft power, relating to the influence and attractiveness of a country’s ideology and value system’.27 Discourse power allows a nation to shape and control its internal and external environments.

In the hands of political opponents, discourse power is a potential threat. According to the CCP, ‘hostile forces’ can incite and exploit economic and social disorder in other countries.28 This threat has been tied directly to leading international credit agencies—Moody’s Investors Service, Standard & Poor’s and Fitch Ratings—seen as potential threats to China. One article claimed that the agencies can ‘destroy a nation by downgrading their credit score, utilising the shock power of “economic nukes”’.29 Another article tied the problem to the One Belt, One Road scheme (Belt and Road Initiative, BRI), because participant countries accept the current international ratings system. For the CCP, the solution is to increase the ‘discourse power [that China’s] credit agencies possess on the international credit evaluation stage’.30 China’s SCS provides an alternative to the existing international credit ratings system. It does some similar things to the existing system, but is designed to give the Chinese state a more powerful voice in global governance. As we saw in the international airlines case, this louder voice is being used to exert influence on the operations of foreign companies.

Preventing the sort of credit crisis described above requires the CCP to have control over the narrative to prevent a political opponent from taking over the narrative—in other words, it requires the CCP to strengthen its ‘discourse power’. Discourse power is directly embedded in the trust and morality that social credit is supposed to create in Chinese society, and not only because trust and morality help with everyday social and economic problem solving. Trust and morality, in the way the Chinese state uses the terms, include as a core concept support for and adherence to CCP control and directions. This linkage can be traced at least as far back as an early 1980s propaganda effort related to ‘spiritual culture’, which responded to ‘popular disillusionment with the CCP’ and the promotion of Western politics as ‘superior’ to China’s.31

The concern only increased as China’s present day perception of threat was shaped by events such as Tiananmen in 1989, Kosovo in 1999, China’s entry into the World Trade Organization, and the ‘colour revolutions’ of the early 2000s. For instance, one article said that, despite mostly positive benefits from China entering the World Trade Organization, ‘Western civilisation-centred ideology, and aggressive Western culture can erode and threaten the independence and diversity of [China’s] national culture through excessive cultural exchanges.’ 32

One reason social credit contributes to strengthening the CCP’s discourse power is that the system relies on the collection and integration of data to improve the party’s awareness of its internal and external environments. In, 2010 Lu Wei described in great detail the meaning of ‘discourse power’ as referring not only to the ‘right to speak’, but also to guaranteeing the ‘effectiveness and power of speech’.33 He elaborated that for China to have discourse power requires both collection power and communication power. Collection power is the ability to ‘collect information from all areas in the world in real time’. Communication power, which ‘decides influence’, becomes stronger with more timely collection.

Data collection supporting China’s environmental awareness doesn’t stop at the country’s borders. Social credit requires real-time monitoring through big-data tools that can inform decision-making and the implementation of the credit system. In 2015, Contemporary World, a magazine affiliated with the International Liaison Department, published an article focused on big-data collection associated with the BRI.34 It said that data could be used to inform diplomatic and economic decision-making, as well as emergency mobilisation capacity. ‘Data courier stations’ within foreign countries would send data via back-ends to a centralised analysis centre in China. Data collection would come from legal information mining, such as information on the internet and database purchases, and from market operations. The data courier stations would include ‘e-commerce (platforms), Confucius Institutes, telecoms, transportation companies, chain hotels, financial payment institutions and logistics companies’.35

The collection method and use of data would differ according to the source. The most obvious and practical reason for data collection at Confucius Institutes is to support teaching. Eventually, the same data would inform decisions on cultural exchange (ostensibly using Confucius Institute databases).36 The objective of ‘cultural exchange’ isn’t merely soft power creation. As ‘discourse power’ suggests, the CCP views ‘language’ as a ‘non-traditional’ state security issue and a means of influencing other states, businesses, institutions and individuals. One publication on the BRI linked to the propaganda department explained that ethnic minorities in China ‘use similar languages to others outside of our borders and are frequently subjected to hostile forces outside of the border’. To reduce the ‘security risk’, ‘resource banks’ or ‘language talent’ projects would support the automatic translation of both Chinese and non-common ‘strategic languages’.37 Automatic translation would help to ‘detect instability in a timely manner, [assist] rapid response to emergencies, and exert irreplaceable intelligence values over the course of prevention, early warning and resolution of non-traditional security threats, in order to ensure national security and stability’.38

According to the Ministry of Education, automatic translation would be implemented through technologies such as big data, cloud computing, artificial intelligence and mobile internet. 39 This kind of technology already supports online teaching platforms affiliated with Confucius Institutes. They are at least partly reliant on technology from Chinese firm iFlytek. In addition to language learning software, iFlytek develops advanced surveillance for ‘public security’ and ‘national defence’, including voice recognition and keyword identification.40 Data collection and integration serve the purpose of increasing real-time situational awareness and simultaneously support the SCS’s discourse power objectives.

Technology, social management and economic development

The CCP saw crises such as the colour revolutions in Central Asia and Europe as illustrations of potential risks to its own power in China. Increasing the party’s discourse power has been justified as one response. The CCP’s perception of its exposure to risk increased with events such as the milk powder scandal in 2008 and the SARS outbreak between 2002 and 2003.41 Each crisis revealed significant problems with the PRC’s crisis prevention and response capacity due to a combination of political, logistical and technical faults.42 The SCS is part of an attempt to address those faults and to prevent the party’s competence or legitimacy from being questioned.

An innocuous line in the Social Credit Plan called for ‘the gradual establishment of a national commodity circulation (supply chain) traceability system based on barcodes and other products’.43 Barcodes are commonly used in supply-chain management to improve product traceability. ‘Other products’ include radio-frequency identification (RFID), which is also used for supply-chain management. RFID is an electronic tagging technology, readable through sensors or satellites, that ‘would gradually replace barcodes in the era of the internet of things’.

Most narrowly and directly, ‘barcodes and other products’ will help to manage food safety and health risks. The integration of information, supported by technology, facilitates risk identification. As technology’s ability to effectively identify risks improves, the government would be able to improve the regulation of behaviours that heighten ‘risk’, as defined and perceived by the CCP. As a result, potentially destabilising crises can be prevented through the optimisation of everyday governance tasks.

In future, the technologies used for supply-chain management will form an integral part of China’s development of ‘smart cities’. Smart cities in China harness ‘internet of things’ technology in support of resource optimisation and service allocation for both economic development and social management. A plan for standardising smart cities in China said that data mining using chips, sensors, RFID and cameras contributes to processes such as ‘identification, information gathering, surveillance and control’ of infrastructure, the environment, buildings and security within a city.44 Data mining covers such areas as ‘automatic analysis, classification, summarization, discovery and description of data trends’, and can be applied to decision-making about a city’s ‘construction, development and management’.45

All of these things contribute to building the capacity to make decisions and prevent threats from emerging by early intervention. Social credit will require big-data integration and data recording through information systems. Real-time decision-making capabilities are central to the success of the monitoring and assessment systems discussed in the Social Credit Plan, particularly in areas such as traffic management and e-commerce. Decision-making is enabled through ‘decision support systems’, which provide support for complex decision-making and problem solving.46 In China, present-day research emerges from a field called ‘soft science’ (软科学) that developed in the 1980s.47

Soft science is defined in China as a ‘system of scientific knowledge sustaining democratic and scientific decision-making’ that can be used in China to ‘ensure the correctness of our decision-making and the efficacy of our execution.’48 Correctness has as much a political meaning as its more usual one.

The use of decision support systems directly contributes to mechanisms for crisis prevention and response planning. Technologies such as barcodes and RFID are found in the logistical mobilisation strategies of many countries, not just the PRC. In China, however, civilian resources are multi-use, with simultaneous economic and social development and political control functions. The same systems support mobilisations for crises. At a study session on a speech that Xi Jinping gave at the 13th National People’s Congress, delegates from the People’s Liberation Army and People’s Armed Police learned about ‘infrastructure construction and resource sharing’. Efforts to improve those areas would support a ‘coordinated development of social services and military logistics’, while utilising various strategic resources and strength in areas such as politics, the economy, the military, diplomacy and culture. 49

This integration of technology with social management, political control and economic development brings back into focus the concept of discourse power. Like the other aspects of social credit, those systems don’t stop at China’s borders. As part of the BRI, China plans to leverage smart cities, and technologies such as 5G, to ‘create an information superhighway’. 50 Combined with channels for information collected from projects ranging from logistics to e-commerce or Confucius Institutes, information can be integrated to support social credit objectives such as increased discourse power.

Future challenges and recommendations

How social credit will exactly develop is not entirely known because the system itself is a multi-stage, multi-decade project. In order to deal with the international consequences of social credit, foreign governments must act now while also applying long-term strategic thought and commitment to dealing with the international elements of this system. Although China’s development of the SCS can’t be stopped, its progress can be delayed and the system’s coercive aspects reduced while better solutions for dealing with the problem are found.

Recommendation 1: Control the export of Western technologies and research already used in—and potentially useful to—the Chinese state’s SCS.

Recommendation 2: Review emerging and strategic technologies, paying particular attention to university and research institute partnerships.

Controlling the export of Western technology is a key short-term solution. Governments should review strategic and emerging technologies that are already or could be used in the SCS. Universities and research organisations partnering with Chinese counterparts and contributing to the development or implementation of the CCP’s SCS should be included in this review. Universities can’t be blind to the impact and end uses of research that they conduct or contribute to with overseas partners. Besides the clear political and social control purposes, contributing to such a system also doesn’t align well with the ethical framework for most Western universities’ research; nor is it good for their global reputations. The findings of such reviews should help Western governments determine where to control access and what legislation is therefore appropriate.

Obvious starting points would be preventing situations such as, for example, the University of Technology Sydney’s Global Big Data Technologies Centre accepting $20 million from the state-owned defence enterprise China Electronics Technology Group Corporation (CETC).51 CETC is one of the key state-owned enterprises behind China’s increasingly sophisticated video surveillance apparatus, including facial recognition systems and scanners. One of University of Technology Sydney’s most recent 2018 CETC-funded projects is in fact research on a ‘public security online video retrieval system’.52 Another example that highlights policy gaps is the recently reported case in which surveillance technology developed by Duke University and originally intended for the US Navy was sold into China with ‘clearance from the US State Department’ because the technology failed to secure backing in the US.53

Recommendation 3: Strengthen democratic resilience to counter foreign interference.

At least part of the solution requires acknowledgement that the spread of social credit beyond China’s borders takes advantage of easily exploitable weaknesses. The problems are compounded when a government opposed to liberal democratic values and institutions exploits those weaknesses. Australia’s foreign interference law could provide a framework for other countries looking to deal with the problem via legislation, as increased transparency is a foundation for an informed response.

Recommendation 4: Fund research to identify dual-purpose technologies and data collection systems.

While it isn’t a complete solution, funding research that contributes to greater transparency and public debate about China’s SCS is very important. Understanding what the Chinese state is doing, and what the implications are for other countries, requires asking the right questions. The problem is not just technology per se, but the ways in which processes and information are used to feed into and support the SCS, as well as other technology-enabled methods of control.

Recommendation 5: Governments and entities must strengthen data protection.

A crucial step is to limit the way data can be exported, used and stored overseas. Auditing should be conducted to ensure that any breaches are detected and to identify loopholes. For example, in the case of Confucius Institutes mentioned above, any data collected for any purpose should be stored using university-owned hardware and software, and only in university-operated databases. In the case of any violations, the university’s obligations to protect privacy and personal data on individuals that it holds should be enforced.

Recommendation 6: New legislation should reflect that this is also a human rights issue.

China’s SCS is not only an issue of political influence and control internationally. It’s also a human rights issue, and new legislation should reflect that. Through contributions to smart cities development in China, for example, Western companies are providing support to build a system that has multiple uses, including uses that are responsible for serious human rights violations. The US’s Global Magnitsky Act is an example of the type of legislation that could be used to hold companies and entities accountable for—willingly or not—enabling the Chinese party-state’s human rights violations.

Recommendation 7: Support companies threatened by China’s social credit system

Western governments need to more actively and publicly support the private sector in mitigating risks that are created by the SCS. This should include collective counter-measures that impose costs for coercive acts.

Recommendation 8: Overseas Chinese communities must be protected from social credit’s overseas expansion.

Western governments must take steps to protect overseas Chinese from the kinds of CCP encroachment that have taken place for decades but that are now increasingly augmented through a functioning and tech-enabled SCS. Democratic governments must ensure that they legislate against the implementation and use of China’s SCS across and within their borders.


Acknowledgements

The author would like to thank Danielle Cave, Didi Kirsten Tatlow, Dimon Liu, Gregory Walton, Kitsch Liao, Nigel Inkster, Peter Mattis, Fergus Ryan and Rogier Creemers, as well as the Mercator Institute for China Studies. Disclaimer: All views and opinions expressed in this article are the author’s own, and do not necessarily reflect the position of any institution with which she is affiliated.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.

© The Australian Strategic Policy Institute Limited 2018

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers.

