Tag Archive for: Critical & Emerging Technology

TikTok and WeChat

Curating and controlling global information flows

What’s the Problem?

While most major international social media networks remain banned from the Chinese market in the People’s Republic of China (PRC), Chinese social media companies are expanding overseas and building up large global audiences. Some of those networks—including WeChat and TikTok—pose challenges, including to freedom of expression, that governments around the world are struggling to deal with.

The Chinese ‘super-app’ WeChat, which is indispensable in China, has approximately 1.2 billion monthly active users1 worldwide, including 100 million installations outside of China.2 The app has become the long arm of the Chinese regime, extending the PRC’s techno-authoritarian reach into the lives of its citizens and non-citizens in the diaspora.3 WeChat users outside of China are increasingly finding themselves trapped in a mobile extension of the Great Firewall of China through which they’re subjected to surveillance, censorship and propaganda. This report also shows how Covid-19 has ushered in an expanded effort to covertly censor and control the public diplomacy communications of foreign governments on WeChat.

Newcomer TikTok, through its unparalleled growth in both Asian and Western markets, has a vastly larger and broader global audience of nearly 700 million as of July 2020.4 This report finds that TikTok engages in censorship on a range of political and social topics, while also demoting and suppressing content. Case studies in this report show how discussions related to LGBTQ+ issues, Xinjiang and protests currently occurring in the US, for example, are being affected by censorship and the curation and control of information. Leaked content moderation documents have previously revealed that TikTok has instructed “its moderators to censor videos that mention Tiananmen Square, Tibetan independence, or the banned religious group Falun Gong,” among other censorship rules.5

Both Tencent and ByteDance, the companies that own and operate WeChat and TikTok, respectively, are subject to China’s security, intelligence, counter-espionage and cybersecurity laws. Internal Chinese Communist Party (CCP) committees at both companies are in place to ensure that the party’s political goals are pursued alongside the companies’ commercial goals. ByteDance CEO Zhang Yiming has stated on the record that he will ensure his products serve to promote the CCP’s propaganda agenda.6

While most major international social media platforms have traditionally taken a cautious and public approach to content moderation, TikTok is the first globally popular social media network to take a heavy-handed approach to content moderation. Possessing and deploying the capability to covertly control information flows, across geographical regions, topics and languages, positions TikTok as a powerful political actor with a global reach.

What’s the solution?

The global expansion of Chinese social media networks continues to pose unique challenges to policymakers around the world. Thus far governments have tended to hold most major international social media networks and Chinese social media networks to different standards. It’s imperative that states move to a policy position where all social media and internet companies are being held to the same set of standards, regardless of their country of origin or ownership.

This report recommends (on page 50) that governments implement transparent user data privacy and user data protection frameworks that apply to all social media networks. If companies refuse to comply with such frameworks, they shouldn’t be allowed to operate. Independent audits of social media algorithms should be conducted. Social media companies should be transparent about the guidelines that human moderators use and what impact their decisions have on their algorithms. Governments should require that all social media platforms investigate and disclose information operations being conducted on their platforms by state and non-state actors. Disclosures should include publicly releasing datasets linked to those information campaigns.

Finally, all of these recommended actions would benefit from multilateral collaboration that includes participation from governments, the private sector and civil society actors. For example, independent audits of algorithms could be shared by multiple governments that are seeking the same outcomes of accountability and transparency; governments, social media companies and research institutes could share data on information operations; all stakeholders could share lessons learned on data frameworks.

Download the report

Download our full report here.


Acknowledgements

We would like to thank Danielle Cave and Fergus Hanson for their work on this project. We would also like to thank Michael Shoebridge, Dr Samantha Hoffman, Jordan Schneider, Elliott Zaagman and Greg Walton for their feedback on this report as well as Ed Moore for his invaluable help and advice. We would also like to thank anonymous technically-focused peer reviewers.

This project began in 2019 and in early 2020 ASPI was awarded a research grant from the US State Department for US$250k, which was used towards this report. The work of ICPC would not be possible without the financial support of our partners and sponsors across governments, industry and civil society.

What is ASPI?

The Australian Strategic Policy Institute was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally. ASPI’s sources of funding are identified in our Annual Report, online at www.aspi.org.au and in the acknowledgements section of individual publications. ASPI remains independent in the content of the research and in all editorial judgements.

ASPI International Cyber Policy Centre

ASPI’s International Cyber Policy Centre (ICPC) is a leading voice in global debates on cyber, emerging and critical technologies, issues related to information and foreign interference and focuses on the impact these issues have on broader strategic policy. The centre has a growing mixture of expertise and skills with teams of researchers who concentrate on policy, technical analysis, information operations and disinformation, critical and emerging technologies, cyber capacity building, satellite analysis, surveillance and China-related issues.

The ICPC informs public debate in the Indo-Pacific region and supports public policy development by producing original, empirical, data-driven research. The ICPC enriches regional debates by collaborating with research institutes from around the world and by bringing leading global experts to Australia, including through fellowships. To develop capability in Australia and across the Indo-Pacific region, the ICPC has a capacity building team that conducts workshops, training programs and large-scale exercises for the public and private sectors.

We would like to thank all of those who support and contribute to the ICPC with their time, intellect and passion for the topics we work on. If you would like to support the work of the centre please contact: icpc@aspi.org.au

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional.

© The Australian Strategic Policy Institute Limited 2020

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

First published September 2020.

ISSN 2209-9689 (online), ISSN 2209-9670 (print)

Funding for this report was provided by the US State Department.

Biodata and biotechnology: Opportunity and challenges for Australia

This new ASPI report canvasses the extraordinary recent developments in genome sequencing and genetic engineering, which will transform all biological enterprises, including healthcare, among the most important parts of the global economy. It argues that there is a once-in- generation opportunity for Australia to play a leading role in a major economic and revolution with digital deliverables, capitalising on our high quality biomedical science, agricultural R&D and healthcare systems

The report identifies a number of elements for Australia to realize this opportunity. First and foremost, a national strategic and action plan is required for the collection and integration of genomic, clinical and smart sensor data for healthcare, and the development of advanced analytical software and point-of-care reporting systems, which can be exported to the world. This plan needs to be resourced by the Australian government, as a major public good infrastructure project. 

Such information will be part of the very fabric of healthcare and drug development in the future. More broadly, genomic information will be used in infection tracing, customs, quarantine, protection of commercial rights, quality control, provenance, security and policing, among others. It will accelerate the identification of valuable traits in animals, plants and microorganisms. Genetic engineering can now be done with speed, sophistication and precision that were unimaginable just a few years ago, and will enhance the efficiency, quality and range of biological production.

There are resourcing, privacy, vulnerabilities, sensitivities and national security issues to consider, protections to be put in place, and social licenses to be obtained.  Big-data analysis skills need be taught in science and engineering, and built into research institutions as well as health, agricultural and environmental management enterprises and agencies.

Clean pipes: Should ISPs provide a more secure internet?

Introduction

One of the largest online challenges facing Australia is to provide effective cybersecurity to the majority of internet users who don’t have the skills or resources to defend themselves.

This paper explores the concept of ‘Clean Pipes’, which is the idea that internet service providers (ISPs) could provide security services to their customers to deliver a level of default security.

The Australian Government looks to be implementing a version of Clean Pipes: on 30 June 2020 the Prime Minister announced a funding commitment to ‘prevent malicious cyber activity from ever reaching millions of Australians across the country by blocking known malicious websites and computer viruses at speed’.1

This paper examines arguments for Clean Pipes and possible implementation roadblocks.

Background

Australia’s 2016 Cyber Security Strategy recognised the opportunities and risks that come with cyberspace and committed to ‘enabling growth, innovation and prosperity for all Australians through strong cyber security’.2

Despite that strategy, however, the online security environment has continued to deteriorate.

There have already been several significant and newsworthy attacks3 so far this year:

  • Toll Group was affected by ransomware in both February and May.4
  • BlueScope Steel’s operations were affected by ransomware in May.5
  • MyBudget, a money management company, had outages caused by ransomware in May.6
  • Lion Australia, a beverage giant, was crippled by ransomware in June.7

However, most attacks aren’t publicly reported, so these incidents are undoubtedly just the tip of the iceberg.

A 2018 estimate that included broader direct costs calculated the potential loss to the Australian economy at $29 billion per year.8

During the Covid-19 crisis, there’s also been significant domestic and international concern about the vulnerability of critical infrastructure such as hospitals and the health sector to cyberattacks. Interpol warned that cybercriminals were targeting critical healthcare institutions with ransomware, and the Cyber Peace Institute issued a call for all governments to ‘work together now to stop cyberattacks on the healthcare sector’.9

This also rose to the highest levels of international diplomacy—the Department of Foreign Affairs and the Australian Cyber Security Centre (ACSC) issued a joint statement on ‘unacceptable malicious cyber activity’, and US Secretary of State Mike Pompeo warned of consequences for malicious cyber activity affecting hospitals and healthcare systems.10

This high-level diplomatic concern emphasises not only that cybersecurity is critically important, but that our current approaches to protecting Australia have failed to adequately protect all of our critical infrastructure.

The Problem

Providing resilient cybersecurity isn’t an inherently intractable task—for those who have the necessary skills and resources.

Individual organisations can and do make significant improvements in their cybersecurity posture when they’re motivated to prioritise security and invest the resources required, but when cybersecurity is viewed as an economy-wide challenge, there are significant sectors of the economy that do not, and probably never will, have the ability to successfully defend themselves.

Unfortunately, the motivation, capability and resources to provide robust cybersecurity are not aligned within the Australian internet ecosystem. Currently, too few businesses in Australia are motivated and capable of providing for their own security.

These are businesses that understand the risk to their operations that arise from failing to address security. Their business model demands that this risk be addressed, and, accordingly, they’ll pay to mitigate it. Some parts of the Australian business community could provide for their own cybersecurity but don’t give the task sufficient priority. Government should employ strategies that encourage them to invest in their own security. However, the bulk of Australian people and businesses fall into a third category: they would like to defend themselves online but don’t have the expertise or the resources to do so.

Large parts of the Australian economy and community can’t protect themselves online because they don’t have the skills or resources to do so.

Criminals, meanwhile, are agnostic about their targets and will attack whoever it is profitable to attack. As weaknesses in security in one area of the economy get shored up, other avenues are explored. If the top end of town is too tough, criminals will ransack those with relatively poor security—individuals and small and medium-sized enterprises.

They also take a ‘belt and braces’ approach to extracting money from their victims. In the May 2020 Toll Group ransomware attack, for example, the criminals first attempted to extract money with ‘traditional’ ransomware—encrypting IT systems to disrupt operations. When Toll refused to pay the ransom, the criminals changed to the exact opposite tactic and threatened to publicly release corporate data unless they were paid.11

Given that malicious actors seek out weakness and vulnerability wherever it exists in the economy, and that some parts of the economy will never have the sophistication and ability to protect themselves, we need to develop initiatives that provide ‘default security’ and bring resources and skills to those who don’t have them—who are generally small and medium-sized enterprises and consumers.

There are already initiatives that bring default security to groups that don’t have the skills or resources to protect themselves. 

They occur at different ‘layers’ of the architecture of the internet: at the hardware level, in operating systems, in some of the services that underpin the operation of the internet, and in the software applications that people use to access the internet (see Table 1).

Table 1: Current default security protections occur at different layers

At the most fundamental level, chip manufacturers have invested in the development of more secure computing architectures.12

Building upon those hardware improvements, operating system manufacturers have also baked default security into their products. This includes features such as automatic updates that make it easier to patch vulnerabilities, built-in anti-malware features such as Windows Defender and architectural features that make it more difficult for hackers to seize control, such as address space layout randomisation and data execution prevention.13

At the internet services layer, a number of Domain Name System (DNS; the system that converts human-readable internet addresses into internet protocol addresses) providers also include default security protection: Quad9, OpenDNS,14 Comodo Secure DNS15 and CleanBrowsing,16 among others. For example, Quad9 states in its FAQ that it ‘uses threat intelligence from a variety of public and private sources and blocks access to those malicious domains when your system attempts to contact them’.17

Google’s Safebrowsing18 and Microsoft’s SmartScreen,19 for example, are web-scanning, anti-phishing and anti-malware systems built into their respective browsers and operating systems to prevent users from visiting potentially dangerous web pages. As users browse the web, the pages they visit are compared to a list of ‘known-bad sites’ that have been confirmed to be hosting phishing or malware. If a user tries to visit one of those sites, instead of taking them directly there the user is shown a warning. These protections are imperfect, as the user can ignore the warning and click through to the site, and criminals and hackers are constantly trying new techniques to evade them, but they have very broad reach. Safebrowsing is used in Google’s Chrome, Mozilla’s Firefox and Apple’s Safari browsers, and together with SmartScreen in Microsoft Edge these systems protect billions of users by default. Google’s Transparency report statistics show that the SmartBrowsing system issued in the order of 5–10 million warnings per week so far this year up to late May 2020.20

These security improvements have occurred at different ‘layers’ of the internet—in browsers, in operating systems and in the underlying plumbing of the internet. They are also ‘high-leverage’ initiatives, in that these investments can improve security for millions to billions of internet users.