  1. Samantha Hoffman, ‘Managing the state: social credit, surveillance and the CCP’s plan for China’, China Brief, Jamestown Foundation, 17 August 2017, 17(11), online. ↩︎
  2. Concepts summarised in this paper, including on social management, pre-emptive control, social credit and the ‘spiritual civilisation’, crisis response and threat perceptions, are drawn from my PhD thesis: Samantha Hoffman, ‘Programming China: the Communist Party’s autonomic approach to managing state security’, University of Nottingham, 29 September 2017. ↩︎
  3. China Civil Aviation Administration General Division, ‘关于限期对官方网站整改的通知’ (‘Notice Relating to Rectification of the Official Website within a Specified Timeframe’), 25 April 2018; James Palmer, Bethany Allen-Ebrahimian, ‘China threatens US airlines over Taiwan references’, Foreign Policy, 27 April 2018, online; Josh Rogin, ‘White House calls China’s threats to airlines “Orwellian nonsense”’, The Washington Post, 5 May 2018, online. ↩︎

  4. The two key guidances directly referred to in the opening of the Civil Aviation Industry Credit Management Measures (Trial Measures) are the Planning Outline for the Construction of a Social Credit System (2014–2020) and 关于印发《民航行业信用管理办法(试行) 》的通知 (Civil Aviation Industry Credit Management Measures (Trial Measures)), 7 November 2017. ↩︎

Big data in China and the battle for privacy

Big data in China and the battle for privacy

Introduction

If data is the new oil, China is oil super-rich. Data is the essential ingredient for artificial intelligence (AI) and is underpinning a wide-ranging revolution.

China’s massive population, lack of privacy protections, controlled tech sector and authoritarian system of governance give it a huge edge in collecting the data needed for that revolution (Figure 1). But the Chinese state and Chinese businesses are also using this wealth of data to pursue state and business goals without the constraints present in other jurisdictions. A lack of privacy protections and rule-of-law protections leaves Chinese citizens at the whim of sophisticated, and often state-controlled, data-driven technologies.

Private companies are not only sharing users’ personal data with the authorities in compliance with China’s regulatory environment such as the most recent Cybersecurity Law but many of those companies—including the industry leaders—are building their business model predominantly around the needs of the state.

The success of these technologies in enabling potential mass surveillance and exerting a chilling effect on individuals deserves more attention.

Figure 1: Top 20 internet populations, by country

This paper examines Chinese state policy on big data industries and analyses the laws and regulations on data collection that companies in China are required to comply with. It also looks at how those rules may affect foreign companies eyeing the China market. Case studies are included to demonstrate the ongoing tensions between big data applications and privacy. The paper concludes by outlining the implications and lessons for other countries.

An ambitious big data vision supported by China’s internet companies

China’s State Council has laid out an ambitious road map outlining its AI vision, which includes creating a US$150 billion industry and becoming the world leader in AI by 2030.1 Enormous state financial backing aside, a controlled tech industry,2 huge data availability and relatively scant privacy protections mean that China is well placed to become a global AI leader; or, to be more accurate, a leader in the development of big-data-driven technologies. 

China’s online ecosystem is unique compared to Western equivalents. Unlike their Silicon Valley competitors, Chinese technology and internet companies typically design their products to include not just one, but various types of services. Tencent’s WeChat, for example, China’s most popular mobile chat application, is more than an instant messaging app: it’s an all-in-one superapp. A billion active WeChat users now use it to chat with their friends and families, communicate with supervisors and
work colleagues, play games, hail taxis, make online purchases and conduct financial investments.3 WeChat is now even used to handle sensitive government paperwork, such as visa applications, and could soon be used for entry into Hong Kong.4

Tencent vowed—openly and ambitiously—to become the fundamental platform for the Chinese internet: a platform ‘as vital as the water and electricity resources in daily life’.5 Alibaba’s Alipay, China’s Paypal-like e-payment service, has incorporated social functions through which it encourages users to share location data, personal information and purchasing habits with others. Combined with China’s real-name registration system,6 these consolidated functions enable the government and industry
to effortlessly profile individual users. In addition, even when an individual’s information has been anonymised, their identity can still be re-identified by any interested parties if they have access to two or more sets of data to find the same user in both. In other countries, such identification would attract public concern, but research indicates that there’s a lack of awareness and a willingness to trade off privacy for lower cost services among Chinese consumers.7 For example, research that compared global consumers’ views on sharing personal information online found that consumers in China had a more lackadaisical attitude towards privacy protection than consumers in most Western countries.8

Big data analytics offers invaluable insights to inform the use and delivery of public goods, including increased public safety, law enforcement, resource allocation, urban planning9 and healthcare systems.10 But how data is collected and used affects a country’s digital ecosystem and its citizens’ social and political participation. How China’s regulatory environment handles these interactions is analysed in the following section.

Big data and public security

China is placing huge bets on big data, and a range of policies have been introduced over the past two years to flesh out the government’s vision. On October 18 2017, Chinese President Xi Jinping promoted the integration of the internet, big data and AI with the real-world economy in his 19th Party Congress report.11 But China’s interest in big data can be dated to as early as the early 2010s. In July 2012, the State Council specifically mentioned the importance of ‘strengthening the development of basic software—especially those that are able to handle large volumes of data’—in a policy document in its 12th Five-Year Plan . The current administration has beefed up the conceptualisation of China’s big data vision.

Chinese Premier Li Keqiang, for example, proposed the concept of ‘Internet Plus’ (互联网+),12 calling for the integration of mobile internet, cloud computing, big data and the ‘internet of things’ with modern manufacturing in his March 2015 Government Work Report.13

In the months following Li’s report, China’s central government released a number of top-down designs and guidelines on big data policies (Table 1). By the end of 2016, various government bureaucracies 14 and more than 20 provincial and municipal governments issued their own regulations and development plans for big data industries.15 Unsurprisingly, most of these government initiatives and policies have a special interest in developing and supporting big data technologies that can be applied to the security sector. Security experts argue that contribution to the emerging social credit system is likely as part of these related initiatives.16 Statistics from 2016 show that most of the government’s domestic government investment in big data industries has gone to public security projects.17

Table 1: Major big data policies issued by the Chinese Government

TitleIssuerDate issuedMain takeaways
Made in China 2025 《中国制造2025》, onlineState CouncilMay 2015Lays out a road map for the transformation and upgrade of China’s traditional and emerging manufacturing industry, with a focus on big data, cloud computing, the internet of things and related smart technologies. (a)
Action Outline for
Promoting the
Development of Big Data
《促进大数据发展行动纲
要》, online
State CouncilAugust 2015Provides a top-down action framework for promoting big data. Details yearly goals such as establishing a platform for sharing data between government departments by the end of 2017, a unified platform for government data before the end of 2018, and nurturing a group of 500 companies in the industry, including 10 leading global enterprises focused on big data application, services and manufacturing by the end of 2020. It is widely perceived to be a programmatic document guiding the long-term development of China’s big data industries.
Outline of the 13th Five-Year Plan for the National Economic and Social Development of the People’s Republic of China 《中华人民共和国经济和 社会发展第十三个五年规 划纲要》, online.National People’s CongressMarch 2016Identifies big data as a ‘fundamental strategic resource’ (基础性战略资源). Pushes for further sharing of data resources and applications. Lists big data applications as one of the eight major informatisation projects. It’s the first time China incorporated big data into state-centric strategy plans. (b)
The National Scientific and Technological Innovation Planning for the 13th Five Years 《’十三五’国家创新规划》, online.State CouncilJuly 2016Prioritises big-data-driven breakthroughs in AI technologies.
Development Plan for Big Data Industries (2016–2020) 《大数据产业发展规划 2016-2020年)》, online.Ministry of Industry and Information TechnologyDecember 2016Sets an overarching goal for China’s big data industries: by 2020, related industry revenue should exceed 1 trillion RMB, with a compound annual growth rate of 30%.

a) 徐永华,陈怀宇, 陈亦恺, Anthony Marshall, 何志强,夏宇飞, 温占鹏,张龙,孙春华, ‘中国制造业走向2025 构建以数据洞察为驱动的新价值网络’,IBM商业价值研究院, 中国电子信息产业发展研究院, 13 October 2015 online.

b) 林巧婷, ‘我国首次提出推行国家大数据战略’ 中央政府门户网站, 3 November 2015 online.

In the outline of the 13th Five-Year Plan, big data applications were listed as one of the eight major ‘informatisation’ projects. Informatisation (信息化)—the process by which the political, social and economic interactions in a society have become networked and digitised—cannot be overstated when analysing China’s big data vision, especially in the public security sector. Over the past two decades, the Ministry of Public Security has taken an adaptive approach to this trend. It has made continuous efforts18 to harness the advances of information and communications technologies for security operations—a process called ‘public security informatisation’ (公安信息化). At its core, public security informatisation relates to shifting police work from reactive to pre-emptive through the use of data collection and synthesis. “Security” is a broad concept when applied by the Chinese state and is sufficiently broad to enable the control and censoring of public debate in ways that may affect the power or standing of the ruling Chinese Communist Party.

A few statistics help put these concepts and policies in context. Across China, there’s a network of approximately 176 million surveillance cameras—expected to grow to 626 million by 202019—that monitor China’s 1.4 billion citizens. Powered by big-data-driven facial recognition technology, these cameras are able to identify a person’s name, identification card number, gender, clothing and more. Meanwhile, Chinese police have reportedly been collecting DNA samples, fingerprints, iris scans, and blood types of all residents, using questionable methods, in places such as Xinjiang.20

Backed by an oceanic amount of data and advanced analytic technologies, Chinese public security forces are emerging as a powerful and dominant intelligence and security sector.21 The interest from the public security forces in using big data to support government systems for faster and more extensive surveillance and social control largely explains the rapid rise of China’s big data industries.22

Private companies are not only sharing users’ personal data with the authorities in compliance with China’s Cybersecurity Law,23 the National Intelligence Law24 and other relevant internet management regulations, but many of them—including the industry leaders25—are building their business model predominantly around the needs of the state.

Diminishing rights: China’s data laws and regulations

On the other end of the spectrum of the all-encompassing, data-driven analytic technologies are citizens’ de facto diminishing rights to privacy and growing challenges of protecting individuals’ data security. In contrast to the wide scope of central- and local-level policy initiatives and government-backed projects on big data collection and use, there’s no uniform law or a national authority to ensure or coordinate data protection in China. Privacy advocates have been striving to have a national privacy protection law passed since 2003.26 Fifteen years later, the National People’s Congress, China’s highest legislative body, still has not included such uniform law in its agenda.27

A number of articles in China’s recent Cybersecurity Law pertain to data collection and privacy protection. However, they take a state-centric approach, expanding the government’s direct involvement in companies’ operations. Missing in this approach is any support for an independent privacy watchdog or support for independent civil society organisations. For now, regulations on data protection remain largely domain-specific, such as those relating to telecommunications and online banking, which are issued by different ministries or local governments (Table 2 summarises the main relevant regulations in China).

Table 2: Chinese laws, regulations and guidelines on data collection

TitleIssuerDate issuedRelevance
Information Security Technology: Guidelines for Personal Information Protection Within Public and Commercial Services Information Systems 《信息安全技术公共及商用服务信息系统个人信息保护指南》, online.General Administration of Quality Supervision, Inspection and Quarantine & Standardisation Administration of ChinaNov 2012Establishes basic principles for personal data collection, processing and transfers, including the principles of ‘parity of authority and responsibility’, ‘minimum necessary and not excessive’ and ‘consent of the individual’. Remains non-compulsory for companies
Decision on Strengthening Information Protection on Networks 《关于加强网络信息保护的 规定》, online.Standing Committee of the National People’s CongressDec 2012Specifies that the state protects ‘electronic information by which individual citizens can be identified and which involves the individual privacy of citizens’.
Provisions on Protecting the Personal Information of Telecommunications and Internet Users 电信和互联网用户个人信息保护规定, online.Ministry of Industry and Information TechnologyJuly 2013Regulates how telecommunications and internet service providers may collect and use users’ personal data.
Regulation on the Administration of Credit Investigation Industry 征信业管理条例, online.State CouncilJan 2013Encompasses China’s grand plan of building a ‘social credit system’. Regulates the collection, storage and processing of personal information by credit investigation enterprises. Article 14 points out that ‘credit investigation institutions are prohibited from collecting information about the religious belief, genes, fingerprints, blood type, disease or medical history of individuals, as well as other individual information the collection of which is prohibited by laws or administrative regulations.’
Amendment (IX) to the Criminal Law of the People’s Republic of China 刑法修正案(九), online.Standing Committee of the National People’s CongressAug 2015Criminalises the sale or provision of citizens’ personal data, with a penalty of up to seven years imprisonment.
Cybersecurity Law 网络安全法, online.Standing Committee of the National People’s CongressNov 2016Article 76 (5) defines ‘personal information’ in legal documents for the first time. ‘Personal information’ refers to all kinds of information, recorded electronically or through other means, that can determine the identity of natural persons independently or in combination with other information, including, but not limited to, a natural person’s name, date of birth, identification number, personal biometric information, address and telephone number.
E-commerce Law (draft) 电子商务法 (草案)Under review by Standing Committee of the National People’s CongressMay be passed in 2018Regulates data collection by e-commerce operators
Interim Security Review Measures for Network Products and Services 《网络产品和服务安全审查办法(试行)》, online.Cyberspace Administration of ChinaMay 2017Specifies that a cybersecurity review will include reviewing risks that product or service suppliers illegally collect, store, process or use user-related information while providing products or services.
Information Security Technology: Personal Information Security Specification 《信息安全技术 个人信息安全规范》, online.General Administration of Quality Supervision, Inspection and Quarantine & Standardisation Administration of ChinaDec 2017 (took effect in May 2018)Clarifies the definition of ‘personal sensitive information’, which includes information on one’s wealth, biometrics, personal identity, online identity identifiers and so on. Remains non-compulsory for companies

The lack of a legal framework on privacy protection has led to open disputes over who has access to user data. One of the most high-profile cases is the dispute between Tencent, China’s first internet giant to enter the elite US$500 billion tech club,28 and Huawei, the Chinese telecom equipment and smartphone maker. Huawei was seeking to collect user data from Tencent’s WeChat, China’s most popular chat app, installed on its Honor Magic phone. The data would help Huawei advance its AI projects. Tencent was quick to object, claiming it would violate user privacy and demanded that the Chinese Government intervene.29 Huawei argued that users have the right to choose whether and with whom their data is shared. The government suggested the two companies ‘follow relevant laws and regulations’,30 but existing regulations fail to specify who can collect and process user data.31 It’s still unclear how the two settled the dispute—or even whether they’ve settled it.32

Huawei and Tencent aren’t the first Chinese tech giants to rub shoulders other over access to data. In June 2017, Alibaba’s logistics arm, Cainiao, and China’s biggest private courier, SF Express, were in a month-long stand-off over access to consumer data. The fight was eventually resolved with the State Post Bureau’s intervention.33 Cainiao and SF Express both cited noble-sounding reasons, such as ‘data security’ and ‘user privacy’, for refusing to share data with each other, but the dispute was really about protecting their commercial interests and determining who had access to merchant and shopper data on China’s US$910 billion online retail market.34 In the case of Huawei versus Tencent, it’s about who may get to dominate the AI race with the help of massive amounts of data, including users’ chat logs. Due to a void in the current legal framework, it’s likely that disputes between companies over user data access will continue.

Lack of transparency and accountability

Most of the regulations are aimed at holding companies and individuals—rather than government bodies—accountable for data collection and protection. By contrast, government authorities now have access to more sensitive personal data than ever (through either court orders or surveillance). In addition, law enforcers are requiring companies to ensure a longer period of data retention and zero exemptions from real-name registration policies.

In June 2016, for example, China’s Cyberspace Administration issued the Provisions on the Administration of Mobile Internet Applications Information Services (移动互联网应用程序服务管理规定),35 which require, among other things, that:

  • app providers and app stores cooperate with government oversight and inspection
  • app providers keep records of users’ activities for 60 days
  • app providers ensure that new app users register with their real names by verifying users’ mobile phone numbers, other identifying information, or both.

In September 2016, Chinese authorities issued new regulations stating explicitly that user logs, messages and comments on social media platforms such as WeChat Moments—a feature that resembles Facebook’s timeline feed—can be collected and used as ‘electronic data’ to investigate legal cases.36 Cases of WeChat users being arrested for ‘insulting police’37 or ‘threatening to blow up a government building’38 on Moments indicate that the feature may be subject to monitoring by the authorities or the company.

Observers have raised concerns over authorities’ use of big-data-driven and AI-enabled technologies such as facial recognition and voice recognition, which may lead to an all-seeing police state. iFlytek, a Chinese information technology company designated by the Ministry of Science and Technology to lead the country’s speech recognition development, has partnered with the Ministry of Public Security to develop a joint research lab. According to a report by the company, it has also partnered
with local telecommunication companies in eastern Anhui Province to establish a surveillance system that ‘notifies public security departments as soon as a suspicious voice is detected’.39 In the highly restricted Xinjiang region, local authorities are reportedly collecting highly sensitive personal information, including DNA samples, fingerprints and iris scans.40

A case that demonstrates ongoing tensions between big data applications and privacy concerns in China is the building of a national social credit system 社会信用体系 (SCS), which is the subject of a forthcoming ICPC policy brief by Samantha Hoffman. The SCS, currently planned for a full launch by 2020, aims to aggregate data on the country’s 1.4 billion citizens and assign each person a credit rating based on their socioeconomic status and online behaviour.41 So far, there’s little detail on exactly
how the system will unfold. Some companies and local governments have created their own systems (such as Tencent’s Tencent Credit,42 Alibaba’s Sesame Credit43 and many other social credit products developed by smaller players).44 While a final reward and punishment mechanism remains uncertain, existing reports show some consistent themes. For example, based on their social credit score and behaviours that affect one’s credit, a citizen’s access to aeroplane or express train travel will be denied and their privileges, such as faster visa approval and easier access to apartment rentals, will be restricted if the person has a bad social credit score.

The justifications for this scheme include the idea that it’s a remedy for the deficit of trust in society.45 Southern Metropolis Daily, a Guangzhou-based liberal-leaning newspaper, surveyed 700 people on their attitudes towards China’s social credit system in 2014.46 It found that even though 40% of the respondents expressed privacy concerns, 80% were in support of this national program because ‘it helps build a society of trust’ and ‘provides a safer and more reliable environment for business’. Yet, the complete lack of transparency and clarity on data protection raise the alarming prospect of big-data-enabled mass surveillance in China and other authoritarian states.

Both Alibaba47 and Tencent48 have rolled out their own versions of social credit systems, which offer a holistic assessment of character based on vaguely defined categories and non-transparent algorithms.49 According to material collected by researchers at the University of Toronto’s Citizen Lab, the chief credit data scientist of Alibaba’s Ant Financial, Yu Wujie, has said, ‘If you regularly donate to charity, your credit score will be higher, but it won’t tell you how many payments you need to make every month … but [development] in this direction [is undertaken with] the hope that everyone will donate.’50 Tencent has revealed little about its credit system thus far, but the company already has access to a huge amount of users’ social data, including chat logs, via WeChat, QQ and many of its gaming products.

Due to the lack of data protection laws, few, including state regulators, have an understanding of what kinds of data a private company can access and use.51 It’s also unclear whether online comments and activities deemed undesirable by the government would negatively affect a person’s creditworthiness. The scheme is wide open to abuse by government authorities, including in tracking dissidents and exerting chilling effects on ordinary citizens.52

International implications

The tensions between privacy protection and data collection will be felt not only in China. In recent years, companies and governments in both authoritarian and democratic countries have vowed to develop big-data-based surveillance technologies and tighten internet management in the name of public and national security.53

At the international level, cross-border transfers of personal information, courtesy of the increasingly interdependent global economy in the age of big data, have become a pressing issue for private and state actors. Following the enactment of the Cybersecurity Law, which sets data localisation requirements, China has released administrative documents and guidelines detailing the conditions companies need to meet for data export (Table 3).

Table 3: Regulations on cross-border data transfer or data export

TitleIssuerDate issuedRelevance
Cybersecurity Law 网络安全法, online.Standing Committee of the National People’s CongressNov 2016Article 37: Personal information and important data collected and generated by critical information infrastructure operators in China must be stored domestically. For information and data that is transferred overseas due to business requirements, a security assessment will be conducted in accordance with measures jointly defined by China’s cyberspace administration bodies and the relevant departments under the State Council. Related provisions of other laws and administrative regulations shall apply.
Circular of the State Internet Information Office on the Public Consultation on the Measures for the Assessment of Personal Information and Important Data Exit Security (Draft for Soliciting Opinions) 《个人信息和重要数据出境 安全评估办法(征求意见稿)》, online.Cyberspace Administration of ChinaApr 2017Extends the scope of outbound data security assessment. While the Cybersecurity Law requires security evaluations to be conducted on critical information infrastructure operators (关键信息基础设施运营者), the measures stipulate that all network operators (网络运营者) must go through the check. Establishes the basic framework for outbound data security assessment, including its processes, responsible parties and main focuses.
Information Security Technology: Guidelines for Data Cross-Border Transfer, online. Security Assessment (second draft), online. 《信息安全技术 数据出境安 全评估指南 (第二稿)》National Information Security Standardisation Technical CommitteeAug 2017Clarifies the definition of data cross-border transfer, which is ‘the one-time or continuous activity in which a network operator provides personal information and important data collected and generated by network or other means in the course of operations within the territory of China to overseas institutions, organisations or individuals by means of directly providing or conducting business, providing services or products, etc.’ Further breaks down the conditions for initiating security self-assessment, government assessment and their processes. Details what is ‘important data’ and ‘personal data’. Non-compulsory for companies.

Under these regulations, foreign companies will have to either invest in new data servers in China that may be subject to monitoring by the government or incur new costs to partner with a local server provider, such as Tencent or Alibaba. Apple’s recent decision to migrate its China iCloud data to Guizhou Big Data and Amazon’s sell-off of its China cloud assets to its local Chinese partner are just two examples of how China’s tightening rules on data retention and transfers may affect foreign companies. By requiring data localisation, the Chinese Government is bringing data under Chinese jurisdiction and making it easier to access user data and penalise companies and individuals seen as violating China’s vaguely defined internet laws and regulations.

Meanwhile, Chinese-manufactured tech devices and applications that have taken over large portions of overseas markets are raising questions about data security. The Australian Defence Department has recently banned staff and serving personnel from downloading WeChat, China’s most popular social media app, onto their work phones.54 The heads of six top US intelligence agencies, including the Federal Bureau of Investigation, the Central Intelligence Agency and the National Security Agency, told the Senate Intelligence Committee in February that they would not advise Americans to use products or services from Chinese telecommunications companies Huawei and ZTE. In April 2018, the tension escalated into a seven-year ban imposed by the US Commerce Department, prohibiting American companies from selling parts and software to ZTE, although at the time of publishing it’s unclear whether this ban will be enforced or overturned.55 In December 2017, the Ministry of Defence in India issued a new order to the Indian armed forces requiring officers and all security personnel to remove more than 42 Chinese apps, including Weibo, WeChat and UC Browser, which were classified as ‘spyware’.

Conclusion

This paper highlights the conflict between the fast-developing big data technologies and citizens’ diminishing rights to privacy and data security in China. A review of major Chinese big-data-related policy initiatives shows that many of those policies reflect special interest from Chinese authorities, its public security forces in particular, in potentially using data-driven analytic technologies for more effective and extensive surveillance and social control.

Compared to the growing number of regulations and national plans that support the research and development of big data technologies, there’s a lack of data protection laws and guidelines to hold relevant parties, especially the government, accountable for the collection and use of personal data. The ambivalent legal framework of data security and privacy protection, which enables state use of collected data, has led to multiple incidences of commercial disputes over access to users’ data. It’s likely we’ll see more such cases in the future.

Addressing these conflicts and advocating for the protection of users’ rights to privacy in China—where the state dominates every sector of society and suppresses civil society—is not easy. The Chinese state’s approach is a reminder to users, both in China and elsewhere, of the importance of protecting personal privacy and online security.

Using China as a case study also offers a number of takeaways for policymakers in other countries. International developments, such as ongoing privacy issues with Facebook data, show that tension between governments, businesses and users in the age of big data is not unique to any country. To that end, the EU’s General Data Protection Regulation has set a good example for containing companies’ exploitation of personal data.

There’s a trend, in China and elsewhere, for governments to use the excuse of ‘protecting user privacy’ to justify a more powerful state and more state involvement in private companies’ and organisations’ operations. Civil society groups, whenever and wherever possible, should assume a stronger role in addressing these challenges and raising awareness . A US-based study released in April 2018, for example, highlighted consumer misconceptions about privacy while using popular browsers, including that they would ‘prevent geo-location, advertisements, viruses, and tracking by both the websites visited and the network provider’.56 Further work and support are needed to equip users with sufficient knowledge to understand how data-related technologies work and what those technologies mean to them in everyday life.

The attractiveness of the Chinese state’s surveillance and social control systems to other authoritarian states means we may see other states adopt them, unless the negative aspects of these approaches are made more transparent. The consequences of reduced personal freedom combined with greater state control of societies and individuals are disturbing for advocates of the vitality and strength of open societies. Beyond these concerns, the strategic consequences of the tight integration of the
Chinese tech sector with the Chinese state is an area for further analysis.


Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.

© The Australian Strategic Policy Institute Limited 2018

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers.