There have been improvements in default security in some aspects of online security over the past two decades, but there’s still a very long tail of vulnerability that we must cope with for the foreseeable future. Additionally, other developments threaten to undermine those improvements. The proliferation of the ‘internet of things’ (IoT)—internet-connected but poorly secured and increasingly ubiquitous consumer devices—threatens to introduce a large vector of insecurity that could drastically affect overall cybersecurity.21

Given the success of previous default-security initiatives, what other initiatives could have a widespread positive impact on the cybersecurity of millions of users?

Clean Pipes

One proposal that could help provide advanced capabilities to internet users is that ISPs be required or encouraged to perform ‘due diligence’ to protect their users from malicious traffic. This concept has been called ‘Clean Pipes’, drawing an analogy to water utilities providing clean drinking water.

Clean Pipes could involve ISPs using a variety of technologies to provide default security to their clients. At the conceptual level, this would involve:

  1. positively identifying threats, which could be, for example
    • internet locations that host malware or phishing
    • malware command and control
    • bogus traffic that can be used in attacks that try to overwhelm a service
    • ‘spoofed’ traffic that claims to originate from somewhere it doesn’t
  2. having some capability to proactively protect from different threats, such as
    • blocking and warning users who are attempting to navigate to dangerous locations, such as ones that host malware or phishing
    • removing bogus or spoofed traffic
  3. being able to adjust this blacklist dynamically and alter it through customer feedback if a location is inadvertently blacklisted.

These kinds of capabilities are already deployed around the world, in corporate networks, by British Telecom22 and recently by Telstra.

The Advantages

The key advantage of Clean Pipes is that it brings advanced scalable protection to an ISP’s entire customer base, which is particularly important to that majority of customers who don’t have the skills and resources to provide for their own security.

It’s also highly leveraged—although in a well-organised protection system the entire workforce involved in identifying malicious internet sites may be thousands of people, the knowledge they generate can be used to provide protection to potentially millions of ISP customers.

There are other advantages. ISPs also have a unique position in the network and are able to see all of the internet protocols that are being used, not just the very few that are used in web browsing. This means that ISPs can see different indicators of malicious behaviour than can, say, operating systems manufacturers, browser manufacturers, DNS providers, or even the anti-malware systems that work on individual computers. Each of these different vantage points into the internet has a different view and can be used to detect or even interrupt different kinds of activity. Browser-based protection, for example, can warn users of malicious websites but can do nothing to stop malware command and control once a computer is compromised.

Not only do ISPs get different views, they also get to act on those other protocols, blocking or redirecting them if need be. This is already standard practice where ISPs need to protect their networks from activity that could degrade or disrupt the network23 or where there’s already an established mechanism to block illegal content.24 ISPs could protect users from threats that can’t be tackled by the other default security providers previously mentioned.

There’s no legal impediment to ISPs providing some level of protection to their customers (excepting techniques that would be privacy-invading). Telstra has already implemented some customer protection under a Cleaner Pipes initiative and has blocked the ‘command and control communications of botnets and malware and [stopped] the downloading of remote access trojans, backdoors and banking trojans’.25 These initiatives can be written into terms-of-service contracts, although perhaps an ideal position would be to provide users with the ability to opt out if they don’t want default protection. For example, Google Safebrowsing and Microsoft SmartScreen both provide warnings that users are still able to navigate past.

ISPs already operate security operations centres and have security teams to protect their own networks’ integrity, so there are already skills and expertise resident within their organisations, although skill levels can vary significantly between ISPs. Providing default security to customers may require additional investment in resources, but it requires that an existing capability be grown rather than a new one created from scratch.

Additionally, ISP-level protections could be particularly useful in mitigating the risk from poorly secured IoT devices. Those devices can’t take advantage of some of the other default security advances that have taken place over recent years, such as improvements in browsers or operating systems, but they still communicate over the internet and do so in relatively standard ways, such that anomalous behaviour can be detected and at least some malicious behaviour blocked. That is, ISPs providing Clean Pipes could help mitigate one of our potential looming security threats.

Although ISPs providing default security protection has many benefits and could significantly reduce the damage caused by malicious traffic, it isn’t a panacea for all the ills of the internet. As with protections built into operating systems and browsers, malware, phishing and other threats will break through and cause harm to internet users.

ISP-level concerns and blockers

In Australia, ISPs, other than Telstra, don’t provide extensive default security protections to their customers. There are several reasons for this that fall into four categories:

  1. costs and ISP security expectations
  2. capability to detect and act
  3. understanding harms
  4. reputational risk.

Costs and security expectations

Possibly the underlying reason that most ISPs don’t invest significantly in Clean Pipes is that enhanced security costs more money and neither customers nor ISPs expect that an ISP should provide increased levels of default security.

Related to this, ISPs don’t believe that their customers value a more secure service, so there’s no potential profit available to justify a business case to provide these security services; therefore, no resources are allocated.

Additionally, there’s been no legal or regulatory obligation that has pushed ISPs to provide enhanced default security services.

Capability to detect and act

All ISPs have some level of security capability, which they need to protect their own networks. However, providing increased levels of default security to customers requires more extensive and more advanced capability to both detect malign behaviour and to act on it.

All ISP security operations must prioritise self-protection and they might not have additional capacity to detect malicious activity that doesn’t directly threaten their own operations. Without a clear view of malicious activity that affects their customers (or even third parties), ISPs are unable to act on it.

Any individual ISP would be able to identify some threats on its network, but a collaboration with multiple partners provides a more comprehensive and effective picture of both the threats and effective mitigations. Holistically understanding threats requires collaboration with multiple partners in the security ecosystem, including providers of threat intelligence, other industry verticals and competitor ISPs. Each organisation provides a different slice of the view so that the overall picture is far more complete than any individual organisation can develop on its own.

This industry collaboration would require two separate forms of trust:

  • Competitors would have to trust that companies within the same industry would not seek to gain competitive advantage through security collaboration. This is relatively straightforward within the information security community, as competitive advantage is seen to lie outside security, and effective security is generally perceived as a precondition for competition rather than as a basis for it.26
  • Companies need to trust the technical competence of collaborators. This is currently based on reputation and past performance, and there’s no formal process for technical trust to be built or certified.

The two forms of trust affect both the ability and willingness to share reliable information and to act effectively on information received. Discussions with stakeholders have indicated that significant skill and capacity differences exist between the security operations within different ISPs, and that those differences may make it difficult to engage in effective widespread information sharing across Australian ISPs.

Beyond merely detecting malicious activity, ISPs also need to have the ability to act on it. Acting on malicious behaviour requires additional financial investment beyond detecting it, so, even if ISPs see damaging activity, they may have decided that the costs of implementing default security for customers are simply too high. At the ISP level, most customers don’t pay extra for security services, so investment in providing improved security might not be seen as an economically viable return on investment.

Understanding harms

Beyond merely detecting malicious activity is understanding the harm that it causes. What malicious activity that ISPs see on their networks causes the most harm to customers? For activity that damages their own networks, that harm is easy for ISPs to understand, but quantifying damage caused to customers is very difficult.

Understanding the harms to customers could be improved by information sharing about the costs of cybercrime from government mechanisms such as ReportCyber, from NGOs such as IDCARE,27 or even from other industry verticals that collate information about the most damaging cybercrimes affecting their customer bases.

Some ISPs, particularly smaller ones, might not be able to detect malicious activity and don’t understand the harms it causes their customers. In such cases, ignorance is bliss—once an ISP sees malicious activity and understands that it causes harm to its customers, it faces its own version of the ‘trolley problem’. Do they intervene to protect their customers from dangerous activity on the internet, even though that may come at some financial cost?

Reputational risk

ISPs could also be concerned about the reputational risks involved in attempting to provide default security.

A key reputational concern is that ISPs may inadvertently block legitimate traffic. Although terms and conditions can mitigate legal concerns, ISPs still have to strike a balance between providing enhanced security and the risk that false positives will affect service quality. Importantly, there are harms to customers that occur when ISPs accidentally block non-malicious traffic and when ISPs allow customers to be harmed by malicious traffic. An ideal balance would minimise both harms while preserving online freedom, but this balance is inconsistently applied across different ISPs and is therefore probably suboptimal.

ISPs may also be concerned about the perception that default security requires them to compromise customer privacy. Certainly, government internet initiatives have focused on law enforcement and intelligence requirements, and Australia’s metadata retention laws28 and the Assistance and Access Act 201829 have been controversial.30 Telstra’s recent announcement regarding Cleaner Pipes, however, hasn’t so far been the subject of any significant level of controversy about privacy. In any case, whether through lack of obligation, understanding, capability or a business case, there’s no broad-based, ISP-led effort to provide default security to Australian internet users.

Government challenges

The challenges facing government mirror those facing ISPs.

The Australian Government hasn’t tried to lead a broader effort to provide default security to Australian internet users through a Clean Pipes initiative involving ISPs. In some sense, it hasn’t accepted that leading this kind of initiative is its job. In the absence of an industry consensus that ISPs should be providing some level of default security, the absence of government leadership or direction probably means that this status quo will continue.

A significant concern may be the controversies over privacy, censorship and surveillance that have accompanied previous internet initiatives, such as an internet filter proposed in 201231 and the previously mentioned metadata retention legislation and Access and Assistance Act. Those former initiatives have been focused on supporting law enforcement or preventing access to harmful content, rather than on providing secure internet access to consumers.

Concerns about privacy, censorship and surveillance could be mitigated by government initiatives having:

  1. a clear focus on threat filtering, with a clear and explicit goal of protecting internet users
  2. government leadership that doesn’t necessarily include government implementation
  3. actions focusing exclusively on cybersecurity threats rather than falling into mission creep and including other online harms (such as child exploitation) that are being tackled through other avenues (such as the e-Safety Commissioner)32
  4. transparency about how default security provisions are enacted and what they achieve
  5. a default system with an opt-out for those who don’t want to participate.

The cost of cybercrime isn’t well understood, and that makes it difficult to appropriately allocate resources. One of the most quoted estimates for cybercrime (a Microsoft-commissioned report from Frost and Sullivan) estimated in 2018 that cybercrime could cost Australia $29 billion per year,33 whereas a 2019 ACSC report estimated $328 million in annual losses.34

The ACSC report was based mostly on incidents self-reported to the ReportCyber platform and so is likely to be an underestimate of the cost, but the 100-fold difference between the estimated and measured values shows that the level of uncertainty is high. More comprehensive data would be helpful, and a granular understanding of the cyber threats that are causing the most harm would provide an economic justification for security investments that would be required to mitigate that harm.

Conclusion

This paper has documented some of the arguments for Clean Pipes initiatives in which ISPs deploy their security capabilities to provide default cybersecurity for their customers, and the potential difficulties in implementing such initiatives.

Large portions of the Australian economy and community aren’t capable of effectively providing for their own cybersecurity, and there are significant opportunities for wide-ranging and effective improvements in the security environment for all internet users.

Those approaches would be additional to other broad-based security improvements that have occurred in recent years and could go some way to mitigating the threat from the proliferation of poorly secured IoT devices.

Road Map

Currently, these opportunities aren’t being taken up because the Australian Government has yet to set a clear policy direction and because industry doesn’t see this as a business obligation. Recently announced government funding, including over $35 million to develop a ‘new cyber threat-sharing platform’ and over $12 million towards ‘strategic mitigations and active disruption options’ is an opportunity to change this status quo.35

The Australian Government should:

  • clearly articulate its position on ISPs providing default security services in its 2020 Cyber Security Strategy (Home Affairs)
  • raise the baseline of ISP security operational expertise by facilitating technical workshops (funding is available to support technical tools, but skilled cybersecurity personnel are also needed to both provide validated information and to make effective use of threat information) (ACSC)
  • investigate providing incentives to ISPs to implement improved default security (this could include technical training to improve capacity, funding for new capabilities, or even regulation or legislation to encourage adoption) (Home Affairs)
  • convene closed-door consultations with ISPs to discuss how the government could support and encourage the delivery of default security to customers (Home Affairs)
  • require transparency reports in which ISPs report on their efforts to provide safe and secure networks (Australian Communications and Media Authority)
  • more comprehensively quantify the cost of cybercrime in Australia through surveys and by engaging directly with Australian industry (Home Affairs).