  1. 中华人民共和国国务院, ‘国务院关于印发 新一代人工智能发展规划的通知’, 国务院, 8 July 2017, online. ↩︎
  2. China has permitted only some foreign direct investment through Chinese entities with partial or full foreign ownership in many tech sectors. See more detailed analysis by Paul Edelberg, ‘Is China Really Opening Its Doors to Foreign Investment?’, China Business Review, 8 November 2017, online and Jianwen Huang, ‘China’, The Foreign Investment Regulation Review – Edition 5, October 2017, online. ↩︎
  3. Yang Ruan, Cheek, Social media in China: what Canadians need to know; Nicole Jao, ‘WeChat now has over 1 billion active monthly users worldwide’, Technode, 5 March 2018, online. ↩︎
  4. Mason Hinsdale, ‘Tencent wants to make WeChat a digital travel ID’, Jing Travel, 6 June 2018, online. ↩︎
  5. 马化腾, ‘互联网像水和电一样成为‘传统行业’, Digitaling.com, 12 August 2014, online. ↩︎
  6. Catherine Shu, ‘China attempts to reinforce real‑name registration for internet users’, Techcrunch.com, 1 June 2016, online. ↩︎
  7. Hui Zhao, Haoxin Dong, ‘Research on personal privacy protection of China in the era of big data’, Open Journal of Social Sciences, 19 June 2017, 5:139–145, online. ↩︎
  8. Boston Consulting Group, Data privacy by the numbers, March 2014, online. ↩︎
  9. Linda Poon, ‘Finally, Uber releases data to help cities with transit planning’, CityLab.com, 11 January 2017, online. ↩︎
  10. Linda Lew, ‘How Tencent’s medical ecosystem is shaping the future of China’s healthcare’, Technode.com, 11 February 2018, online ↩︎

Deterrence in cyberspace

Spare the costs, spoil the bad state actor: Deterrence in cyberspace requires consequences

Foreword

In the past three years, barely a week has gone by without a report of a critical cyberattack on a business or government institution. We are constantly bombarded by revelations of new ransomware strains, new botnets executing denial of service attacks, and the rapidly expanding use of social media as a disinformation and propaganda platform.

Perhaps most alarmingly, a great many of these attacks have their origin in the governments of nation states.

In the past decade we have moved well beyond business as usual signals intelligence operations. Some of the largest malware outbreaks in recent years, such as NotPetya and WannaCry, had their origins in state-run skunkworks.

Cyberattacks initiated by nation states have become the new normal, and countries including Australia have struggled with the challenge of how to respond to them. Far too often they’re considered a low priority and met with a shrug of the shoulders and a “What can you do?”

In this paper, Chris Painter offers us a way forward. Chris presents a reasonable framework for deterrence, a way that we as a nation can help limit the deployment of cyberwarfare tools.

His recommendations are designed to properly punish bad actors in a way that discourages future bad behaviour. They’re modelled on actions that have worked in the past, and serve, if not as a final solution, at least as a starting point for us to scale back on the increasing number of state-sponsored cyber attacks.

Most importantly, these actions aren’t just to the benefit of the state—they will allow us to better protect private citizens and companies that all too often get caught in the cyberwarfare crossfire. To put it simply, if we can ensure there are costs and consequences for those who wrongly use these tools to wreak damage, bad actors might start thinking twice before engaging in this destructive behaviour.

Yohan Ramasundara
President, Australian Computer Society

What’s the problem?

Over the past few years, there’s been a substantial increase in state attacks on, and intrusions into, critical information systems around the globe—some causing widespread financial and other damage.1 They have included:

  • attacks by North Korea on Sony Pictures in 2014
  • widespread Chinese theft of trade secrets and intellectual property
  • Russian state-sponsored interference in the US elections
  • North Korea’s sponsorship of the WannaCry ransomware worm that caused, among other things, a meltdown of the UK’s National Health System
  • the Russian-sponsored NotPetya worm that caused tens of millions of dollars of damage and disruption around the world.

The pace and severity of these attacks show no sign of declining. Indeed, because there have usually been little or no consequences or costs imposed on the states that have taken these actions, they and others have little reason not to engage in such acts in the future.

The US, Australia and many other countries have spent years advancing a framework for global stability in cyberspace. This framework comprises:

  • the application of international law to cyberspace
  • acceptance of certain voluntary norms of state behaviour in cyberspace (essentially, voluntary rules of the road)
  • the adoption of confidence and transparency building measures.

Although much progress has been achieved in advancing this framework, the tenets of international law and norms of state behaviour mean little if there are no consequences for those states that violate them. This is as true in the cyber world as in the physical one. Inaction creates its own norm, or at least an expectation on the part of bad state actors that their activity is acceptable because there are no costs for their actions and no likely costs for future bad acts.

Individually as countries and as a global community, we haven’t done a very effective job of punishing and thereby deterring bad state actors in cyberspace. Part of an effective deterrence strategy is a timely and a credible response that has the effect of changing the behaviour of an adversary who commits unacceptable actions.

Although there are some recent signs of change, in the vast majority of cases the response to malicious state actions has been neither timely nor particularly effective. This serves only to embolden bad actors, not deter them. We must do better if we’re to achieve a more stable and safe cyber environment.

What’s the solution?

It is a well-worn and almost axiomatic expression that deterrence is hard in cyberspace. Some even assert that deterrence in this realm is impossible.

Although I don’t agree with that fatalistic outlook, it’s true that deterrence in cyberspace is a complex issue. Among other things, an effective deterrence framework involves strengthening defences (deterrence by denial); building and expanding the consensus for expectations of appropriate state behaviour in cyberspace (norms and the application of international law); crafting and communicating—to potential adversaries, like-minded partners and the public—a strong declaratory policy; timely consequences, or the credible threat thereof, for transgressors; and building partnerships to enable flexible collective action against those transgressors.

Although I’ll touch on a couple of those issues, I’ll focus here on imposing timely and credible consequences.

The challenge of attribution

One of the most widely cited reasons for the lack of action is the actual and perceived difficulty in attributing malicious cyber activity.

Unlike in the physical world, there are no launch plumes to give warning or the location of the origin of a cyberattack, and sophisticated nation-states are adept at hiding their digital trail by using proxies and routing their attacks through often innocent third parties. But, as recent events illustrate, attribution, though a challenge, is not impossible. Moreover, attribution involves more than following the digital footprints; other forms of intelligence, motive and other factors all contribute to attribution. And, ultimately, attribution of state conduct is a political decision. There’s no accepted standard for when a state may attribute a cyberattack, although, as a practical, political and prudential matter, they’re unlikely to do so unless they have a relatively high degree of confidence. Importantly, this is also true of physical world attacks. Certainly, a state doesn’t require 100% certainty before attribution can be made or action taken (as some states have suggested). Whether in the physical or the cyber world, such a standard would practically result in attribution never being made and response actions never being taken.

Although attribution is often achievable, even if difficult, it still seems to take far too long—at least for public announcements of state attribution. Announcing blame, even if coupled with some responsive actions, six months to a year after the event isn’t particularly timely. Often by that point the impact of the original event has faded from public consciousness and so, too, has the will to impose consequences.

Part of this delay is likely to be due to technical difficulties in gathering and assembling the requisite evidence and the natural desire to be on solid ground; part is likely to be due to balancing public attribution against the possible compromise of sources and methods used to observe or detect future malicious activity; but part of it’s probably due to the need to summon the political will to announce blame and take action—particularly when more than one country is joining in the attribution. All of these cycles need to be shortened.

Naming and shaming

Public attribution of state conduct is one tool of deterrence and also helps legitimise concurrent or later responses.

The US, the UK, Australia and other countries came together recently to attribute the damaging NotPetya worm to Russia and, a few months ago, publicly attributed the WannaCry ransomware to North Korea. This recent trend to attribute unacceptable state conduct is a welcome development and should be applauded.2 It helps cut through the myth that attribution is impossible and that bad state actors can hide behind the internet’s seeming anonymity.

However, public attribution has its limits. Naming and shaming has little effect on states that don’t care if they’re publicly outed and has the opposite effect if the actor thinks their power is enhanced by having actions attributed to them. In the above two cases, it’s doubtful that naming and shaming alone will change either North Korea’s or Russia’s conduct. Public attribution in these cases, however, still serves as a valuable first step to taking further action. Indeed, in both cases, further actions were promised when public attribution was made.

That raises a couple of issues. First, those actions need to happen and they need to be effective. President Obama stated after the public attribution to North Korea in relation to the Sony Pictures attack that some of the response actions ‘would be seen and others unseen’. A fair point, but at least some need to be seen to reinforce a deterrent message with the adversary, other potential adversaries and the public at large.

The other issue is timing. The public attribution of both WannaCry and NotPetya came six months after the respective attacks. That delay may well have been necessary either for technical reasons or because of the work required to build a coalition of countries to announce the same conclusion, but attribution that long after the cyber event should be coupled with declared consequences—not just the promise that they’re to come. Some action did in fact come in the NotPetya case about a month after public attribution, when the US sanctioned several Russian actors for election interference, NotPetya and other matters. That was a very good start but would be even more effective in the future if done when the public attribution occurs.

Action speaks louder than attribution alone, and they must be closely coupled to be effective.

Action speaks louder than attribution alone, and they must be closely coupled to be effective.

General considerations

A few general considerations apply to any contemplated response action to a cyber event.

First, when measures are taken against bad actors, they can’t just be symbolic but must have the potential to change that actor’s behaviour. That means that one size does not fit all. Different regimes hold different things dear and will respond only if something they prioritise or care about is affected. Tailored deterrence strategies are therefore required for different states.3

For example, many have opined that Russia is more likely to respond if sanctions are targeted at Putin’s financial infrastructure and that of his close elites than if simply levied in a more general way.

Second, the best response to a cyberattack is seldom a cyber response. Developing cybertools and having those tools as one arrow in the quiver is important, but other responses will often be more effective.

Third, the response to a cyber event shouldn’t be approached in a cyber silo but take into account and leverage the overall relationship with the country involved. The agreement that the US reached with China that neither should use cyber means to steal the trade secrets and intellectual property of the other to benefit its commercial sectors wouldn’t have come about if widespread cyber-enabled intellectual property theft was seen only as a cyber issue. Only when this problem was seen as a core national and economic security issue, and only when President Obama said that the US was willing to bear friction in the overall US–China relationship, was progress really possible.

Fourth, a responsive action and accompanying messaging needs to be appropriately sustained and not a one-off that can be easily ignored. Fifth, potential escalation needs to be considered. This is a particularly difficult issue when escalation paths aren’t well defined for an event that originates in cyberspace, whether the response is a cyber or a physical one, and the chance of misperception is high. And finally, any response should comport with international law.

Collective action

Collective action against a bad actor is almost always more effective than a response by just one state and garners more legitimacy on the world stage.

Of course, if the ‘fiery ball of cyber death’ is hurtling towards you, every country has the right to act to defend itself, but, if possible, acting together, with each country leveraging its capabilities as appropriate, is better. Collective action doesn’t require any particular organised group or even the same countries acting together in each instance.

Flexibility is the key here and will lead to swifter results. The recent attribution of NotPetya by a number of countries is a good example of collective action to a point. It will be interesting to see, following the US sanctioning of Russia, whether other states join in imposing collective consequences.

One challenge for both collective attribution and collective action is information sharing. Naturally, every state will want to satisfy itself before taking the political step of public attribution, and that’s even more the case if it’s taking further action against another transgressing state. Sharing sensitive attribution information among states with different levels of capability and ability to protect that information is a tough issue even in the best of times. But, if collective action is to happen, and happen on anything approaching a quick timeline, enhancing and even rethinking information sharing among partner countries is foundational.

Using and expanding the tools in the toolkit

The current tools that can be used in any instance to impose consequences are diplomatic, economic (including sanctions), law enforcement, cyber responses and kinetic responses.

Some of them have been used in the past to varying degrees and with varying levels of effectiveness but not in a consistent and strategic way. Some, like kinetic responses, are highly unlikely to be used unless a cyber event causes death and physical injury similarly to a physical attack. Others admittedly take a while to develop and deploy, but we have to have the political willingness to use them decisively in the appropriate circumstances and in a timely manner. For example, the US has had a cyber-specific sanctions order available since April 2015 and, before its recent use against Russian actors in March, it had only been used once in December 2017 against Russian actors for election interference. For the threat of sanctions to be taken seriously, they must be used in a more regular and timely manner, and their targets should be chosen to have a real effect on the violating state’s decision-making.

Our standard tools are somewhat limited, so we must also work to creatively expand the tool set so that we can better affect the unique interests of each adversarial state actor (identified in a tailored deterrence strategy), so that they’ll change course or think twice before committing additional malicious acts in the future. That is likely to need collaboration not just within governments but between them and the private sector, academia, civil society and other stakeholders in order to identify and develop new tools.

Recommendations

Of course, foundational work on the application of international law and norms of voluntary state behaviour should continue. That work helps set the expectation of what conduct is permissible. In addition, states should articulate and communicate strong declaratory policies. Declaratory statements put potential adversaries on notice about what’s unacceptable 4 and can contain some detail about potential responses. In addition, a number of other things can aid in creating an environment where the threat of consequences is credible:

1. Shorten the attribution cycle.

Making progress on speeding technical attribution will take time, but delays caused by equity reviews, inter-agency coordination, political willingness, and securing agreement among several countries to share in making attribution are all areas that can be streamlined. Often the best way to streamline these kinds of processes is to simply exercise them by doing more public attribution while building a stronger political commitment to call bad actors out. The WannaCry and NotPetya public attributions are a great foundation for exercising the process, identifying impediments and speeding the process in the future. Even when attribution is done privately, practice can help shorten inter-agency delays and equity reviews.

2. If attribution can’t be made or announced in a fairly brief period, couple any later public attribution with at least one visible responsive action.