ISPs should:

  • work with government to centralise and expand upon existing industry-wide efforts in collaboration, intelligence sharing and coordinated action. 

Australian industry, beyond ISPs, should:

  • increase the sharing of technical indicators of compromises that are affecting its customers (a government-supported centralised clearing house for information would support this)
  • measure the cost of cybercrime and share information, within intelligence-sharing bodies, about the most damaging cybercrime techniques
  • factor in consideration of the cost and risk of failing to manage security issues in supplying their services.

Acknowledgements

ASPI’s International Cyber Policy Center receives funding from a variety of sources including sponsorship, research and project support from across governments, industry and civil society. There is no sole funding source for this paper.

What is ASPI?

The Australian Strategic Policy Institute was formed in 2001 as an independent, non-partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally. ASPI’s sources of funding are identified in our Annual Report and in the acknowledgements section of individual publications. ASPI remains independent in the content of the research and in all editorial judgements

ASPI International Cyber Policy Centre

ASPI’s International Cyber Policy Centre (ICPC) is a leading voice in global debates on cyber and emerging technologies and their impact on broader strategic policy. The ICPC informs public debate and supports sound public policy by producing original empirical research, bringing together researchers with diverse expertise, often working together in teams. To develop capability in Australia and our region, the ICPC has a capacity building team that conducts workshops, training programs and large-scale exercises both in Australia and overseas for both the public and private sectors. The ICPC enriches the national debate on cyber and strategic policy by running an international visits program that brings leading experts to Australia.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional.

© The Australian Strategic Policy Institute Limited 2020

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

First published July 2020.
ISSN 2209-9689 (online),
ISSN 2209-9670 (print)

Funding Statement

There is no sole funding source for this paper.

  1. Scott Morrison, ‘Nation’s largest ever investment in cyber security’, media release, 30 June 2020, online. ↩︎
  2. Department of Home Affairs (DHA), Australia’s Cyber Security Strategy, Australian Government, May 2016, online. ↩︎
  3. The underlying cause of these attacks is not public, so it isn’t possible to say whether ISPs providing Clean Pipes would have prevented them. ↩︎
  4. Ry Crozier, ‘Toll Group “returns to normal” after Mailto ransomware attack’, iTnews, 18 March 2020, online; Ry Crozier, ‘Toll Group suffers second ransomware attack this year’, iTnews, 5 May 2020, online. ↩︎
  5. Ry Crozier, ‘BlueScope confirms a “cyber incident” is disrupting its operations’, iTnews, 15 May 2020, online. ↩︎
  6. Bension Siebert, Shuba Krishnan, ‘MyBudget blames hack for outage affecting thousands of customers’, ABC News, 15 May 2020, online. ↩︎
  7. Ben Grubb, ‘Drinks giant Lion hit by cyber attack as hackers target corporate Australia’, Sydney Morning Herald, 9 June 2020, online. ↩︎
  8. Swetha Das, ‘Direct costs associated with cybersecurity incidents costs Australian businesses $29 billion per annum’, Microsoft News Centre Australia, 26 June 2018, online. ↩︎
  9. Interpol, ‘Cybercriminals targeting critical healthcare institutions with ransomware’, news release, 4 April 2020, online; ‘CyberPeace Institute—call for government’, CyberPeace Institute, 26 May 2020, online. ↩︎
  10. Michael Pompeo, ‘The United States concerned by threat of cyber attack against the Czech Republic’s healthcare sector’, press statement, US Department of State, 17 April 2020, online; Department of Foreign Affairs and Trade, Australian Cyber Security Centre (ACSC), ‘Unacceptable malicious cyber activity’, news release, Australian Government, 20 May 2020, online. ↩︎
  11. Toll Group, ‘Toll IT systems update’, 29 May 2020, online. ↩︎
  12. For example, investment in trusted platform modules, Apple’s Secure Enclave in iOS devices. ↩︎
  13. Microsoft, ‘The most secure Windows ever’, no date, online. ↩︎
  14. OpenDNS, ‘Why users love OpenDNS’, 2020, online. ↩︎
  15. Comodo Cybersecurity, ‘Secure internet gateway’, 2020, online. ↩︎
  16. CleanBrowsing, ‘Browse the web without surprises’, no date, online. ↩︎
  17. Interestingly, when customers use these optional DNS services their ISP loses visibility and can no longer detect malware and assist them; ‘FAQ: DNS need to know info’, Quad 9, 2019, online. ↩︎
  18. Google, ‘Google safe browsing’, 2019, online. ↩︎
  19. Microsoft, ‘Microsoft Defender SmartScreen’, 27 November 2019, online. ↩︎
  20. Google, ‘Google safe browsing’, 2019, online. ↩︎
  21. Eliza Chapman, Tom Uren, The Internet of Insecure Things, ASPI, Canberra, 19 March 2018, online. ↩︎
  22. Dave Harcourt, ‘BT’s proactive protection: supporting the NCSC to make our customers safer’, National Cyber Security Centre, UK Government, 25 October 2018, online. ↩︎
  23. Such as, for example distributed denial of service (DDoS) attacks that attempt to overwhelm networks or websites. ↩︎
  24. For example, Interpol’s ‘Worst of’ provides a list of domains carrying child abuse material; Interpol, ‘Blocking and categorizing content’, 2020, online. ↩︎
  25. Andrew Penn, ‘Safer online and the new normal’, Telstra Exchange, 6 May 2020, online. ↩︎
  26. Even within the cybersecurity industry competitors collaborate, and the Cyber Threat Alliance serves as a model for competitors sharing information about threats. There are also many effective information-sharing initiatives overseas and in Australia (for example, see ‘Member ISACs’, National Council of Information Sharing and Analysis Centers, 2020, online). ↩︎
  27. ‘National identity and cyber support’, IDCARE, 2020, online; ACSC, ‘ReportCyber’, Australian Signals Directorate, Australian Government, 2020, online. ↩︎
  28. DHA, ‘Data retention’, Australian Government, March 2020, online. ↩︎
  29. DHA, ‘The Assistance and Access Act 2018’, Australian Government, September 2019, online. ↩︎
  30. For example, see Elise Scott, ‘Senate passes controversial metadata laws’, Sydney Morning Herald, 27 March 2015, online; Damien Manuel, ‘Think your metadata is only visible to national security agencies? Think again’, The Conversation, 5 August 2019, online; Stilgherrian, ‘Home Affairs report reveals deeper problems with Australia’s encryption laws’, ZDNet, 29 January 2020, online. ↩︎
  31. Ry Crozier, ‘Conroy abandons mandatory ISP filtering’, iTnews, 8 November 2012, online. ↩︎
  32. There are already mechanisms to block objectionable material, such as the Sharing of Abhorrent and Violent Material Act 2019, and those mechanisms should remain separate from security provisions. See Attorney-General’s Department, ‘Abhorrent violent material’, Australian Government, no date, online. ↩︎
  33. Frost and Sullivan, Understanding the Cybersecurity Threat Landscape in Asia Pacific: Securing the Modern Enterprise in a Digital World, 2018. ↩︎
  34. ACSC, Cybercrime in Australia—July to September 2019, Australian Signals Directorate, Australian Government, 2019, online. ↩︎
  35. Morrison, ‘Nation’s largest ever investment in cyber security’. ↩︎

Genomic surveillance

Inside China’s DNA dragnet

What’s the problem?

The Chinese Government is building the world’s largest police-run DNA database in close cooperation with key industry partners across the globe. Yet, unlike the managers of other forensic databases, Chinese authorities are deliberately enrolling tens of millions of people who have no history of serious criminal activity. Those individuals (including preschool-age children) have no control over how their samples are collected, stored and used. Nor do they have a clear understanding of the potential implications of DNA collection for them and their extended families.

Earlier Chinese Government DNA collection campaigns focused on Tibet and Xinjiang, but, beginning in late 2017, the Ministry of Public Security expanded the dragnet across China, targeting millions of men and boys with the aim to ‘comprehensively improve public security organs’ ability to solve cases, and manage and control society’.1 This program of mass DNA data collection violates Chinese domestic law and global human rights norms. And, when combined with other surveillance tools, it will increase the power of the Chinese state and further enable domestic repression in the name of stability maintenance and social control.

Numerous biotechnology companies are assisting the Chinese police in building this database and may find themselves complicit in these violations. They include multinational companies such as US-based Thermo Fisher Scientific and major Chinese companies like AGCU Scientific and Microread Genetics. All these companies have an ethical responsibility to ensure that their products and processes don’t violate the fundamental human rights and civil liberties of Chinese citizens.

What’s the solution?

The forensic use of DNA has the potential to solve crimes and save lives; yet it can also be misused and reinforce discriminatory law enforcement and authoritarian political control. The Chinese Government and police must end the compulsory collection of biological samples from individuals without records of serious criminal wrongdoing, destroy all samples already collected, and remove all DNA profiles not related to casework from police databases. China must enact stringent restrictions on the collection, storage, use and transfer of human genomic data.

The Chinese Government must also ensure that it adheres to the spirit of the International Covenant on Civil and Political Rights (1966), the International Declaration on Human Genetic Data (2003), the Universal Declaration on the Human Genome and Human Rights (1997) and the Convention on the Rights of the Child (1989), as well as China’s own Criminal Law (2018). National and international legal experts have condemned previous efforts to enrol innocent civilians and children in forensic DNA databases, and the UN Special Rapporteur on the right to privacy should investigate the Chinese Government’s current collection program for any violations of international law and norms.2

Foreign governments must strengthen export controls on biotechnology and related intellectual property and research data that’s sold to or shared with the Chinese Government and its domestic public and private partners. Chinese and multinational companies should conduct due diligence and independent audits to ensure that their forensic DNA products and processes are not being used in ways that violate the human and civil rights of Chinese citizens.

Executive summary

Forensic DNA analysis has been a part of criminal investigations for more than three decades. Dozens of countries have searchable DNA databases that allow police to compare biological samples found during forensic investigations with profiles stored in those databases. China is no exception.

In 2003, China’s Ministry of Public Security began building its own forensic DNA database.3 Like other such databases, it contains samples taken from criminal offenders and suspects. However, since 2013, Chinese authorities have collected DNA samples from entire ethnic minority communities and ordinary citizens outside any criminal investigations and without proper informed consent. The Chinese Government’s genomic dataset likely contains more than 100 million profiles and possibly as many as 140 million, making it the world’s largest DNA database, and it continues to grow (see Appendix 3).

This ASPI report provides the first comprehensive analysis of the Chinese Government’s forensic DNA database and the close collaboration between Chinese and multinational companies and the Chinese police in the database’s construction. It draws on more than 700 open-source documents, including government bid tenders and procurement orders, public security bureaus’ Weibo and Weixin (WeChat) posts, domestic news coverage, social media posts, and corporate documents and promotional material (see Appendix 1). This report provides new evidence of how Xinjiang’s well-documented biosurveillance program is being rolled out across China, further deepening the Chinese Government’s control over society while violating the human and civil liberties of millions of the country’s citizens.

The indiscriminate collection of biometric data in China was first reported by Human Rights Watch.4

Beginning in 2013, state authorities obtained biometric samples from nearly the entire population of the Tibetan Autonomous Region (3 million residents) under the guise of free annual physical exams (Figure 1).5 In 2016, a similar program was launched in Xinjiang, where data from nearly all of the region’s 23 million residents was collected.6

Figure 1: Blood being collected as part of the free physical exam projects in Lhasa, Tibet Autonomous Region, May 2013, and Urumqi, Xinjiang Uyghur Autonomous Region, February 2018

Sources: ‘Tibet: People’s physical examination to protect the health of the people on the plateau’ (西藏:全民体检为高原百姓保健康), Government of China Web (中国政府网), 15 May 2013, online; ‘Xinjiang National Health Checkup: Cover the last mile and benefit the furthest family’ (新疆全民健康体检:覆盖最后 一公里 惠及最远一家人), Xinhuanet (新华网), 9 February 2019, online.

In those minority regions, DNA collection was only one element of an ongoing multimodal biometric surveillance regime, which also includes high-definition photos, voiceprints, fingerprints and iris scans, which are then linked to personal files in police databases. In both Xinjiang and Tibet, authorities intentionally concealed the reasons for biometric collection.7 When that data was combined with an extensive system of security cameras8 and intrusive monitoring of local families,9 the Chinese Government was able to extend its control over these already tightly monitored communities.

Such programs, however, were only the beginning. Starting in late 2017, Chinese police expanded mass DNA data collection to the rest of the country. Yet in contrast to the wholesale approach adopted in Tibet and Xinjiang, authorities are using a more cost-efficient but equally powerful method: the collection of DNA samples from selected male citizens. This targeted approach gathers Y-STR data—the ‘short tandem repeat’ or unique DNA sequences that occur on the male (Y) chromosome. 

When these samples are linked to multigenerational family trees created by the police, they have the potential to link any DNA sample from an unknown male back to a specific family and even to an individual man.

In this report, we document hundreds of police-led DNA data-collection sorties in 22 of China’s 31 administrative regions (excluding Hong Kong and Macau) and across more than a hundred municipalities between late 2017 and April 2020. Evidence suggests that, in some locations, blood collection has occurred in preschools (Figure 2) and even continued during the Covid-19 pandemic.10

Figure 2: One of more than 1,500 blood samples collected from kindergarten and elementary school students in Xiabaishi Township, Fujian Province, June 2019

Source: ‘Xiabaishi police energetically launch male ancestry inspection system development work’ (下白石派出所大力开展男性家族排查系统建设工作), Gugang Huangqi Weixin (古港黄崎威信), 4 June 2019, online.

The scale and nature of this program are astounding. We estimate that, since late 2017, authorities across China have sought to collect DNA samples from 5–10% of the country’s male population, or roughly 35–70 million people (Figure 3, and see Appendix 3). These ordinary citizens are powerless to refuse DNA collection and have no say over how their personal genomic data is used. The mass and compulsory collection of DNA from people outside criminal investigations violates Chinese domestic law and international norms governing the collection, use and storage of human genetic data.

Figure 3: Blood collection in Garze Tibetan Autonomous Prefecture, Sichuan Province, August 2019, and Binhe Township, Zhongwei, Ningxia Hui Autonomous Region, June 2018

Sources: ‘Batang police department continued to carry out information collection work of male family tree investigation system’ (巴塘县公安局持续开展男 性家族排查系统信息采集工作), Batang Police WeChat (巴塘县公安局微信), 20 August 2019, online; ‘Actively carry out DNA blood sample collection’ (积极 开展DNA血样采集工作), Binhe National Security Web (滨河治安国保), 13 June 2018, online.

The corporate world is profiting handsomely from this new surveillance program. Leading Chinese and multinational companies are providing the Chinese police with the equipment and intellectual property needed to collect, store and analyse the Y-STR samples. Key participants include Thermo Fisher Scientific, which is a US-headquartered biomedical and bioinformatics company, and dozens of Chinese companies, including AGCU Scientific, Forensic Genomics International, Microread Genetics and Highershine (see Appendix 4). Under China’s 2019 Regulations on Human Genetic Resource Management,11 if these companies partner with public security bureaus to develop new forensic products, any results and patents must be shared with the police. The continued sale of DNA profiling products and processes to China’s public security bureaus is inconsistent with claims that these companies have made to improve the quality of life and wellbeing of the communities they serve.

China’s national Y-STR database

In 2003, China’s Ministry of Public Security established a national DNA database for police forensic work.12 Over the following decade, police collected DNA samples during criminal investigations.

However, by the early 2010s, Chinese authorities began to engage in the mass collection of DNA from even wider groups. This included not only programs in Tibet and Xinjiang, which were the first to start, but also more targeted efforts elsewhere. Between 2014 and 2016, the Public Security Bureau of Henan Province collected DNA samples from 5.3 million men, or roughly 10% of the province’s male population.13 The province’s police saw the project as a massive improvement in their ability to conduct forensic investigations and extend state surveillance over even more of Henan’s population.

The success of that project encouraged its expansion nationwide and, on 9 November 2017, the Ministry of Public Security held a meeting in Henan’s provincial capital, Zhengzhou, calling for the construction of a nationwide Y-STR database (Figure 4).14

Figure 4: Ministry of Public Security Meeting on Promoting Nationwide Y-STR Database Construction, Zhengzhou, Henan Province, November 2017

Source: ‘The Criminal Investigation Bureau of the Chinese Academy of Sciences made an experienced introduction at the on-site promotion meeting for the construction of the Y-STR DNA database’ (厅刑侦局在全国Y-STR DNA数据库建设现场推进会上作经验介绍), Shaanxi Public Security Party Construction Youth League (陕西公安党建青联), 10 November 2017, online.

Data collection quickly expanded across the country. Between November 2017 and April 2020, documented instances of police-led Y-STR sample collection have been found in 22 of China’s 31 administrative regions (excluding Hong Kong and Macau) and in more than a hundred municipalities.15

Those are only the instances for which we have direct evidence. Given the national scope of this program, these figures are certainly an underestimate.

Unlike autosomal STR data, which is present in the DNA of both males and females, Y-STRs (the short tandem repeats on Y chromosomes) are found only in male DNA.16 Passed directly from father to son, they aren’t recombined with every successive generation. There’s therefore little variation in Y-STRs, apart from random mutations, and the Y-STR profile of a man will be nearly identical to that of his patrilineal male blood relatives. This means that forensic traces drawn from Y-STR data can point only to a genetically related group of men and not to an individual man.

However, when combined with accurate genealogical records (family trees) and powerful next-generation gene sequencers,17 Y-STR analysis can be a powerful tool. Because surnames are usually inherited from fathers, men who share a common surname are likely to share a common paternal ancestor and a common Y-STR profile.18 Likewise, if the Y-STR profiles of two men match, their surnames are likely to match, too. Therefore, if a Y-STR database contains a large representative sample of DNA profiles and corresponding family records, even an unknown male’s data can potentially be matched to a family name and even an individual, so long as investigators have on file the Y-STR data of that male’s father, uncle or even third cousin (Figure 5).

Figure 5: Illustration of shared Y-STR profile among patrilineal male relatives (translated)

Source: ‘The “hero” behind the murder case of the girl from the Southern Medical University: What is the Y-STR family investigation technique?’ (南医大女生 被害案背后 “功臣”: Y-STR家系排查技术是什么), Youku Video Net (优酷影视网), 25 February 2020, online. Partially translated from Chinese by ASPI.

For the Chinese Government, Y-STR analysis presents a more cost-effective and efficient method of building a national genetic panopticon. Unlike in Tibet and Xinjiang, authorities don’t need to collect DNA samples from all Chinese citizens in order to dramatically increase their genomic surveillance capacity. Authorities in Henan achieved 98.71% genetic coverage of the province’s total male population by collecting Y-STR samples from 10% of the province’s men and developing family trees for nearly all of the province’s patrilineal families.19 Following a similar program nationally, Chinese authorities could achieve genetic coverage for nearly all men and boys in China.

This is highly disturbing. In China’s authoritarian one-party system, there’s no division between policing crime and suppressing political dissent. A Ministry of Public Security-run national database of Y-STR samples connected to detailed family records for each sample would have a chilling impact not only on dissidents, activists and members of ethnic and religious minorities, but on their extended family members as well.

Figure 6: Meeting on Y-STR database construction, Suide County, Shaanxi Province, March 2019

Source: Lu Fei (路飞), ‘The successful completion of the training and mobilisation meeting of the Suide County public security bureaus for work on building a male ancestry inspection system’ (绥德县公安局男性家族排查系统建设工作动员部署及应用培训会圆满完成), Meipian (美篇网), 28 March 2019, online.

The Chinese state has an extensive history of using threats and violence against the families of regime targets in order to stamp out opposition to the Communist Party. Leaked documents obtained by the International Consortium of Investigative Journalists20 and The New York Times reveal that authorities in Xinjiang collect information on family members of detainees in the region’s re-education camps,21 and a detainee’s release is conditional upon the behaviour of their family members outside the camps.22 The repression of family members extends far beyond Xinjiang. Parents23 and children24 of prominent human rights lawyers, and the siblings of overseas government critics,25 are routinely detained and tortured by Chinese police.

By forcing a dissident’s family to pay the price for their relative’s activism, these tactics cruelly yet effectively increase the cost of resistance.26 A police-run Y-STR database containing biometric samples and detailed multigenerational genealogies from all of China’s patrilineal families is likely to increase state repression against the family members of dissidents and further undermine the civil and human rights of dissidents and minority communities.

Figure 7: Genealogical records collected from a single extended family, Hanjia Village, Liaoning Province, March 2018, and a meeting of police officers concerning family records in Weinan, Shaanxi Province, August 2018

Sources: ‘Wolong Police Station carrying out Y-bank construction’ (卧龙派出所深入开展Y库建设), Meipian (美篇网), 15 March 2018, online; ‘To implement the spirit of the Heyang meeting, the Huazhou District Public Security Bureau went to Fuping to learn the process of the construction of a male family investigation system’, (落实合阳会议精神,华州区公安局赴富平实地学习男性家族排查系统建设), Huazhou Criminal Investigation Bureau (华州刑侦), 10 August 2018, online.

We also know that Chinese researchers are increasingly interested in forensic DNA phenotyping. This computational analysis of DNA samples—also known as ‘biogeographic ancestry inferences’27—allows investigators to predict the biogeographical characteristics of an unknown sample, such as hair and eye colour, skin pigmentation, geographical location, and age. Chinese scientists have been at the forefront of these controversial methods,28 claiming to be able to identify whether a sample belongs to an ethnic Uyghur or a Tibetan, among other ethnic groups.29 Scientists have warned about the potential for ethnic discrimination,30 yet Chinese scientists are using these methods to assist the Chinese police in targeting ethnic minority populations for greater surveillance,31 while Chinese and foreign companies are competing to provide the Chinese police with the tools to do their work.32

Figure 8: Blood collection in Xi’an, Shaanxi Province, April 2020, and Tongchuan, Shaanxi Province, February 2019

Sources: ‘The technical squadron of the Criminal Police Brigade of the Huyi Branch Bureau fully endeavoured to ensure the smooth progress of the construction of the Y library’ (鄠邑分局刑警大队技术中队全力保障Y库建设工作顺利进行), Meipian (美篇网), 2 April 2020, online; ‘Chen Jiashan Police Station catches up and surpasses, and completes the Y library information collection task’ (陈家山派出所追赶超越 全面完成Y库信息采集任务), Meipian (美篇网), 24 February 2019, online.

A national database containing the genetic information of tens of millions of ordinary Chinese citizens is a clear expansion of the already unchecked authority of the Chinese Government and its Ministry of Public Security. Chinese citizens are already subjected to extensive surveillance. Even beyond Tibet and Xinjiang, religious believers and citizen petitioners across China are added to police databases to track their movements,33 while surveillance cameras have expanded across the country’s rural and urban areas.34 The expansion of compulsory biometric data collection only increases the power of the Chinese state to undermine the human rights of its citizens.

Building comprehensive social control

A range of justifications have been provided by Chinese authorities for the mass collection of DNA samples from boys and men across China. Some of those reasons can be found in a notice released online on 1 April 2019 by the Public Security Bureau in Putian, Fujian Province:

Blood Collection Notice

In order to cooperate with the foundational investigative work of the seventh national census and the third generation digital ID cards, our district’s public security organs will on the basis of earlier village ancestral genealogical charts, select a representative group of men from whom to collect blood samples.

This work will not only help carry on and enhance the genealogical culture of the Chinese people, but will also effectively prevent children and the elderly from going missing, assist in the speedy identification of missing people during various kinds of disasters, help police crack cases, and to the greatest extent retrieve that which is lost for the masses. This is a great undertaking that will benefit current and future generations, and we hope village residents will enthusiastically cooperate.35

From this and other similar notices found across the Chinese internet, it can be difficult to assess the primary motive behind this program. Yet there are clear indications that it is the forensic and social control applications of the program—commonly referred to as the construction of a ‘male ancestry inspection system’—which most interest authorities. An 18 November 2019 article from People’s Daily Hubei states:

The construction of a male ancestry investigation system is currently important work being carried out across the country by the Ministry of Public Security. Through foundational work such as illustrative mapping of male ancestral families, the extraction of biological specimens, and the collection of samples and building of databases, we will further understand and grasp the information of male individuals. In this way we will strengthen the use of male hereditary marker DNA technology, continue to increase the efficiency of the investigative screening of criminal offenders, comprehensively improve public security organs’ ability to solve cases, and manage and control society, and maximise the efficiency of criminal technologies to crack cases.36

At first glance, it might appear that Chinese police are engaged in the mass screening of local men as part of ongoing forensic investigations. So-called ‘DNA dragnets’ are rare but not unheard of: in 2012, Dutch police collected Y-STR data through cheek swabs from 6,600 male volunteers as part of an investigation into the 1999 rape and murder of a teenage girl,37 while Y-STR samples were collected from 16,000 men as part of a criminal investigation into the 2011 murder of an Italian teenager.38

Yet such mass screenings are highly controversial. Both the Forensic Genetics Policy Initiative39 and the Irish Council for Civil Liberties40 note that police pressure can transform the ‘voluntary’ submission of samples into compulsory acts, while the American Civil Liberties Union has condemned police-led DNA dragnets in the US as ‘a serious intrusion on personal privacy’.41 Best practices require that DNA samples collected in such mass screenings should be connected to a specific criminal investigation, provided only by volunteers in the geographically restricted area in which the offence took place, and be destroyed following the completion of the investigation.