Attribution six months or a year after the fact with the vague promise of future consequences will often ring hollow, particularly given the poor track record of imposing consequences in the past. When attribution can be made quickly, the promise of a future response is understandable, but delaying the announcement until it can be married with a response may be more effective.

3. Mainstream and treat cybersecurity as a core national and economic security concern and not a boutique technical issue.

If cyberattacks really pose a significant threat, governments need to start thinking of them like they think of other incidents in the physical world. It is telling that Prime Minister Theresa May made public attribution of the Salisbury poisonings in a matter of days and followed up with consequences shortly thereafter. Her decisive action also helped galvanise an international coalition in a very short time frame. Obviously that was a serious matter that required a speedy response, but the speed was also possible because government leaders are more used to dealing with physical world incidents. They still don’t understand the impact or importance of cyber events or have established processes to deal with them. Mainstreaming also expands and makes existing response options more effective. As noted above, a prime reason for the US–China accord on intellectual property theft was the fact that it was considered a core economic and national security issue that was worth creating friction in the overall US–China relationship.

4. Build flexible alliances of like-minded countries to impose costs on bad actors.

A foundational element of this is improving information sharing, both in speed and substance, to enable better collective attribution and action. Given classification and trust issues, improving tactical information sharing is a difficult issue in any domain. However, a first step is to discuss with partners what information is required well in advance of any particular incident and to create the right channels to quickly share that information when needed. It may also require a re-evaluation of what information must absolutely be classified and restricted and what can be shared through appropriately sensitive channels. If there’s greater joint attribution and action, this practice will presumably also help build mechanisms to share information and build trust and confidence in the future with a greater number of partners.

5. Improve diplomatic messaging to both partners and adversaries.

Improved messaging allows for better coordinated action and serves to link consequences to the actions to which they’re meant to respond. Messaging and communication with the bad actor while consequences are being imposed can also help with escalation control. Of course, effective messaging must be high-level, sustained and consistent if the bad actor is to take it seriously. Sending mixed messages only serves to undercut any responsive actions that are taken.

6. Collaborate to expand the toolkit.

Work with like-minded states and other stakeholders to expand the toolkit of potential consequences that states can use, or threaten to use, to change and deter bad state actors.

7. Work out potential adversary-specific deterrence strategies.

Actual or threatened responsive actions are effective only if the target of those actions is something that matters to the state in question, and that target will differ according to the particular state involved. Of course, potential responses should be in accord with international law.

8. Most importantly, use the tools we already have to respond to serious malicious cyber activity by states in a timely manner.

Imposing consequences for bad action not only addresses whatever the current bad actions may be but creates a credible threat that those consequences
(or others) will be imposed in the future.

None of this is easy or will be accomplished overnight, and there are certainly complexities in escalation, proportionality and other difficult issues, but a lot comes down to a willingness to act—and the current situation isn’t sustainable. The recent US imposition of sanctions is a step in the right direction, but imposing tailored costs when appropriate needs to be part of a practice, not an aberration, and it must be accompanied by high-level messaging that supports rather than undercuts its use.

The 2017 US National Security Strategy promises ‘swift and costly consequences’ for those who target the US with cyberattacks. Australia’s International Cyber Engagement Strategy states that ‘[h]aving established a firm foundation of international law and norms, the international community must now ensure there are effective consequences for those who act contrary to this consensus.’ On the other hand, Admiral Rogers, the head of US Cyber Command and the National Security Agency, recently told US lawmakers that President Putin has clearly come to the conclusion that there’s ‘little price to pay here’ for Russia’s hacking provocations, and Putin has therefore concluded that he ‘can continue this activity’.

We must change the calculus of those who believe this is a costless enterprise. Imposing effective and timely consequences for state-sponsored cyberattacks is a key part of that change.

  1. Of course, there are an ever-increasing number of attacks and intrusions by criminals, including transnational criminal groups, as well. Deterring this activity is a little more straightforward—the consequences for criminals are prosecution and punishment and, in particular, a heightened expectation that they’ll be caught and brought to justice. I don’t address deterring criminal actors in this paper, although there have been advances in ensuring that countries have the laws and capacity to tackle these crimes and there have been a number of high-profile prosecutions, including transnational cases. Much more needs to be done to deter these actors, however, as many cybercriminals still view the possibility that they’ll be caught and punished as minimal. ↩︎
  2. One downside of a practice of publicly attributing state conduct is that it creates an expectation that victim states will do this in every case and leads to the perception that when they don’t it means they don’t know who is responsible—even if they do. For that reason, states, including the US, have often said in the past that they’ll make public attribution when it serves their deterrent or other interests. There are also cases in which a state or states may want to privately challenge a transgressor state to change its behaviour or in which calling out bad conduct publicly risks sources and methods that may have a greater value in thwarting future malicious conduct. Nevertheless, the seeming trend to more cases of public attribution is a good one, and these concerns and expectations can be mitigated in a state’s public messaging or by delaying public attribution when necessary. ↩︎
  3. Defence Sciences Board, Task Force on Cyber Deterrence, February 2017. ↩︎
  4. Such statements should be relatively specific but need not be over-precise about exact ‘red lines’, which might encourage an adversary to act just below that red line to escape a response. ↩︎

ASPI International Cyber Policy Centre

The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society.

It seeks to improve debate, policy and understanding on cyber issues by:

  1. conducting applied, original empirical research
  2. linking government, business and civil society
  3. leading debates and influencing policy in Australia and the Asia–Pacific.

We thank all of those who contribute to the ICPC with their time, intellect and passion for the subject matter. The work of the ICPC would be impossible without the financial support of our various sponsors but special mention in this case should go to the Australian Computer Society (ACS), which has supported this research.

Chris Painter’s distinguished visiting fellowship at ASPI’s International Cyber Policy Centre was made possible through the generous support of DFAT through its Special Visits Program. All views expressed in this policy brief are the authors.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.

© The Australian Strategic Policy Institute Limited 2018

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers.

Weibo diplomacy and censorship in China

Sina Weibo

Since its inception in 2009, Sina Weibo – China’s souped-up version of Twitter – has provided a rare foothold for foreign governments in the PRC’s tightly-controlled media environment.

Yet while the PRC is allowed free reign to push its messages in Western media and social media platforms, Beijing’s censors have been hampering the legitimate digital diplomacy efforts of foreign embassies.

This ASPI ICPC report provides an in-depth look at the increasingly sophisticated censorship methods being used on foreign embassies on Weibo and provides a series of recommendations for foreign governments, including Australia, to address these policy challenges.

What’s the problem?

As the Chinese Communist Party (CCP)-led state extends its reach into other nations, it’s actively limiting the ability of other countries to do the same in the People’s Republic of China. Seeing itself in an ideological confrontation with ‘the West’,1 the CCP under Xi Jinping is determined to ensure ideological conformity in its own information space.

A key battleground is Weibo, the Chinese micro-blogging service most closely analogous to Twitter. Since Weibo’s inception, embassies have maintained a presence on it—a rare foothold for foreign governments in China’s tightly controlled information space.

While some governments, particularly those of Western countries, have occasionally spoken outside the CCP’s frame of acceptable public discourse, most do not. As Weibo continues to introduce new and subtle methods of direct censorship, foreign embassies are both self-censoring their messaging and failing to speak up when their content is being censored.

In Australia’s case, this lack of transparency and cycle of self-censorship sits oddly with the description of Australia as ‘a determined advocate of liberal institutions, universal values and human rights’ in the 2017 Foreign Policy White Paper.2

What’s the solution?

To not be seen as agreeing to the CCP’s ideological agenda, like-minded governments, in coordination with each other, should commit to publishing transparency reports to reveal the extent to which their legitimate online public diplomacy efforts are being curtailed in China.

Foreign governments should establish and publish clear terms of use for their social media accounts in China so that they don’t fall into the trap of self-censoring their policy messages and advocacy. They should use uncensored social media platforms such as Twitter—which, despite being blocked in China, still has an estimated 10 million active users in the country.3

Embassies could cross-post all of their content there so that audiences are both aware of any incidences of censorship and have alternative avenues to access their full content. The Australian Government should establish Weibo accounts for the positions of Prime Minister and Foreign Minister.

‘Orwellian nonsense’

In early May 2018, the US Embassy in China put Weibo censors in a delicate bind when it issued a provocative slapdown of Beijing’s censorship overreach.

‘President Donald J Trump ran against political correctness in the United States’, read the White House statement, which had been translated into Mandarin.4 ‘He will stand up for Americans resisting efforts by the Chinese Communist Party to impose Chinese political correctness on American companies and citizens.’

The statement was put out in response to the Chinese Civil Aviation Administration’s call on 36 foreign airlines, asking them to come into line with Beijing’s preferred terms of reference for Taiwan, Hong Kong and Macau as ‘Chinese territories’.

The statement continued: ‘This is Orwellian nonsense and part of a growing trend by the Chinese Communist Party to impose its political views on American citizens and private companies.’ It went further still: ‘China’s internal Internet repression is world-famous. China’s efforts to export its censorship and political correctness to Americans and the rest of the free world will be resisted.’

The post, most likely penned by White House press secretary Sarah Huckabee Sanders, was a deliberate poke in the eye for Beijing and it promptly caused a firestorm on the platform.

In the short history of Weibo diplomacy, sometimes referred to as ‘Weiplomacy’, it was the most direct challenge to China’s censorship regime yet. Having shone a mirror on their own activities, Sina Weibo’s censors were put on the spot.

‘Only folks with strong connections (like you) can avoid getting censored’ read the most upvoted comment in the hour immediately after the post went out (Figure 1). ‘I can imagine the censorship department scratching their heads over this,’ read another comment.5

Notably, Hu Xijin, the chief editor of Global Times, the nationalist newspaper owned by the CCP, took to his own Weibo account to call on ‘Weibo management’ to refrain from intervening.6

Instead, in the ensuing few hours, Sina Weibo’s censors used every tool at their disposal short of deleting the post to ensure that the missive had as little impact as possible. Not only was the sharing function for the post switched off, but the comments section under the post was carefully manicured to remove liberal voices and replace them with CCP-approved sentiment (Figure 2).

Figure 1: The comments section under the US Embassy post less than an hour after it was published included users directly challenging the censorship regime.

Translation

  • Only folks with strong connections (like you) can avoid getting censored. [2,656 Likes]
  • I’m also against political correctness or imposing your ideology on others but respecting the sovereignty and territorial integrity of other countries should not be mixed up with ideology. [2,077 Likes]
  • If we were exercising extreme oppression on the domestic Internet, do you think you’d still be talking shit here? [1,277 Likes]
  • Hahahahaha seeing in my living years the US opposing China’s political correctness.. [1,027 Likes]
  • How does our press freedom rank in the world again, one hundred and something right? [634 Likes]
  • I sincerely hope the Indians can claim back their land and establish their own country, while Hawaii could become an independent country. [814 Likes]
  • If you don’t want to do business here, then f&#% off. If you do want to do business here, respect our laws. [497 Likes]
  • [I] support President Trump’s thinking, the world belongs to the people, not a certain party. [378 Likes]
  • Leave your name here before the post gets deleted. [321 Likes]

Figure 2: The comments section under the US Embassy post (now seen in mobile view) around 2 hours after it was published and after censors removed posts that didn’t toe the party line.

Translation

  • If you don’t want to do business here, then f&#% off. If you do want to do business here, respect our laws. [110,000 Likes] 
  • When China and the US established diplomatic relations in 1972, Nixon openly accepted China’s political correctness during his trip here. Are you now denying the establishment of diplomatic relations? [7,854 Likes]
  • Independence for Hawaii
    Independence for Alaska
    Independence for California
    Independence for Texas
    Independence for New Mexico [7,108 Likes]
  • 1. This is not political correctness, this is the one-China principle.
  • 2. Please abide by the terms of the Sino-US joint communique, if you choose to unilaterally go against them, it will be seen as a violation of the agreement. [6,560 Likes]

The incident was an object lesson in how sophisticated the PRC censorship apparatus has become and how precisely it can be deployed. It may be ‘Orwellian nonsense’, but it does largely work. While some Western media reports 7 took care to note that more varied opinions were expressed by Weibo users under the post before the censors swooped in, most reports didn’t.8

What remained after the censors had done their work was nothing more than a Potemkin post, with the comments under it carefully selected to give the impression of a uniformly nationalistic online Chinese public. Such an impression has led previous scholarship on ‘Weiplomacy’ to conclude that the power of Weibo to further the goals of public diplomacy might have been overestimated.9

But a closer examination of the comment section under the post revealed a plethora of viewpoints that the censors failed to expunge. Even though the censors had cherrypicked CCP-approved comments to feature as the most upvoted comments, many of the comments under those comments weren’t toeing the party line (Figure 3). Peeling back the curtain on the Potemkin post reveals the raucous marketplace of ideas that still exists on Weibo, if one takes the time to seek it out.

Figure 3: The comments under the cherrypicked nationalist comments reveal sentiment from opposing ideological clusters.