The Chinese Government’s program of male DNA data collection violates all of those principles. In none of the hundreds of instances of police-led mass DNA collection-related work uncovered in our research is data collection described as part of an ongoing forensic investigation. Nor are any of the men or boys targeted for DNA collection identified as criminal suspects or as relatives of potential offenders. Finally, China’s authoritarian political system makes refusing police requests for DNA samples impossible.

Figure 9: Blood collection in Kaifeng, Henan Province, August 2019 (cropped), and Ordos, Inner Mongolia, October 2018 (still image from video)

Sources: ‘Xinghua Camp has taken several measures to complete the Y-DNA blood collection task’ (杏花营所多项举措完成DNAY库采血任务), Meipian (美篇 网), 14 August 2019, online; ‘Albas police station actively carries out blood collection work of Y library construction’ (阿尔巴斯派出所积极开展Y库建设采血 工作), Meipian (美篇网), 24 October 2018, online.

Instead, the Chinese Government’s national Y-STR database appears to be part of larger efforts to deepen comprehensive social control and develop multimodal biometric profiles of individual citizens.

Those profiles would allow state security agents to link personal information to biometric profiles, including DNA samples, retinal scans, fingerprints and vocal recordings.42 When completed, such a system could allow Chinese police to connect biometric data from any unknown sample to identifying personal information.

As in the earlier campaigns in Tibet and Xinjiang, DNA collection occurs in a range of places, including private homes,43 schools,44 streets,45 shops46 and village offices47 (see Appendix 2 for a full description of the collection process). Unlike in those two regions, the current program seems aimed at all Chinese men and boys, irrespective of ethnicity or religious faith. Yet there’s evidence that in one case police targeted ethnic Hui Muslims at a local cultural event, in a possible extension of the anti-Muslim campaign that began in Xinjiang (Figure 10).

Figure 10: DNA sample collection in a private residence in Jinhua, Zhejiang Province, September 2018, and at a Hui ethnic minority community centre in Shiyan, Hubei Province, October 2019

Sources: ‘The Baima Police Station of the County Public Security Bureau went to the jurisdiction to carry out blood collection work’ (县公安局白马派出所到 辖区开展血液采集工作), Pujiang County Public Security Bureau (浦江县公安局), 28 September 2018, online; ‘The Hubeikou Police presented safety lectures to the Hui ethnic people on the spot and collected male blood samples during the holy Ramadan festival of the Hui ethnic people’ (湖北口派出所利用回族 群众圣纪节日,给到场回族群众做法制安全讲座,并采集男性血样), Hexie Hubeikou Microblog (和谐湖北口微博), 10 October 2019, online.

The scale of data collection is enormous. Tens of thousands of DNA samples have been collected in single localities. In Tunliu County in Chanzhi, Shanxi Province, local authorities recommended collecting blood samples from 36,000 men,48 or roughly 26% of the county’s male residents; in Laoting County in Tangshan, Hebei Province, 56,068 samples were recommended for collection from the county’s 320,144 men;49 and an invitation for bids for the construction of a Y-STR database for the Xian’an District of Xianning, Hubei Province, states that 40,000 blood samples were collected from the district’s roughly 300,000 male residents.50 These figures alone—a mere fraction of the total size of the Chinese Government’s current DNA collection program—represent some of the largest targeted DNA dragnets in police history.

More disturbing still is the compulsory collection of DNA samples from children (Figure 11).51 Unconnected to any criminal investigation, police have collected blood samples from students at schools across China, including in Shaanxi,52 Sichuan,53 Jiangxi,54 Hubei,55 Fujian,56 and Anhui.57 In a single township in Fujian, more than 1,500 blood samples were taken from students at local kindergartens and elementary schools.58 In some cases, teachers have been enlisted to assist in DNA collection.59

Figure 11: Collecting blood samples from students, Poyang County, Jiangxi Province, November 2018, and Yunxi County, Hubei Province, March 2019

Sources: ‘Actively cooperate with students in collecting DNA samples’ (积极配合做好学生DNA样本信息采集工作), Dongxi Primary School Web (东溪小学王 网), 14 November 2018, online; ‘Safety management: Nine-year standard school in Shangjin Town actively cooperates with DNA information collection’ (安 全管理:上津镇九年一贯制学校积极配合做好DNA信息采集工作), Nine-year Standard School in Shangjin Town WeChat account (上津镇九年一贯制学校), 22 March 2019, online.

These accounts are in keeping with a 2017 Wall Street Journal investigation that found that police in rural Qianwei, Sichuan Province, collected DNA samples from male schoolchildren without explanation (Figure 12).60 This is a clear violation of Article 16 of the UN’s Convention on the Rights of the Child (to which China is a signatory) against the ‘arbitrary or unlawful interference with [a child’s] privacy’61 and an abuse of the authority police have over vulnerable adolescents.

Figure 12: Police-led DNA collection from middle and elementary school students in Shifan County, Sichuan Province, September 2019, and in Hanzhong County, Shaanxi Province, October 2019

Sources: ‘Shigu Junior High School actively cooperates with the public security police to do a good job of collecting DNA samples from teenagers’ (师古初中 积极配合公安民警做好青少年DNA样本采集工作), Shifang City Government Web (什邡市人民政府), 12 September 2019, online; ‘This elementary school in Nanzheng District has launched the collection of student DNA samples’ (南郑区这个小学,开展了学生DNA样本采集), Eastday (东方咨询), 12 October 2019, online.

While DNA samples are taken from men and boys outside of a police investigation, data samples are stored permanently in the Ministry of Public Security’s National Public Security Organ DNA Database (Figure 13).62

Figure 13: National Public Security Organ DNA Database screenshot (cropped)

Source: ‘Public Security Organ DNA Database Application System’ (公安机关DNA数据库应用系统), Beijing Haixin Kejin High-Tech Co. Ltd (北京海鑫科金高 科技股份有限公司), online.

Like the FBI’s Combined DNA Index System (CODIS) in the US,63 China’s national database permits DNA samples collected by police to be compared with samples stored in hundreds of local and provincial databases across the country. This database also contains additional core STR loci (locations on a chromosome) for enhanced discriminatory capacity tailored to the ethnic make-up of China’s population.64

The Chinese Government’s DNA database feeds into a constantly evolving program of state surveillance under the banner of the Golden Shield Project, which is led by the Ministry of Public Security. The project seeks to make the personal information of millions of Chinese citizens, including forensic and personal data, available to local police officers nationwide.65 According to the website of Highershine Biological Information Technology Co. Ltd, a company that builds Y-STR databases for the Ministry of Public Security, its databases allow DNA data to be compared with non-genetic data on Chinese citizens contained in the national personal residence database system and the comprehensive police database system, which are both part of China’s Golden Shield Project (Figure 14).

Figure 14: Highershine’s National Public Security Organ Male Family Ancestry Investigation System

Source: ‘National Public Security Male Family Investigation System collects clients’ (全国公安男性家族排查系统采集用户端), China Highershine (北京海华鑫安生物), online.

Evidence already suggests that this new DNA database is being integrated with other forms of state surveillance and ‘stability maintenance’ social control operations.66 Local officials in Sichuan Province have linked Y-STR data collection to the Sharp Eyes Engineering Project,67 which is a national surveillance program aimed at expanding video monitoring across rural and remote areas.68 The Chinese company Anke Bioengineering has also spoken of building a ‘DNA Skynet’,69 in an apparent allusion to another national surveillance program.70

Corporate complicity

Chinese and multinational companies are working closely with the Chinese authorities to pioneer new, more sophisticated forms of genomic surveillance. According to Ping An Securities, China’s forensic DNA database market generates Ұ1 billion (US$140 million) in sales each year and is worth around Ұ10 billion (US$1.4 billion) in total.71 Competition is intense. While multinational companies currently dominate equipment sales, domestic players are making significant inroads, and biotechnology is listed as a critical sector in the Chinese Government’s Made in China 2025 strategy.72 More than two dozen Chinese and multinational companies are known to have supplied local authorities with Y-STR equipment and software (see Appendix 4).

One of the key domestic producers of Y-STR analysis kits is AGCU Scientech Inc.,73 which is a subsidiary of one of China’s largest and fastest growing biotech companies, Anhui Anke Bioengineering (Group) Co. Ltd.74 AGCU’s founder and Anke’s vice president is Dr Zheng Weiguo.75 After working for Thermo Fisher affiliate Applied Biosystems and other companies in the US, he was invited by the Ministry of Public Security to help develop the Chinese Government’s DNA database in 2004 and set up AGCU in the city of Wuxi under the Thousand Talents Program in 2006.76 He now serves as an expert judge for this Chinese Government talent recruitment program and has been awarded numerous state prizes for his scientific and patriotic contributions.77

AGCU has partnered with public security bureaus across China to apply for patents for Y-STR testing kits78 and in 2018 entered into an exclusive distribution partnership with US biotech company Verogen to sell Illumina’s next-generation DNA sequencers in China.79 AGCU is now actively promoting Illumina next-generation solutions at domestic and international trade fairs organised by the Ministry of Public Security (Figure 15).80

Figure 15: An AGCU engineer discusses Y-STR data systems at the Public Security Bureau of Pingxiang, Jiangxi Province, August 2018

Source: ‘Pingxiang City Public Security Bureau Male Family Investigation System Construction Promotion Conference and “FamilyCraftsman” training class’ (乡市公安机关男性家族排查系统建设工作推进会暨“家系工匠”培训班), Meipian (美篇网), 17 August 2018, online.

Other players include Forensic Genomics International,81 which is a fully owned subsidiary of the Beijing Genomic Institute Group—a company with an increasingly global footprint. In August 2018, Forensic Genomics International signed a strategic partnership agreement with the Public Security Bureau of Xi’an82 and has worked with other public security bureaus to build Y-STR databases as part of this national program.83 Another company is Microread Genetics Co. Ltd, a leading life sciences company with a joint genetic lab in Kazakhstan,84 which has won contracts to provide public security bureaus with Y-STR testing kits85 and database construction services.86

Beijing Hisign Technology Co. Ltd is also providing Y-STR database solutions to the Ministry of Public Security.87 Founded by former People’s Liberation Army member Liu Xiaochun,88 Hisign has developed a range of big-data biometric surveillance products used to collect, store and analyse finger (palm) patterns, facial scans and forensic DNA samples (Figure 16).89 Its Y-STR databases, which the company boasts can be ‘seamlessly connected with the DNA National Library’ and which can ‘provide intelligent family tree mapping’, are used by the public security bureaus of eight provinces, autonomous regions and directly administered cities.90

Figure 16: Hisign’s Y-STR database genealogical mapping function

Source: ‘YSTR database application system’ (YSTR数据库应用系统), Hisign Technology (北京海鑫科金高科技股份有限公司网), online.

A number of leading multinational companies are also providing DNA sequencers and other forensic technologies to public security bureaus across China. They include the China subsidiaries of Thermo Fisher Scientific and Eppendorf. Of those companies, Thermo Fisher’s role is most prominent.

This corporate giant has 5,000 employees in China, which contributed over 10% of the company’s US$25 billion in revenue in 2019.91

The company’s involvement in biometric surveillance in Xinjiang is well documented.92 But, while it has vowed to stop selling human identification products in the region,93 Thermo Fisher’s extensive involvement in the Ministry of Public Security’s national DNA database program is less well known.

One week before the launch of the national Y-STR data program, representatives from Thermo Fisher joined Chinese academics and police officials at a conference held by the Forensic Science Association of China in Chengdu, Sichuan, from 1 to 3 November 2017 (Figure 17).94 Recorded presentations from the conference give a clear sense of how closely Thermo Fisher has worked with the Ministry of Public Security to improve police collection of Y-STR data.

Figure 17: Presentation on forensic Y-STR kits designed for the Chinese market by a representative of Thermo Fisher, Chengdu, Sichuan Province, November 2017

Source: ‘Dr Zhong Chang’ (钟昌博士), Tencent Video (腾讯视频), 8 November 2017, online.

In a talk by Dr Zhong Chang, a researcher at Thermo Fisher, two of the company’s DNA kits—the VeriFiler Plus PCR amplification kit95 and Yfiler Platinum PCR amplification kit96—are described as having been created in direct response to the Ministry of Public Security’s need for enhanced discriminatory capacity tailored to the ethnic make-up of China’s population.97 More disturbingly, Thermo Fisher’s Huaxia PCR amplification kit was developed specifically to identify the genotypes of Uyghur, Tibetan and Hui ethnic minorities.98

Such kits have been instrumental to the current national Y-STR collection program aimed at ordinary men and boys, and numerous local public security bureaus have purchased Thermo Fisher Y-STR analysis kits as part of the construction of male ancestry investigation systems99 and Y-STR databases.100

Thermo Fisher may defend these sales, as it did to Human Rights Watch in 2017, on the grounds that it’s impossible ‘to monitor the use or application of all products’ that it makes.101 That may be true, but the company is clearly aware of how its products are being used, and it actively promotes its close collaboration with the Chinese police in its Chinese-language publicity material. In a profile of Gianluca Pettiti, Thermo Fisher’s former head of China operations and current President of Specialty Diagnostics,102 the company boasts: ‘In China, our company is providing immense technical support for the construction of the national DNA database, and has already helped to build the world’s largest DNA database.’103 Similarly, in 2018, the company’s Senior Director of Product Management, Lisa Calandro, discussed the ‘sinicizing’ of their forensic science product line for the Chinese market.104

Even if multinational companies object to the use of their genetic products as part of China’s surveillance regime, new legislation puts them at risk of acting as the handmaidens of repressive practices. Under China’s 2019 Regulations on Human Genetic Resource Management, any patents emerging from joint research projects must be shared between foreign-owned and Chinese entities.105

That means that, if Chinese or international biomedical companies partner with the public security bureaus, their research results and patents must be shared with the police. Furthermore, Article 16 of the Regulations grants the Chinese state sweeping powers to make use of DNA datasets created by public or private researchers for reasons of ‘public health, national security and the public interest’.

This means that any genetic data or processes in China may be used by Chinese authorities in ways these companies might have never intended.

Human rights violations

The Chinese Government’s genomic surveillance program is out of step with international human rights norms and best practices for the handling of human genetic material.106 Article 9 of the UN Universal Declaration on the Human Genome and Human Rights states that ‘limitations to the principles of consent and confidentiality may only be prescribed by law, for compelling reasons within the bounds of public international law and the international law of human rights’,107 while Article 12 of the UN International Declaration on Human Genetic Data states that the collection of genetic data in ‘civil, criminal or other legal proceedings’ should be ‘in accordance with domestic law consistent with the international law of human rights’.108

The Chinese Government’s DNA dragnet is also a clear violation of the International Covenant on Civil and Political Rights’ prohibition against ‘arbitrary or unlawful interference’ with a person’s privacy,109 and Article 16 of the UN Convention on the Rights of the Child (to which China is a signatory) against the ‘arbitrary or unlawful interference with [a child’s] privacy’.110

There are three areas in particular where this program appears to violate the human rights of Chinese citizens:

1. Lack of legal authority

The compulsory collection of biological samples among non-criminal offenders is not currently authorised under Chinese law. Article 132 of the revised 2018 Criminal Procedures Law only permits the collection of fingerprints, blood and urine samples from victims or suspects in criminal proceedings.111 Chinese authorities are aware of this issue. Chinese scholars and experts have warned about the lack of a clear legal basis for the collection of biometric samples by police outside criminal investigations,112 while others have cautioned about the potential for mass social unrest if compulsory collection should occur.113

Figure 18: Blood collection in Tongchuan, Shaanxi Province, February 2019 (cropped), and Xi’an, Shaanxi Province, January 2020

Sources: ‘Wangjiabian Police Station solidly carried out the security work of opening the school campus’ (王家砭派出所扎实开展开学校园安保执勤工作), Meipian (美篇网), 20 February 2019, online; ‘The Zoukou Police Station combined with the “Millions of Police Entering Tens of Millions Community” activity, went deep into the jurisdiction to carry out male “Y” blood sample collection work’ (零口派出所结合“百万警进千万家”活动,深入辖区开展男性“Y”系血样 采集工作), Meipian (美篇网), 14 January 2020, online.

The compulsory collection of DNA samples in China has sparked controversy in the past. The mass DNA screening of 3,600 male university students by police in 2013 following a spate of campus thefts was condemned as disproportionate and a violation of China’s Criminal Law.114 When discussing the creation of a nationwide Y-STR database in 2018, Pei Yu of the Hubei Police Academy warned that the ‘large-scale coercive collection of blood’ from ordinary civilians would violate both Chinese domestic law and international norms and suggested that this would be a major legal hurdle for Chinese authorities.115

Police notices and social media posts make it clear that the authorities are worried about potential pushback. Posters urge public cooperation, while police are told to carry out careful propaganda work aimed at dispelling any concerns about blood collection.116 Yet online posts suggest that some still question the legal basis of this program.117

2. Lack of informed consent

Outside of a criminal investigation, the voluntary submission of genetic samples requires prior, free and informed consent.118 The Chinese Government’s current program of compulsory Y-STR data collection isn’t part of any criminal investigation. Yet there’s no evidence in the sources reviewed for this report that Chinese authorities sought people’s consent before collecting Y-STR samples; nor are those who have given samples likely to be aware of how this program could subject them and their families to greater state surveillance and potential harm.

Figure 19: Blood collection in Shangrao, Jiangxi Province, October 2019 (cropped), and Lantian County, Xi’an, Shaanxi Province, January 2019

Sources: ‘Xianshan Primary School: District public security bureau visits the school to collect blood samples’ (仙山小学:区公安局到校进行血样采集), Meipian (美篇网), 1 November 2019, online; ‘(Striving for “Safety Vessel” Lantian Public Security in Action: Public Security police keeping the peace at the end of the Spring Festival’ (争创“平安鼎”蓝田公安在行动: 年终岁尾春节至,公安民警守平安), Meipian (美篇网), 30 January 2019, online.

Police provide contradictory explanations or speak in vague generalities about the purpose of the DNA collection program. A local resident, for example, expressed confusion about why men in his village were being targeted for blood collection in a 2019 social media post.119 Other posts express concern about being compelled to provide biometric samples. In a post made in late 2018, a netizen reported that men were being required to submit blood samples to police when applying to change their residency permits.120 Extensive police powers (both legal and extra-legal) make it virtually impossible for someone to refuse a request for biometric data in China.121

3. Lack of privacy

Despite some assurances that personal information will be protected,122 police are given a wide remit to make use of genetic resources. DNA collected in Tibet and Xinjiang as part of a free ‘physicals for all’ program was used to enhance biosurveillance over those ethnic minority populations, without the knowledge of those from whom DNA samples were taken.123 Legal experts and ordinary citizens have also expressed concerns about the lack of robust privacy protections when it comes to Y-STR sample collection.124

Figure 20: Blood collection in Yantai, Shandong Province, March 2019, and Yulin, Shaanxi Province, April 2019

Sources: ‘Xiaoyang Police Station of Haiyang City: Check and fill the vacancies for the construction of the Y library’ (海阳市小纪派出所: 对Y库建设工作进行 查漏补缺), Shuimu Web (水母网), 28 March 2019, online; ‘Recent work trends of Sanchuankou Police Station of Public Security Bureau of Zizhou County’ (子洲县公安局三川口派出所近期工作动态), Meipian (美篇网), 7 May 2019, online.

Online posts note that police blood collection outside of a criminal investigation constitutes an infringement on personal privacy.125 In one post, a father claimed that a police officer threatened to revoke his residency permit if he didn’t provide a Y-STR sample for his child.126 The father wrote that, when he expressed confusion about the purpose of the program, he was asked: ‘Don’t you trust the government?’

A nationwide program of male DNA collection not only represents a serious challenge to the privacy of those whose profiles are contained in the database, but also undermines the privacy of their relatives, who may be unaware that their personal information is contained in the family trees that police have created as part of this project.127

These concerns about legality, consent and privacy are all the more evident when the Chinese Government’s program is compared with two other national DNA collection programs: the UK’s National DNA Database, which until recently stored DNA samples taken from people merely suspected (but not convicted) of recordable offences, and a 2015 law in Kuwait, which would have required all residents and visitors to Kuwait to provide DNA samples to the government. Both programs were highly controversial.

In a 2008 ruling by the European Court of Human Rights, the UK’s program was found to have ‘fail[ed] to strike a fair balance between the competing public and private interests’.128 Likewise, the UN Human Rights Committee’s 2016 periodic review of Kuwait raised concerns about the ‘compulsory nature and the sweeping scope’ of the program, the ‘lack of clarity on whether necessary safeguards are in place to guarantee the confidentiality and prevent the arbitrary use of the DNA samples collected’ and ‘the absence of independent control’.129

In both cases, the collection regime was dramatically scaled back or scrapped altogether. In the UK, the European Court’s ruling led to the UK’s Protection of Freedoms Act in 2012130 and the subsequent destruction of 1.76 million DNA profiles taken from people innocent of any criminal offence.131 In the case of Kuwait, the law was eventually found to violate constitutional protections of personal liberty and privacy by the country’s supreme court in 2017.132

The criticisms leveled against the UK’s and Kuwait’s DNA programs could easily apply to the Chinese Government’s current campaign of mass DNA collection, but a similar outcome is highly unlikely. China lacks independent courts that can check the power of the Chinese Government, the Communist Party and domestic security forces.133 Nor has the Chinese Government been receptive to criticisms of earlier mass DNA collection programs made by international human rights organisations.134 Finally, China’s authoritarian political system lacks a free press, opposition political parties and a robust civil society that can openly challenge the legality of this program.135

Recommendations

DNA analysis is now considered the gold standard for police forensics. Recent innovations in DNA sequencing and big-data computing make the process of analysing biometric samples more efficient and cost-effective. Yet forensic DNA collection has also been linked to the abuse of police power,136 and even commercial genealogical websites can lead to the loss of genetic privacy for the relatives of those who have voluntarily uploaded their data.137 In order to defend against possible abuses, compulsory police collection and storage of biometric data must be strictly limited to those convicted of serious criminal wrongdoing.

As detailed in this report, there’s no evidence that Chinese authorities are adhering to these standards. 

Unconstrained by any checks on the authority of its police, the Chinese Government’s police-run DNA database system is extending already pervasive surveillance over society, increasing discriminatory law enforcement practices and further undermining the human rights and civil liberties of Chinese citizens.

The tools of biometric surveillance and political repression first sharpened in Xinjiang and Tibet are now being exported to the rest of China.

In the light of our report, ASPI recommends as follows:

  • The Chinese Government should immediately cease the indiscriminate and compulsory collection of DNA samples from ordinary Chinese civilians, destroy any biological samples already collected, and remove the DNA profiles of people not convicted of serious criminal offences from its forensic databases.
  • The UN Special Rapporteur on the right to privacy should investigate possible human rights violations related to the Chinese Government’s DNA data collection program and broader programs of biosurveillance.
  • Governments and international organisations should consider tougher export controls on equipment and intellectual property related to forensic DNA collection, storage and analysis being sold in Chinese markets.
  • Biotechnology companies should ensure that their products and services adhere to international best practices and don’t contribute to human rights abuses in China, and must suspend sales, service and research collaborations with Chinese state authorities if and when violations are identified.

Appendix 1: Data sources

In chronicling the Chinese Government’s latest DNA dragnet, this report draws on more than 700 Chinese-language open-source documents that refer to the current program of Y-STR data collection, as well as related research on the forensic applications of Y-STR analysis in China and materials concerning China’s domestic forensic science market.

The sources listed in Table 1 don’t include the Chinese- and English-language sources we have cited concerning China’s broader systems of surveillance and governance, China’s earlier biometric data collection programs in Xinjiang and Tibet, or reports on DNA collection programs outside of China.