Translation

  • If you don’t want to do business here, then f&#% off. If you do want to do business here, respect our laws. [12,076 Likes]
  • ‘Little pink’ maggots [a derogatory term for young nationalists] are really disgusting [4,879 Likes]
  • So ZTE deserved to be prosecuted in the US because it didn’t obey their laws. [3,319 Likes]
  • ‘War Wolves’ [a reference to patriotic hit Chinese film Wolf Warrior] always think the rest of the world couldn’t survive without China. [3,302 Likes]
  • Saying it like this is a bit extreme. China and the US affect each other mutually. Chinese airlines need to fly to the US and US airlines need to fly to China. It’s not possible for only one side to depend on the other for business. [3,091 Likes]
  • [The commenter] is obviously a slave but one who talks with the tone of a master. [1,970 Likes]

Weibo and foreign governments: a history of censorship and self-censorship

Three years after the UK Embassy became the first foreign embassy to open an account on Sina Weibo, Jonas Parello-Plesner warned that diplomats should be wary of creeping self-censorship.

‘Embassies shouldn’t accept self-censorship by only posting innocuous tweet[s] that can pass through the censors,’ Parello-Plesner wrote in The Diplomat in 2012.10 ‘Instead they should give the full spectrum of views including on values—even if it means more deleted postings.’

In the intervening years, some foreign embassies took up the challenge, showing a willingness to push the envelope even at the risk of having their content censored. At times, the envelope pushing has been inspired. Doing this required them to be quite creative, because being predictable means being easily blocked.

On 30 May 2012, the US Embassy tapped into Michael Jackson’s popularity in China to give a boost to a politically sensitive interview with then ambassador Gary Locke.11

‘Michael Jackson has an album called Thriller, one of the best selling records in the history of music. The story we’re telling today is also a Thriller. Click to read,’ read the post, which also included a picture of the famous album (Figure 4).

The link led to a Newsweek interview titled ‘Ambassador to China Gary Locke talks Chen, Drama in China’,12 which included details about the attempt by former Chongqing police chief Wang Lijun to get political asylum from the US, as well as the dramatic story of activist Chen Guangcheng’s successful bid for political asylum.

Figure 4: The censored 2012 Weibo post from the US Embassy, which used Michael Jackson’s celebrity as a smokescreen for a politically sensitive interview with then ambassador Gary Locke. The post was archived on FreeWeibo.com.

In 2014, the UK Embassy posted a 2013 human rights report to Weibo using ‘Martian’, a coded language based on Chinese characters (Figure 5).13

Figure 5: The 2014 Weibo post from the UK Embassy, which used coded language in an attempt to evade censorship.

If the post had gone out using standard Chinese, keywords deemed sensitive by the party-state, such as ‘human rights’, would have been flagged automatically. But by using the ‘Martian’ coded language, the longevity of the post was prolonged before the censors became aware of it.14

In other instances, embassies have posted ‘sensitive’ content on Weibo in order to address what they have perceived as unfair treatment by China’s state-controlled media.

On 3 August 2011, the Canadian Embassy was censored for the first time after it posted about Chinese fugitive Lai Changxing. The post included a full federal court decision that resulted in his deportation to China. It included mentions of Liu Xiaobo and Falun Gong and was deleted almost immediately.15

At other times, foreign embassies have tested the boundaries of what is deemed acceptable discourse by Beijing’s censors. In 2016, the US consulate in Shanghai sent out a Weibo post asking for virtual private network (VPN) supplier recommendations. The post was deleted within an hour of its appearance.16

On 1 February 2017, the British Embassy posted an EU statement calling for the investigation of allegations of torture of detained human rights lawyers.17 According to Citizen Lab, Weibo users weren’t able to forward or comment on the post.18 The post was subsequently deleted. And on 3 June 2014, a day before the 25th anniversary of the massacre at Tiananmen Square, the Canadian Embassy posted a photo of Ambassador Guy Saint-Jacques posing with his wife at the site (Figure 6). The low comments-to-shares ratio on the provocative post would suggest some form of censorship, with comments either being deleted or not allowed at all.

Figure 6: Canadian Ambassador and his wife at Tiananmen Square, 2014

The text reads:

  • ‘On June 1, ambassador Guy Saint-Jacques and wife Sylvie Cameron took a tour around the Chairman Mao Memorial on their bikes. A visit to the place they once saw reminded of various past events associated with the square, including the once more cordial and relaxed atmosphere there.’
  • Despite being shared 917 times, the post only displays a few comments—a telltale sign that censors had throttled engagement with it.
  • One share of the post added the comment: ‘There are only a few comments on this post, and you can’t see any of the shares of it.’

At times, the act of censorship happens not because an embassy has made a decision to push the envelope, but because it’s made a diplomatic faux pas. On 26 March 2014, the Russian Embassy Weibo account made what Foreign Policy called a ‘large digital diplomacy gaffe’ when it made mention of the Tiananmen incident. The embassy argued that ‘Russia’s current situation’, following Western sanctions after Russia’s annexation of Crimea, ‘somewhat resembles what China suffered after the Tiananmen incident.19

More recently, however, the instances of blatant censorship—in which posts and even the accounts themselves are deleted—appear to have dropped off. Instead, as this report shows, the invisible hand of Beijing’s censors is, for the most part, eschewing heavy-handed censorship for more surreptitious forms. At the same time, it appears that foreign embassies on Weibo are pulling their punches and accepting ‘the sliding slope of red lines and self-censorship inside the Chinese system’ that Parello-Plesner warned about.20 The combination results in the suppression of ideas that are different from the CCP’s ‘correct line’.

Websites FreeWeibo and Weiboscope have been extremely useful for uncovering examples of blatant censorship, including deletions of posts and keyword blocking. However, less obvious forms of censorship are more difficult to detect. Some of those methods include disabling the comments section under posts and switching off their sharing functionality.

The disabling of comments has been one of many levers that Sina Weibo’s censors have been able to pull from as early as 2012, when, rather heavy-handedly, all comments on all posts were switched off after rumours of a coup spread on the platform.21

Similar forms of surreptitious censorship include ‘shadow-banning’, in which users are under the impression that their posts are being seen when in fact they’re being hidden from other users. The practice is known to be used, if only anecdotally, on Sina Weibo, but has been proven to be in use on China’s dominant chat application, WeChat. 22

These stealthier forms of censorship are less noticeable to the user and therefore less likely to provoke any unwanted backlash.23 As Lawrence Lessig observed in 1999, it’s the underlying code that determines ‘whether access to information is general or whether information is zoned’.24 Or to rework the old aphorism, ‘If a message is posted on social media, but the algorithm doesn’t prioritise it, does it really make a sound?’

How censorship on Weibo works

An analysis of three months’ worth of Weibo posts between November 2017 and January 2018 from the top 10 foreign embassies in China (measured by follower numbers) found 51 instances of censored posts, mostly on the US Embassy account (Figure 7).25

Figure 7: Three months of Weibo posts from November 2017 to January 2018 resulted in 51 instances of censorship.

The US Embassy account had 28 instances of censorship in total, and a variety of methods were used to reduce or erase the impact of its posts. Those methods ranged from the blunt to the subtle:

  • Six posts were deleted—some immediately, some weeks after the fact.
  • Fifteen posts had their comments sections disabled immediately.
  • Three posts had comments sections disabled immediately and then re-enabled weeks later.
  • Two posts had their comments sections allowed, then disabled and hidden at some later stage.
  • In two posts, Weibo notified users that comments were being accepted but asked that they wait patiently for a ‘server synchronisation’. The user comments never made it through.

A range of censorship methods were used on US Embassy posts, ranging from the blunt to the subtle (Figure 8).

Figure 8: Censorship methods used on the US Embassy Weibo account

In a blatant act of censorship, a post sent out by the US Embassy on 7 November 2017 showing the first leg of President Trump’s Asian tour, in Japan, was immediately deleted. The deleted post—captured and archived by FreeWeibo.com 26—was also tweeted from the US Embassy Twitter account,27 helping to make its absence on Weibo more noticeable (Figure 9).

Figure 9: The US Embassy tweet, the Weibo equivalent of which was deleted by Chinese censors.

TranslationPresident Trump and First Lady Melania Trump were welcomed by the Emperor and Queen of Japan on the second day of their Japan visit. They also met with the families of North Korean abductees. President Trump held bilateral talks with Abe, and met with Japanese and American business leaders, while the First Lady had a joyous meeting with some Japanese primary school students. #POTUSinAsia

Two days later, on 9 November 2017—the second day of President Trump’s first state visit to the PRC—a post sent out by the US Embassy linking to a transcript of a press briefing by Secretary of State Rex Tillerson (Figure 10)28 had its comments section immediately disabled.

The post contained a statement from Secretary Tillerson that presented President Trump and President Xi as being on a joint ticket in regard to denuclearisation of the Korean Peninsula, and quickly became that week’s most shared post from the embassy, with 523 shares and 441 ‘Likes’.

Figure 10: The tweet about Rex Tillerson, the Weibo equivalent of which was deleted by Chinese censors.

Translation: President Trump and President Xi confirmed their determination in realising the complete, verifiable and ever lasting denuclearisation of the Korean peninsula. President Trump and President Xi won’t accept a North Korea that is armed with nuclear weapons. We thank China’s cooperation. Secretary of State Rex Tillerson at Beijing Press Conference. Read the brief.

On 17 November, another post quoted a different part of Secretary Tillerson’s earlier press briefing:

The key topic of discussion was our continued joint effort to increase pressure on North Korea, to convince them to abandon their nuclear and missile program. President Trump and President Xi affirmed their commitment to achieve a complete, verifiable, and permanent denuclearization of the Korean Peninsula. President Trump and President Xi will not accept a nuclear-armed North Korea.

On 24 November, another post quoted President Trump from his joint press conference with President Xi two weeks earlier: 29

All responsible nations must join together to stop arming and financing, and even trading with the murderous North Korean regime. Together we have in our power to finally liberate this region and the world from this very serious nuclear menace. But it will require collective action, collective strength, and collective devotion to winning the peace.

And on 30 November 2017, a US Embassy Weibo post announced a call between President Trump and President Xi after Pyongyang tested a missile reportedly capable of reaching the US mainland (Figure 11).30 A copy of the post remains on the US mission’s Twitter account.31

Figure 11: The tweet about Trump’s phone call with Xi, the Weibo equivalent of which was deleted by Chinese censors on Weibo.

Translation: President Trump spoke with President Xi to discuss North Korea’s latest missile test. President Trump stressed America’s determination to defend itself and its allies from the growing threat posed by the North Korean regime. November 29, 2017, the White House President Trump and President Xi call briefing.

Six months after these four posts were published, they no longer exist. It’s unclear when exactly the censors deleted them. This method of delayed censorship avoids detection on FreeWeibo.com, where there are no records of the posts being censored. With the North Korea nuclear crisis still a live issue, the deletions suggest that Beijing is trying to regain control of the narrative inside its own information space.

On 27 December 2017, the US Embassy was censored again after it sent out a post linking to a US– German embassy joint statement about the sentencing of activist Wu Gan and his lawyer, Xie Yang:

We see lawyers and defenders of rights as aiding the strengthening of the Chinese society via developing governance by law. Click the link here to view the recent cases.

The post was captured on FreeWeibo.com after being censored on Weibo.32

Aside from these six instances of deleted posts, all other instances of censorship captured in this report involved the disabling of the comments section under posts. This softer, less noticeable form of censorship is what’s more generally applied to posts from foreign embassies, resulting in suspiciously low levels of reported engagement from users. Engagement levels are artificially deflated when comments are disabled.

In a response to a list of questions asked by ASPI’s International Cyber Policy Centre (ICPC), three governments—the US, Australian and Japanese—confirmed that their embassies in Beijing never disable the comment sections under their Weibo posts.33

‘We don’t delete our own posts,’ a US Embassy spokesperson told ASPI ICPC via email. ‘The US Embassy faces regular and routine blocking of social media posts in China.’ 34

‘We don’t disable the comments section ourselves,’ a Japanese Embassy spokesperson told an ASPI ICPC researcher over the phone. ‘When comments are closed for posts it’s always done by Sina. They will always disable comments for posts mentioning the names of Chinese political leaders, for example.’

In fact, in the data covered in this report, 75% of the time censorship appears to have been meted out because a top Chinese official (living or dead) was mentioned by name or was in a photo in the post.

The sensitivity around senior Chinese officials isn’t surprising. In his 2013 book, Blocked on Weibo, Jason Q Ng found that the largest share of blocked words he discovered through his research were names of people, mostly CCP members.

‘[P]rotection from criticism on Weibo seems to be a perk for rising up the ranks—while dissidents and people caught up in scandals or crimes make up the rest of the names,’ Ng wrote.35

A post by the Cuban Embassy on 25 January 2018 mentions Song Tao (宋涛) , the head of the CCP’s International Department. The post described Song as ‘Secretary Xi Jinping’s Special Envoy’, which was probably the reason for the censorship that followed (Figure 12).

Figure 12: A Cuban Embassy post runs into trouble

Translation of error message: Sorry, you cannot proceed with your attempt as the content contains information that has violated relevant laws and regulations or Weibo community guidelines.

Even when posts mentioning Xi Jinping are positive, they still attract the attention of censors. In October 2017, former Australian Prime Minister Kevin Rudd posted a photo of himself ‘studying’ Xi’s report to the 19th CPC National Congress (Figure 13). ‘China has entered a new age,’ he wrote. According to Rudd, comments under the post were disabled by Weibo. 36

Figure 13: Comments were disabled after Kevin Rudd posted on Weibo

A Sina spokesperson confirmed to ASPI’s ICPC that government-affiliated Weibo accounts with a blue verified badge have the ability to disable the comment sections on their own posts.37 However, in the dataset collected for this report, only one instance of a foreign embassy disabling its own comments was found, on the South Korean embassy’s Weibo account (Figure 14).

Figure 14: The error message reads ‘Due to this user’s settings, you’re unable to comment.’ The South Korean embassy did not respond to ASPI ICPC’s enquiries.

Occasionally, there are exceptions to the censorship rules. An uncensored post from Canadian Prime Minister Justin Trudeau sent on 6 December 2017 included Chinese Premier Li Keqiang’s name in the text, as well as Li’s image in a photo.38 

The outsized success of a selfie taken by Indian Prime Minister Narendra Modi and Chinese Premier Li Keqiang and posted to Weibo in July 2015 is another exception to the rule (Figure 15). 39 The virality of the post was due not only to the rare inclusion of a top Chinese leader, but also due to the content, in which Modi wishes Li a happy birthday. Premier Li’s exact birthday hadn’t been publicly disclosed before.40

Figure 15: Indian Prime Minister Narendra Modi and Chinese Premier Li Keqiang post a selfie

In a rare case during the 2017 G20 summit in Germany, any mention of Russian President Vladimir Putin was blocked on Weibo, according to the Financial Times.41

The move was interpreted by the paper as ‘giving Russia’s president an immunity from public criticism usually reserved for China’s Communist Party elite.’ In that instance, any mention of Putin on the accounts of Weibo users with more than 1,000 followers triggered the message: ‘This post does not allow commenting.’

Out of 51 instances of suspected censorship over the three-month study period, only 13 were posts that didn’t mention any top Chinese leaders.

One particularly notable instance of censorship was of a 13 November 2017 post from the US Embassy Weibo account, which included a video of President Donald Trump emphasising the US as a country whose ‘home’ is ‘on the Pacific’ (Figure 16).

Figure 16: Comments are disabled on US Embassy’s post of President Trump speaking about the US and the Pacific.

Translation of error message: Sorry, you cannot proceed with your attempt as the content contains information that has violated relevant laws and regulations or Weibo community guidelines.

Other, more personal, attempts at cross-cultural communication were also hamstrung by the censors. On the final day of President Trump’s state visit to the PRC, a video of Trump’s 6-year-old granddaughter Arabella Kushner that Trump had personally shown President Xi and his wife Peng Liyuan was published on the US Embassy account and immediately had the comments section on it disabled (Figure 17).

Figure 17: Screenshot of the US embassy’s post of Arabella Kushner singing in Chinese. Comments on the post were immediately disabled.

On the same day, a Weibo post written in the first person by President Trump at the end of his state visit to the PRC appeared:

I’m now leaving China for Vietnam for the APEC meeting #APEC2017#. First Lady Melania will stay here to visit the zoo, and of course, the Great Wall of China. Then she will go to Alaska to greet our amazing troops.

The post prompted some users to ask in comments whether Trump had taken over control of the US Embassy account.

After 39 comments were made, any subsequent attempt to comment resulted in an error message reading: ‘Posted successfully. Please be patient about 1–2 minutes delay due to server synchronization, thank you’ (Figure 18).

Figure 18: The Trump post at the end of his China visit.

Translation of error message: Posted successfully. Please be patient about 1–2 minutes delay due to server synchronization, thank you.

Two other posts by the US Embassy probably drew the ire of Weibo’s censors by providing an opportunity for Chinese netizens to draw comparisons between conditions in the US and China.

One such post answered a question posed to the US Embassy Weibo account about whether American officials were provided with special food supplies (Figure 19).42 Chinese news reports in 2011 revealed that Chinese Government officials have exclusive suppliers of organic food.43 Given that the post didn’t include any sensitive words that might cross a censorship fault line, it managed to garner at least 88 comments before commenting was disabled by the censors.

Figure 19: One of only 13 censored posts that didn’t refer to a senior Chinese leader, this post seemed to invite a comparison of US officials to Chinese officials, and comments were disabled.

Weibo accounts run by the US Government have been suspended and even completely deleted in the past. The US Shanghai consulate’s Weibo account was shut down on 14 July 2012, while the US Embassy account was suspended briefly on 5 May 2016, according to China Digital Times, which is a website following social and political developments in China and run by the University of California.44

At times, it’s less clear why a decision to disable comments was made. When the US Embassy posted that it wouldn’t be able to continue posting to Weibo and WeChat during a government shutdown on 22 January 2018, the post went viral (Figure 20).45 It was the second most shared of all posts gathered during the three-month reporting period for this report.

Figure 20: A post by the US Embassy, explaining that it wouldn’t be posting during a government shutdown, was picked up by the Chinese media.

Translation: Due to an unresolved issue with funding, the US embassy’s social media account will cease its regular updates. While the funding issue remains unresolved, all regular and emergency consular, citizen and immigration services will continue as usual. Those seeking visa or citizen services who have secured an appointment in advance should attend as scheduled. In the exception of emergency security and safety information, the embassy website will not continue its regular updates before full resumption of operations.

However, after the post garnered 1,893 comments, further comments were disabled, despite the Global Times’ gleeful reporting on the incident.46

For China’s overzealous censors, even posts that could be used to show the apparent weaknesses of liberal democracies, such as the US Embassy’s government shutdown post, need to be censored—presumably for fear that discussion of the US Government will prompt users to draw comparisons to their own government. Clearly, the censors, of which Sina Weibo employs an estimated 13,000,47 are highly sensitive to any content that falls outside the boundaries of acceptable CCP-approved discourse.

It follows that a country such as Australia, which claims to be ‘a determined advocate of liberal institutions, universal values and human rights’,48 should expect such advocacy to attract the attention of China’s censors. If it didn’t, something would be odd. However, the Australian Embassy Weibo account doesn’t appear to be attracting much CCP censorship. In the three months of data collected for this report, the embassy’s Weibo account was censored only three times, all for mentioning Xi Jinping. Whether this lack of censorship reflects savvy account management, the CCP’s disinterest in the embassy Weibo account or self-censorship by the Australian Government is the important question.

Rising nationalism

Rising Chinese nationalism online has been allowed to foment amid recent social media campaigns against companies such as South Korean conglomerate Lotte Group, German carmaker Daimler’s Mercedes-Benz brand and Marriott International. The campaigns have received support from both state-run media and the Chinese Government.49

On 17 November 2017, an innocuous post by the German Embassy explaining the meaning of the German word Lückenbüßer (stopgap)50, became a place for nationalists to congregate and protest after pro-Tibetan independence flags were sighted at a soccer match in Germany involving Chinese players (Figure 21).

Figure 21: The German Embassy Weibo post and angry responses from nationalists.

Translation: Luther invented the word Lückenbüßer while translating the Old Testament. The word is about holes and cracks needing to be mended in the Holy Wall in Jerusalem. This is the origin of the word. Today, it refers to a person who acts as a replacement for the one missing from the original plan, although the plan does
not work out in the end. No one wants to be a measure of expediency, but we often cannot do without one. During a period of transition when changes are about to happen, or when a final choice has yet to be made, it usually connects the world together.

Translation of comments:

  • You want freedom of speech? Sure! Next time you Germans want to come to China for any games, we will bombard with swastika flags and photos of Hitler, and salute and chant the name of Hilter throughout, and belt out Nazi songs! Then you’d be happy, be content! A nation that cannot retain its roots is really pathetic, of course, they will treat the territorial integrity of other nations as bullshit!
  • You deserve terrorist attacks in Europe, it’s all your own making!
  • Can we perform Nazi rituals and bear Nazi flags when the German team comes to China?
  • Since some people purposely provoked aggression with flags for Tibetan independence during a China–Germany soccer match, while you brushed it aside with the excuse of freedom of speech, I think it would not be an issue to paste around your embassy all with flags of east Germany!
  • What is freedom of speech? If the separation of China can be counted as freedom of speech, then we sincerely hope that you would again divide Germany into two countries.

The prevalence of such deep nationalism, both real and manufactured, has prompted some, like Adelaide University scholar Ying Jiang, in her pioneering research into ‘Weiplomacy’ efforts, to suggest that the power of Weibo to further the goals of public diplomacy might have been overestimated.51 It’s easy to see how that could be the case. While liberal voices face extra scrutiny from the censors, nationalist voices are allowed to flourish. Even foreigners on Weibo have been tapping into Chinese nationalism as a fast track to viral fame on the platform.

David Gulasi, a China-based Australian English teacher, attracted attention on the platform with funny videos, but saw it skyrocket when he started aping nationalistic views. State media outlet Xinhua has noted that videos uploaded by Gulasi include one in which he ‘professed his love for China and denounced foreigners who did not share his passion for the country’.52

In 2016, when thousands of China-based trolls attacked Australian Olympic swimmer Mack Horton and his supporters after Horton called his Chinese rival Sun Yang a ‘drug cheat’, Gulasi joined in on Weibo (Figure 22).53

Figure 22: Joining a Chinese nationalist pile-on on Australian Olympian Mack Horton helped David Gulasi achieve viral fame on Weibo.

In another video, Gulasi complains about the slow pace of life in Australia and tells his audience he has come to China to pursue his ‘Chinese Dream’ 54 —a populist slogan introduced by Xi Jinping in 2013. Astoundingly, Gulasi was chosen by the Australian Embassy to feature in its 45 Years, 45 Stories campaign to commemorate the 45th anniversary of Australia–China diplomatic relations.55

Foreign embassies and even national leaders such as India’s Narendra Modi have had their Weibo accounts deluged with angry nationalistic messages.56 But in an increasingly censored and controlled online media environment, foreign embassy accounts can also be a channel for netizens to protest about their own government.

In early February 2018, the comments section on posts sent out by multiple foreign embassies, including the US, Japanese and UK embassies, as well as the United Nations, spontaneously became a space for Weibo users to protest the China Securities Regulatory Commission and its head, Liu Shiyu (Figure 23).57

Figure 23: A screenshot of the US embassy Weibo account from 9 February 2018. The screenshot was censored on Weibo but retrieved by FreeWeibo.com, a censorship monitoring site. Source: 科学自然 ‘科学自然:激动的中国股民涌到美国驻…’, FreeWeibo.com, 10 February 2018, online

Translation:

  • Since the China Securities Regulatory Commission Weibo has banned hundreds of millions of investors from protesting, all we can do is voice our fury here and strongly demand Liu Shiyu to step down.
  • Please have your American reporters go to the CSRC to interview Liu Shiyu, [and ask him] why is the Chinese stock market so unable to take a hit?
  • As our official platform has been censored, I just want to borrow this space to call for Liu Shiyu to step down. The stock market has crashed five times in two years, slaughtering hundreds of millions of investors
  • ‘641’ (a homonym for Liu Shiyu) must step down immediately, you’ve already seriously hurt hundreds of millions of families.

In April 2018, Weibo reversed a ban on content ‘related to’ homosexuality after an unusually fierce backlash from internet users.58

Both incidents reveal the diversity of views and ideological groupings that continue to exist online in China despite the party-state’s efforts to promote nationalism. Research by the Mercator Institute for China Studies (MERICS) demonstrates how those widely differing views coexist on Chinese social media, even after extensive efforts by the CCP to repress liberal voices on the platform.59

Its research shows that ,while party-state propaganda plays a dominant role, a number of other distinct ideological clusters exist on Chinese social media sites such as Sina Weibo. Among the groupings they identify are ‘Market Lovers’, ‘Democratizers’, ‘Humanists’ and ‘US Lovers’.

Furthermore, a survey conducted by MERICS for the report shows that Chinese nationalism isn’t necessarily anti-Western. While 62% of respondents in the online survey said China should be more assertive internationally, 75% also supported the ‘spread of Western values’. As the paper points out, ‘the CCP’s strategy of denouncing so-called Western values has repeatedly backfired when netizens pointed out the lack of better Chinese alternatives.’ Western embassies’ public diplomacy efforts seem to have some fertile ground, despite the censorship.

Israel, the Weibo stand-out

The ICPC’s analysis of three months of posts from the top 10 foreign embassies on Weibo shows that a failure to cut through can’t be blamed only on censorship. Many foreign embassies simply aren’t putting enough resources into ensuring that their content is engaging enough to succeed in a highly competitive online media environment, or creative enough to not be easily spotted by censors.

The Israeli Embassy is a stand-out exception: it has a highly successful content strategy that has proved highly popular on the platform.
In her own research into ‘Weiplomacy’ efforts, Adelaide University scholar Ying Jiang captured 2015 data from the top 10 embassies on Weibo, and Israel didn’t make the list. Just a year later, research by Manya Koetse, editor-in-chief of the Chinese social trend tracking website What’s on Weibo, showed that the Israeli Embassy had come out of nowhere to take the top spot (Table 1).