Table 1: List of primary data sources

Documented instances of police-led Y-STR data collection have been found in 22 of China’s 31 administrative regions (excluding Hong Kong and Macau),138 and in more than a hundred municipalities. It’s important to note that this total is likely to be an underestimate; instances of DNA collection may go unreported, and the true scale of the program is likely to be much greater. Data collection also appears to be continuing in some locations.

Appendix 2: How Y-STR samples are collected

The Chinese Government’s Y-STR data collection program appears to happen mostly in rural areas or townships and villages located on the periphery of cities. This may be because it is easier for police to produce accurate genealogies of patrilineal families and collect samples from multiple members of the same family in rural areas, where multiple generations of a single family are more likely to live in close proximity.139 Furthermore, many current urban residents are first- or second-generation migrants who can trace their ancestry back to extended families living in rural areas. Greater genetic coverage of Chinese men is more likely to be achieved by focusing on their ancestral families, rather than recent migrants to major cities. Finally, Chinese authorities may be focusing on rural areas because they believe their program will face less public scrutiny there than in more developed urban areas.

No matter where data collection occurs, this program is broken down into four stages: 

1. Preparatory meetings

Local Y-STR data-collection work begins with meetings led by the public security bureaus where police officers and other government officials are introduced to the role Y-STR data collection can play in combating crime and strengthening ‘social management’ (Figure 21).140

Figure 21: Local officials meeting to discuss male ancestry inspection systems, Anlu, Hubei Province, September 2019, and Weinan, Shaanxi Province, August 2018

Sources: ‘Chendian Township held a training seminar on mobilisation of the male family tree investigation system’ (陈店乡举办男性家族排查系统建设工作 动员业务培训会), Anlu Government (安陆政府网), 3 September 2019, online; ‘Weinan Municipal Public Security Bureau’s male family investigation system construction site promotion meeting was successfully held in Heyang’ (渭南市公安局男性家族排查系统建设现场推进会在合阳圆满召开), Meipian (美篇 网), 9 August 2018, online.

During these meetings, officers are organised into subgroups responsible for particular datacollection-related tasks. Meetings end with the signing of letters of responsibility, which lay out the obligations government offices have for completing Y-STR data-collection work.

2. Creating family trees

The next step is creating family trees for local men and boys. Collecting accurate genealogical information on local patrilineal families is of vital importance. This information will be used to identify a representative sample of men and boys from whom to collect genetic data and, in the future, will allow police to connect Y-STR data from an unknown male to a particular patrilineal surname and all the men sharing that name.

To collect genealogical information on male family members, police officers visit individual families, often accompanied by village cadres.141 Through these visits, police try to map out family genealogies going back from five to eight generations (Figure 22).142

Figure 22: Collecting genealogical data by hand, Chaohu, Anhui Province, April 2018, and Jinan, Shandong Province, September 2018

Sources: ‘Huailin town carried out male family tree survey and mapping’ (槐林镇开展男性家族家系调查和图谱绘制工作), Chaohu Government (巢湖政 府网), 10 April 2018, online; ‘The Chengguan Office successfully completed the Y library information collection task’ (城关所圆满完成Y库信息采集任务) Chegguan Police Station (城关派出所), 29 September 2018, online.

A mock illustration of these family trees is found in a 21 August 2018 government notice on Y-STR data collection in Sui County, Hubei Province, where names, mobile numbers and ID card numbers are collected (Figure 23).

Figure 23: Mock genealogical chart, Sui County, Hubei Province

Source: ‘Notice of the County Government Office on printing and distributing the work plan for the construction of the “Y-STR” DNA database in Sui County’ (县人民政府办公室关于印发随县’Y-STR’DNA数据库建设工作方案的通知), Sui Country Government (随县政府网), 4 September 2018, online. This mock
chart captures five generations of a single patrilineal family with the names, phone numbers and presumably state ID numbers to be recorded for each individual identified.

Family trees are first drawn by hand,143 and police officers and local officials work with members of targeted families to ensure accuracy (Figure 24).144 Not all local males are targeted, however. According to the same 2018 work notice from Sui County, only information on permanent residents in the rural or semi-rural counties, townships or ‘villages within cities’ of these municipalities is recorded.145

Figure 24: Completed family trees, Luliang, Shanxi Province, June 2018, and Baoji, Long County, Shaanxi Province, October 2018 (cropped)

Sources: ‘Lin County Public Security Bureau Y-STR DNA Family Investigation System Construction Database’ (临县公安局: Y—STR DNA家族排查系统建设数 据库), Meipian (美篇网), 26 June 2018, online; Caojiawan Police Station of Long County Public Security Bureau completed the first male family survey map (陇县公安局曹家湾派出所完成首张男性家族家系调查图谱), Meipian (美篇网), 10 October 2018, online.

After family trees are checked for errors, the finished charts are entered into computer databases using the commercially available genealogical mapping software ‘Ancestry Artisan’ (Figure 25).

Figure 25: Inputting genealogical information, Tongchuan, Shaanxi Province, August 2018 (cropped)

Source: ‘Chengguan Police Station completed the construction of male Y DNA bank’ (城关派出所全面完成男性Y库建设工作), Nanyuan Police (南苑警务网), 8 August 2018, online.

3. Compulsory collection of blood samples

Based on the family trees, a non-random sample of local men is targeted for compulsory Y-STR data collection (Figure 26). Estimates for the proportion of local men targeted vary from roughly 8.1% in Dongsheng District, Lingqiu County, Shanxi Province146 and 9.6% in Ordos, Dongsheng District, Inner Mongolia,147 to 25.4% in Tongchuan, Yijun County, Shaanxi Province148 and 26.4% in Changzhi, Tunliu County, Shanxi Province.149

Figure 26: Blood collection in Tongchuan, Shaanxi Province, June 2019, and Zhangzhou, Fujian Province, April 2019

Sources: ‘Tongchuan police: Hongqiao Yuhua Police Station completed the annual DNA blood sample information collection task’ (铜川公安:虹桥玉华派出 所完成全年DNA血样信息采集任务), Hongqiao Yuhua Police Station (虹桥玉华派出所), 9 June 2018, online; “Changtai: Blood Collection Notice” (长泰:采血 通告), Soho (搜狐网), 20 April 2019, online.

Samples are taken in the form of blood via a pinprick to the finger,150 and blood is collected on a paper card, which is then inserted into an envelope (Figure 27). This method of sample collection allows large amounts of data to be collected in the absence of storage space.151

Figure 27: Blood collection cards and envelopes, Tongchuan, Shaanxi Province, June 2019 (cropped), and Xi’an, Zhouzhi County, Shaanxi Province, May 2019

Source: ‘Jiufeng has taken multiple measures, combined points with points, broken common rules, and promoted quickly to strive to complete the construction of male family trees as soon as possible’ (九峰所多策并举、点面结合、打破通例 、快速推动,争取早日全面完成男性家系建设工作), Meipian (美篇网), 24 May 2019, online.

In some cases, blood is collected from individuals in their community, as shown in a video from 17 May 2019 of a police officer in Anqing, Anhui Province, taking blood from an elderly man (Figure 28).

Figure 28: Screen capture taken from video of blood collection in Anqing, Anhui Province, May 2019

Source: ‘In order to build the Y-DNA bank and not affect the farming time of the masses, the auxiliary policemen from Liuping Police Station entered the field on 17 May to collect blood samples for the Y-DNA bank from the people in the jurisdiction and publicise safety precautions’, (为了Y库建设工作和不影响群 众农耕时间5月17日柳坪派出所民辅警走进田间地头,为辖区群众采集Y库血样和宣传安全防范), Susong Liuping Police (宿松柳坪派出所), video, 17 May 2019, online.

In other cases, samples are collected simultaneously from numerous men at a designated location. 

A July 2019 video (possibly from Sichuan Province) shows dozens of men—many holding what appear to be copies of their family trees—having their blood taken by public security officers (Figure 29).

Figure 29: Screen capture taken from video of blood collection in Sichuan Province, July 2019 (cropped)

Source: ‘Rural: What are you doing together? It turns out collecting blood samples!’ (农村:大家围在一起干吗了,原来是在采集血样!), Tencent Video (腾讯视频), video, 15 July 2019, online.

Uniformed police officers aren’t the only ones who conduct blood collection. In a June 2019 video shot at a village government office in the Fuling District of Chongqing, local officials are seen recording identifying information for numerous men on sample collection envelopes before collecting blood samples (Figure 30).

Figure 30: Screen capture taken from video of blood collection in Fuling District, Chongqing Municipality, June 2019 (cropped)

Source: ‘The staff went to the village to collect DNA blood samples, which greatly conveniences the people’ (工作人员到村里面进行DNA血样采集,极大的 方便了人民群众), Haokan Video (好看视频), 11 June 2019, online.

According to the website of Bosun Life—a Beijing-based company that builds Y-STR databases—one person is selected for Y-STR collection out of a family of five to six, while two people are selected from a family of up to fifty.152

Figure 31: Blood collection in Ningde, Zhejiang Province, April 2019

Source: Nodded attention! Male family blood sample collection work started’ (点头人注意!男性家族血样采集工作开始了), Sohu (搜狐网),| 30 April 2019, online.

Local governments are under intense pressure to meet DNA sample-collection targets set by superiors higher up in the state, and there’s evidence that systems of rewards and punishments have been instituted to ensure that sample-collection quotas are met.153

4. Data sharing with public security bureaus

Once local blood collection is complete, data is entered into specialised police-run Y-STR databases (Figure 32). Numerous requests for tenders and procurement orders for the construction of Y-STR databases have been found for local public security bureaus across China.154

Figure 32: Data entry, Wulanhaote, Inner Mongolia, September 2019

Source: ‘Collection of blood samples from male families’ (男性家族血样采集工作), Meipian (美篇网), 17 September 2019, online.

In turn, these local databases are connected to a network of provincial Y-STR databases and the national forensic DNA database, as stated in government tenders (Figure 33).155

Figure 33: Data sharing between public security bureaus using Yingdi’s Y-STR database system (translated)

Source: ‘Solution pages of police equipment’ (解决方案列表), Yingdi (武汉英迪科技发展有限公司), online. Translated from Chinese by ASPI.

Appendix 3: Estimating the scale of Y-STR sample collection

While we know Y-STR samples have been collected from males across China, it’s difficult to determine how many boys and men in total have been targeted. However, a rough estimate can be produced. 

This requires first calculating the size of the pool from which samples could be taken. The scale of the Henan Y-STR database gives us a good indication of the proportion of men and boys who may have been targeted. Between 2014 and 2016, 5.3 million Y-STR profiles were collected from a total male population of roughly 49.6 million, or roughly 10% of all males. This was believed to have given authorities nearly 98.71% coverage of the province’s male population.156

In some cases, precise figures indicating the scale of male data collection in particular localities are available. By comparing the total number of Y-STR samples collected to the population of local males (roughly estimated to be half the total local population), we’re able to estimate the percentage of men and boys from whom biometric data may have been taken (Table 2).

Table 2: Local data on Y-STR sample collection

Please download PDF for full source listing.

We know from government records that, in areas where Y-STR data collection has occurred, anywhere from roughly 8.1% to 26.4% of all males have been targeted. The wide variation in those figures may reflect efforts to collect more data than needed.

Government procurement orders can also be used to estimate the scale of Y-STR sample collection (Table 3). Some of those orders provide precise figures for the number of Y-STR sample-collection cards local authorities have purchased. By comparing the number of sample-collection cards to the local male population (roughly estimated to be half the total local population), we can estimate the percentage of local men who may have been targeted for DNA data collection.

Table 3: Government bid invitations and procurement orders for Y-STR blood sample collection cards

Please download PDF for full source listing.

From these records, we can estimate that local authorities have purchased enough Y-STR analysis kits to collect samples from anywhere between roughly 7.4% and 26.2% of all local males. The wide variation in these figures may again reflect efforts to collect more data than needed.

The large proportion of men and boys targeted for data collection in some localities may be offset by lower levels of data collection in other areas. We have also considered the possibility that in some areas of the country data collection might not be taking place. While we know that this is a nationwide campaign, we don’t yet have precise figures for the number of municipalities in which data collection has occurred. For example, mass Y-STR collection doesn’t so far seem to be taking place in first-tier cities such as Beijing or Shanghai.

Based on these considerations, and the scale of the earlier provincial Y-STR database built by the Henan Public Security Bureau,157 we therefore estimate that the Chinese Government may be seeking to collect Y-STR profiles from as many as one out of every 10 males in China.