Table 1: The top 10 foreign embassies on Weibo, 2015 to 2017

(Table-1)

Sources:
a) Ying Jiang, ‘Weibo as a public diplomacy platform’, Social Media and e-Diplomacy in China, 10 August 2017, online.
b) Manya Koetse, ‘Digital diplomacy: these foreign embassies are most (un)popular on Weibo’, What’s On Weibo, 20 December 2016, online.
c) Data collected by Fergus Ryan, December 2017.

Of course, a successful digital public diplomacy effort on Weibo should not only be judged by how many posts are censored; it should also be pragmatic. Above all, any digital diplomacy, or ‘e-diplomacy’, effort is fundamentally about the use of the internet and new information and communications technologies to help achieve diplomatic objectives.60

Drawing on data from late 2017, this report has Israel maintaining its lead at number 1 (despite losing followers), while the US and Canada continue to vie for second and third place. The UK has recovered from its loss of two places to regain the number 6 slot, while Australia has managed to re-enter the top 10.

However, follower counts can be a somewhat crude metric, as they can be easily gamed.

A 2014 investigation by The Globe and Mail found that large chunks of those followers were fake. According to the online tool used by the paper, 45.8% of the US Embassy’s followers, 39.9% of the UK’s and 51.2% of Japan’s were real. Only 12.9% of the Canadian Embassy’s 1.1 million followers were determined to be real.61

Another more meaningful metric is to examine the number of shares, likes and comments that each post gets on average to arrive at an idea of how ‘influential’ each embassy is (Figure 24).

Figure 24: Top 10 foreign embassies, by shares and likes per post

Using these engagement metrics, the Japanese, UK, US, Israeli and Canadian embassies are the top 5 leading the pack. 

Central to the success of the top 5 accounts is a tendency to not just promote the image of their own countries, but to engage with and leverage Chinese culture, particularly pop culture. Weibo’s audience skews young (88% of Weibo users are under 33 years of age) and, after its most vocal liberal voices were purged, is now largely dominated by entertainment.62

If the aim of foreign embassies on Weibo is to enhance soft power and to shift public opinion around to supporting their foreign policy positions, the Israeli Embassy Weibo account is exemplary. Shimi Azar, who worked as social media manager at the embassy from late 2014 to early 2016, says the country received a lot of exposure through state visits by Israel’s leaders to China.

‘The first visit of Israel’s Prime Minister Netanyahu to China in 2013 and the visit of the late president Shimon Peres in 2014 created a big buzz in the media,’ Azar told the Global Times.

‘So the embassy took advantage of this buzz and created a Sina Weibo account for Shimon Peres, which was very successful and soon attracted half a million followers.’63

But the outsized success of the Israeli Embassy Weibo account also occurred in the context of a number of deadly terrorist attacks by jihadist-inspired separatist groups in Xinjiang Province.64 As Peter Cai noted in 2014, the majority of comments under an Israeli Embassy Weibo post that likened Hamas to the Islamic State terrorist group were supportive of Israeli attacks on Hamas.

‘Israel, you must control the population in Gaza, otherwise it’s impossible for you to win. You should ditch your humanitarian principles and the only hope for you is to fight evil with evil,’ read one representative comment under the post.

Chinese netizen support for Israeli foreign policy, which goes against the official Beijing position, is still ongoing. Nine sentences sent out by the Israeli Embassy following US President Trump’s decision to recognise Jerusalem as the capital of Israel was the most shared piece of embassy content (the item was shared 2,298 times) in the three-month period covered in this report (Figure 25).65

Figure 25: The most shared piece of embassy content—on the US recognition of Jerusalem as Israel’s capital

The post, which outlines the official Israeli view of the history of Jerusalem, was positively received by Weibo users. ‘The world will rest assured and the people will be satisfied when Jerusalem is given to you,’ reads the most liked comment underneath the post.

‘Put the boot into the cancer of humanity’, the second most liked comment reads—a sentiment typical of a growing anti-Muslim sentiment online that has gone unchecked by Beijing’s censors. Islamophobia has been given a wide berth online in China as authorities continue to crack down in its restive region of Xinjiang. Frequent anti-Muslim comments under many Israeli embassy posts suggest that there’s a perception in their audience that the Israeli Embassy Weibo account is itself anti-Muslim.

A lack of coordination and transparency

But the efficacy of even the most well-resourced and strategic use of Chinese social media platforms such as Weibo is ultimately limited by the party-state. On his second official visit to China in December 2017, Canadian Prime Minister Justin Trudeau sought to parlay his image as a ‘Weibo addict’ into a public diplomacy coup when he made his first stop a visit to Sina Weibo headquarters in Beijing.

Promotional material released before Trudeau’s visit to Weibo claimed the Q&A with the Canadian Prime Minister would be broadcast live, via video stream onto Weibo (Figure 16). But instead of seeing a live-stream of the proceedings, Weibo users at first saw only a delayed 36-second clip of the PM. It was only hours later that more of his appearance was made available.66 As the Canadian Government intended the event to be live-streamed, a reasonable conclusion is that the abrupt cancellation was due to Weibo censors.

Figure 26: A Sina Weibo poster advertising Canadian Prime Minister Justin Trudeau’s video live-stream from Sina Weibo HQ. The poster refers to Trudeau as a ‘Weibo addict’.

Chinese officials, when questioned about the practice of censoring the comments section on foreign embassy Weibo accounts, pass the buck back to Sina Weibo. An exchange between a foreign journalist and an official at a recent Foreign Ministry press conference provides an illustrative example:

Q: Some Chinese investors were angry about the decline in the domestic stock market last week, and they used the US Embassy’s Weibo account to vent, posting comments to that account. On Saturday, we saw these comments have been blocked. Can you tell us your understanding as to what happened there? Does China see that the US is doing anything incorrect in this matter?

A: You might as well ask the US Embassy in China, whose staff is responsible for the maintenance of their own account.

Follow-up: It appears from our report that they did not take actions to block anything. That may have been the Weibo that blocked them.

A: I have not heard about what you mentioned. As I understand, you need to ask them if there are problems with their Weibo account. If the problem cannot be solved, they may contact relevant competent authorities. 67

Conclusion and policy recommendations

It’s estimated that Beijing spends US$10 billion a year on external propaganda, an order of magnitude higher than the US, which spent US$666 million on public diplomacy in 2014.68 Content from Chinese state media has featured in major Western outlets such as The Sydney Morning Herald, The Washington Post, the UK’s Daily Telegraph and Le Figaro as well as on the social media platforms Twitter and Facebook.

The reverse would be unthinkable in the PRC’s tightly controlled media environment. This is despite the fact that the PRC backed a landmark resolution in July 2012 at the UN Human Rights Council, which affirmed that ‘the same rights that people have offline must also be protected online, in particular freedom of expression, which is applicable regardless of frontiers and through any media of one’s choice.’69

Insisting that the PRC uphold the rights of its citizens to engage freely with the legitimate online public diplomacy efforts of foreign embassies isn’t a boutique concern. It’s a parallel issue to seeking reciprocity from the Chinese state for numerous other things, such as intellectual property regimes and market access. The PRC’s online censorship regime cloisters its netizens in an information environment that’s cut off from the rest of the world and primed with a nationalistic ideology. The more the Chinese party-state controls the media to promote its own narrative, the more it limits its own options for how it can resolve international conflicts.70

While CCP statements at the UN are reassuring, the trendlines for censorship in China are moving in the opposite direction. Under Xi’s rule, China has increasingly tightened its grip on the internet, concerned about the erosion of its ideology and policy by a vibrant online culture and the spectre of so-called ‘hostile foreign forces’. As this paper shows, Beijing’s censors aim to use almost imperceptible amounts of censorship to throttle discussion on Weibo that they deem falls outside the frame of discourse acceptable to the CCP party-state. For foreign governments, the temptation to self-censor is increasing.

Foreign governments should demand that Beijing refrain from censoring their legitimate and overt digital diplomacy efforts. Short of that, and probably more powerful for the netizen community, like-minded governments, in coordination with each other, should commit to publishing transparency reports, both to reveal the level of censorship that they’re receiving on Weibo and to demonstrate their commitment to presenting Western political norms and values to Chinese civil society. This can be very influential public diplomacy. It’s important that embassy Weibo accounts speak to China’s diverse netizen groups. Publishing a transparency report about CCP censorship will also inform those groups of their own government’s actions.

The continued meaningful presence of foreign embassy accounts—which occasionally speak outside the bounds of the CCP’s frame of acceptable discourse—will demonstrate those countries’ commitment to presenting Western political norms and values to Chinese civil society.

These accounts can also help reduce misunderstandings between foreign governments and the population of one of the world’s most powerful countries.
Changes need to be made to the way governments engage online in China. Those changes need to include preventive measures to stop governments falling into a cycle of self-censorship. This paper makes the following recommendations:

  1. Governments need to become more assertive and more creative in their messaging on Chinese social media platforms. Of course, some content should be tailored for local audiences. But foreign governments must ensure that they’re communicating the same policy and political messages to the Chinese public as they are to other publics around the world. They are likely to be censored for this.
  2. Foreign governments should use uncensored social media platforms such as Twitter—which, despite being blocked in China, still has an estimated 10 million active users in the country 71 — to cross-post all of their content. That way, incidences of censorship will be transparent and available to global audiences. Cross-posting content elsewhere also gives Chinese netizens an alternative avenue to access and engage with uncensored content. The US Embassy’s Twitter account—which as 738,000 followers—provides other countries with a good model.72
  3. When governments have their official content censored on Chinese online platforms, they should raise this censorship directly with their Chinese Government counterparts. Those countries 73 which allow the Chinese Communist Party an open media and cyber environment to communicate all of its official messages should request reciprocity.
  4. The Australian Government needs more avenues to engage the Chinese public and to put different messages forward. Dedicated official accounts for the positions of Prime Minister and Foreign Minister should be established immediately.

Acknowledgements

The author would like to thank Amber Ziye Wang for her help researching this paper. He’d also like to thank Richard McGregor, Peter Cai and Alex Joske for their comments, which greatly improved the final product. He’s also immensely grateful to my colleagues at ASPI, Danielle Cave, Fergus Hanson and Michael Shoebridge, for their crucial assistance.


ASPI International Cyber Policy Centre

The ASPI International Cyber Policy Centre’s mission is to shape debate, policy and understanding on cyber issues, informed by original research and close consultation with government, business and civil society.

It seeks to improve debate, policy and understanding on cyber issues by:

  1. conducting applied, original empirical research
  2. linking government, business and civil society
  3. leading debates and influencing policy in Australia and the Asia–Pacific.

We thank all of those who contribute to the ICPC with their time, intellect and passion for the subject matter. The work of the ICPC would be impossible without the financial support of our various sponsors.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional person.

© The Australian Strategic Policy Institute Limited 2018

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers.

  1. Mareike Ohlberg, Boosting the party voice: China’s quest for global ideological dominance, Mercator Institute for China Studies, 2016, online. ↩︎
  2. Australian Government, 2017 Foreign Policy White Paper, 2017, online. ↩︎
  3. Jon Russell, ‘Twitter estimates that it has 10 million users in China’, TechCrunch, 5 July 2016, online. ↩︎
  4. US Embassy, Weibo post, 7 May 2018, online. ↩︎
  5. Jiayun Feng, ‘US Embassy bashes Chinese “political correctness” on Weibo, sending the Chinese internet into a frenzy’, SupChina, 7 May 2018, online. ↩︎
  6. Hu Xijin (胡锡进), Weibo post, 7 May 2018. ↩︎
  7. Jiayun Feng, ‘US Embassy bashes Chinese “political correctness” on Weibo, sending the Chinese internet into a frenzy’. ↩︎
  8. Sidney Leng, Jane Li, ‘US, China in fresh row as Beijing tells foreign airlines they will be punished for failing to respect territorial claims, report says’ South China Morning Post, 7 May 2018, online. ↩︎
  9. Ying Jiang, ‘Weibo as a public diplomacy platform’, Social Media and e-Diplomacy in China, 10 August 2017, online. ↩︎

Offensive Cyber report makes waves

The new report by the International Cyber Policy CentreAustralia’s Offensive Cyber Capability, has caught the imagination of the Australian cyber community and is being widely reported and commented on.

Some of the media coverage is listed here;

https://www.sbs.com.au/news/boost-australia-s-cyber-capability-report

https://www.theaustralian.com.au/national-affairs/defence/australias-worldclass-cyber-warriors-take-the-fight-to-islamic-state/news-story/1c4d7c17c3cbc7435ad316077974ec59

https://www.sbs.com.au/news/australia-urged-to-invest-more-to-counter-cyberattacks

https://securitybrief.com.au/story/aspi-demystifies-australias-offensive-cyber-capabilities/

https://ia.acs.org.au/article/2018/clarity-for-australia-s-cyber-capabilities.html

https://overcast.fm/+lLFD160E

https://www.zdnet.com/article/cyber-dam-busters-could-give-australias-military-an-asymmetric-edge/

https://www.aspistrategist.org.au/australias-offensive-cyber-capability/

http://www.canberratimes.com.au/national/public-service/cyber-strength-needs-better-recruitment-lower-classifications-aspi-20180409-p4z8l4.html