The proportion of men and boys within individual families targeted for Y-STR sample collection also gives us clues about the possible scale of this program. There are indications that the authorities aim to collect samples from at least two men from every family of six to 50 people, and a further one or two samples from families of more than 50 members.158 It isn’t clear how rigorously police are adhering to these standards, but at a minimum this suggests that the Chinese Government aims to collect Y-STR samples from roughly five out of every 100 men.

We therefore conservatively estimate that authorities aim to collect DNA samples from around 5-10% of China’s total male population of roughly 700 million. Based on these calculations, a completed nationwide system of Y-STR databases will likely contain at least 35–70 million genomic profiles.

How do these tens of millions of Y-STR samples relate to the Chinese Government’s broader genomic surveillance capabilities? According to a report by the Chinese insurance company Ping An, in 2016 Chinese authorities possessed DNA records for 44.35 million people, including 40.7 million from forensic databases, 1.49 million from crime-scene databases, 594,000 from missing people databases, and 513,000 in so-called ‘base level’ DNA databases.159 To those numbers we can add the roughly 23 million profiles taken in Xinjiang and 3 million in Tibet, for a new total of roughly 70 million—a total slightly lower than the figure of 80 million cited in recent Chinese press reports160 but identical to that provided on the website for Hisign Technology.161

If we add the estimated 35–70 million Y-STR profiles to the 70 million profiles authorities already possess,162 the Chinese Government likely has 105–140 million profiles on file. That doesn’t include DNA profiles currently being enrolled in the ‘newborn genebank’ that is being trialed in the Guangxi Zhuang Autonomous Region and Chongqing.163

Appendix 4: Companies participating in national Y-STR data collection

Table 4 lists Chinese and multinational companies that are known to provide the equipment, consumables, services and intellectual property used by the Ministry of Public Security and public security bureaus across China as part of the ongoing national program of Y-STR data collection.

Table 4: Chinese and multinational companies involved in the Y-STR data collection program

[[ Please download PDF for full source listing. ]]

Download

Readers are urged to download the full report PDF for the full sources, citations and references.


Acknowledgements

The authors would like to thank Danielle Cave, Derek Congram, Victor Falkenheim, Fergus Hanson, William Goodwin, Bob McArthur, Yves Moreau, Kelsey Munro, Michael Shoebridge, Maya Wang and Sui-Lee Wee for valuable comments and suggestions with previous drafts of this report, and the ASPI team (including Tilla Hoja, Nathan Ruser and Lin Li) for research and production assistance with the report. ASPI is grateful to the Institute of War and Peace Reporting and the US State Department for supporting this research project.

What is ASPI?

The Australian Strategic Policy Institute was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally.

ASPI International Cyber Policy Centre

ASPI’s International Cyber Policy Centre (ICPC) is a leading voice in global debates on cyber and emerging technologies and their impact on broader strategic policy. The ICPC informs public debate and supports sound public policy by producing original empirical research, bringing together researchers with diverse expertise, often working together in teams. To develop capability in Australia and our region, the ICPC has a capacity building team that conducts workshops, training programs and large-scale exercises both in Australia and overseas for both the public and private sectors. The ICPC enriches the national debate on cyber and strategic policy by running an international visits program that brings leading experts to Australia.

ASPI’s International Cyber Policy Centre has no core funder. Rather, it is supported by a mixed funding base that includes sponsorship, research and project support from across governments, industry and civil society.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional.

© The Australian Strategic Policy Institute Limited 2020

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

First published June 2020.

ISSN 2209-9689 (online)
ISSN 2209-9670 (print)

Winning hearts and likes

How foreign affairs and defence agencies use Facebook

What’s the problem?

For defence and diplomacy, digital media, and specifically social media, have become an unavoidable aspect of their operations, communications and strategic international engagement, but the use of those media isn’t always understood or appreciated by governments.

While the Department of Foreign Affairs and Trade (DFAT) and the Department of Defence (DoD) both use social media, including accounts managed by diplomatic posts overseas and by units of the ADF, both departments can improve how they reach and engage online. It’s important to note, however, that their use cases and audiences are different. DFAT’s audience is primarily international and varies by geographical location. Defence has a more local audience and focus.

More importantly than the content, online engagement is dependent on the strength of the ties between the senders or sharers and the recipients of the content. For both departments, improving those online ties is vital as they seek to influence.

What’s the solution?

The Australian Government should use social media far more strategically to engage international audiences—particularly in the diplomatic and defence portfolios. Both DFAT and Defence should review outdated digital strategies, cross-promote more content and demonstrate transparency and accountability by articulating and publishing social media policies.

Both departments should create more opportunities for training and the sharing of skills and experiences of public diplomacy staff. They should refrain from relying solely on engagement metrics as success measures (that is, as a measure of an individual’s, usually senior staff’s or heads of missions’, level of ability or achievement).

Instead, by changing the emphasis from the producers of social media content to the audiences that interact with it, the engagement data can be usefully regarded as a proxy for attention and interest. This can tell us what kinds of audiences (mostly by location) are engaged, and what types of content they do and don’t engage with. This information indicates the (limited) utility of social media; this should guide online engagement policy.

This report also highlights and recognises the value of social media for the defence community — especially as a means of providing information and support for currently serving personnel and their families—by supporting the use of Facebook for those purposes by all defence units.

DFAT should remove the direction for all Australian heads of mission overseas to be active on social media. While this presence is indeed useful and boosts the number of global government accounts, if our ambassadors aren’t interested in resourcing those accounts, the result can be sterile social media accounts that don’t engage and that struggle to connect with publics online. Instead, both departments should encourage those who are interested in and skilled at digital diplomacy to use openness, warmth and personality to engage.

Introduction: the global rise of Facebook

This report examines DFAT’s and the DoD’s use of one social media platform—Facebook—and evaluates current practices to identify how, where and for what purposes Facebook has impact. 

The focus on Facebook reflects the platform’s global reach and its popularity as an everyday, essential medium for accessing and sharing information. Besides notable exceptions (such as China), in most places (such as some Southeast Asian countries), Facebook is so popular that it’s often roughly synonymous with ‘the internet’. This is a symptom of the platform’s ubiquity and utility as well as a consequence of Facebook’s heavily promoted services, including the Free Basics internet access service, which provides limited online access via a Facebook application.1

In order to generate lessons learnt, this report makes comparisons between Australian Government pages and their counterparts in the US, the UK, New Zealand and Canada. The analysis of Facebook use for diplomatic purposes is based on 2016–17 data extracted from Facebook pages of the diplomatic missions of eight ‘publisher’ nations (the five that are the subject of this report, as well as India, Israel and Japan) in 23 ‘host nations’.2 More recent data couldn’t be used because access is no longer available, but a review of the pages suggests that the analysis stemming from the data extracted during that period remains relevant.

The underlying design of Facebook deeply influences and limits its use by publishers and users. The Facebook newsfeed—the most commonly used feature for getting regularly updated information — prioritises posts from accounts that are either closely associated through a history of user activity, including liking, sharing, commenting and messaging, or are boosted through paid promotion.

One of the main consequences is that the more a Facebook user interacts with content that they prefer, the more likely they are to receive that type of material in their newsfeeds, which they’re in turn more likely to interact with and so on. Successful content has emotional appeal, or is useful, and comes from a Facebook page that’s been frequented by the user or been shared with a close member of a user’s Facebook network of friends. As this cycle continues, Facebook ‘gets to know its users better and better’.3

In other words, it isn’t enough to make engaging (meaning fun, compelling or relevant) content. Online engagement is dependent on the strength of the ties between the senders or sharers and the recipients of the content, at least as much and very probably more than the nature of the content. Understanding this is vital for governments as they seek to influence online.

But, as a social media network, Facebook brings with it complications for public diplomacy and defence social media strategies. For example, Facebook’s utility is limited by its underlying algorithm architecture and the habits and preferences of individual Facebook users, which are influenced by in-country patterns of social media usage and internet access. These issues need to be factored into departmental communications policies and social media strategies.
 

Online content, classified

Facebook posts can be classified into four types, according to their apparent function or purpose: outward-facing publicity (including propaganda), inward-facing publicity, engagement, and diplomacy of the public.4 The categories often overlap: content may be both inward- and outward-facing, for example. An analysis of these four types of content can be very useful for creating a strategy for effective DFAT and DoD Facebook use.

1. Outward publicity

Outward-facing publicity is the most common. It’s characterised by its evident target being the broader public of the country in which it’s posted, or a section of that public, such as overseas students, potential immigrants or, less commonly, large expatriate populations. It therefore uses the language of the local population and locally popular themes and topics. Content varies but usually involves the provision of information, publicity for events, branding exercises or the posting of trivia (such as pictures of koalas). Posts can also be warm and personal and include one of the internet’s maligned features—cuteness.

The most popular Facebook post recorded during this research displays many of those features. It’s a video of two American embassy ‘diplokids’ playing the Indian national anthem on the occasion of India’s Independence Day.5 It’s been viewed 2.53 million times and shared more than 125,000 times (as of January 2020).

Many popular posts are practical and transactional, such as information about employment, scholarships, funding opportunities and visa applications. The US Embassy in Mexico, for example, published a series of videos outlining the procedures for various visa classes. The Australian Consulate in Hong Kong published a sequence of posts targeting Australian citizens in the lead-up to the 2016 Australian federal election with information about how to vote, and—taking advantage of Facebook’s potential to target specific audiences—paid to promote them.

Posts announcing employment opportunities at the embassy or consulate for locally engaged staff are consistently among the most popular, especially in small and developing countries. These posts can serve as more than mere job ads. One such post, on the American Facebook page in Iraq, prompted an enquiry via the comment feed from a potential applicant who feared he might be too old to apply. The American page administrator replied, assuring this applicant that his application would be welcome and reiterating American policies against age-based discrimination in a way that promoted US values and demonstrated respect for an older Iraqi man, which in return inspired several positive comments in the thread.

Other popular outward-facing promotional posts include commemorations on significant memorial days and on the occasion of tragedies such as natural disasters. Noting these days of significance on Facebook should out of respect be considered obligatory, as they largely appear to be. Posts announcing support in the aftermath of disasters are often very well received (as indicated by numbers of shares and supportive comments) and suggest that Facebook can have a useful role in promoting aid and relief efforts. For example, the Australian Embassy in Fiji posted about assistance efforts after Tropical Cyclone Winston in 2016; those posts had engagement figures in the thousands (the mean engagement figure for 2016 was 29).6

Facebook posts promoting military activity elicited significant support in other contexts. US Facebook posts in support of Iraqi soldiers serving as part of the American-led coalition against Daesh, for example, were widely shared and commented on, almost entirely positively.

How important are ambassadors and consuls-general as proponents of outward-facing publicity? The research suggests that they’re significant assets where they’re personable and relatable and embrace the community and nation where they’re posted. Speaking the local language, either proficiently or with evident effort, is a major asset. While most posts are typically published in the local language (often as well as in English), publishing videos of heads of mission speaking the language seems to have additional audience appeal. One of the few Australian Facebook pages that increased its levels of engagement from 2016 to 2017 was that of the Embassy in Paris. Australia’s Ambassador to France, Brendan Berne, a fluent French speaker, features in a number of posted videos, including media appearances and official speeches.

In one popular video post, Ambassador Berne introduced changes in Australian law to legalise same-sex marriage and then popped the question to his unsuspecting partner, Thomas.7 This was acknowledged as unorthodox but was a calculated risk that paid off, increasing the profile of the Ambassador and thereby providing him with further platforms, including popular mainstream broadcast media, on which to promote the bilateral relationship.

Former US Consul-General in Hong Kong, Clifford Hart, exemplified how the personal can empower public diplomacy, to the extent that he was known as Clifford Baby (or ‘Clifford BB’).8 His very popular farewell video post featured Hart reflecting in Cantonese on his favourite places and dishes in Hong Kong. The video also uses catchphrases from Stephen Chow (an iconic actor in Hong Kong), which, while meaningless for those unfamiliar with his work, carried immense appeal for Hong Kongers.

2. Inward-facing publicity

Inward-facing publicity is related to outward-facing publicity but has an internal focus by appealing to smaller audiences—perhaps the local diplomatic or government community or to (even more internal) colleagues in Barton, Foggy Bottom or Whitehall.

This content frequently features a staged, formulaic photo of ‘distinguished guests’ at an official event.

Anecdotally, it’s been made clear to me on a number of occasions that this type of content is regarded as important, to the extent that hours can be spent on its production—the text carefully parsed and often escalated up the chain for approvals.

Although these events have limited appeal, they have a specific value that isn’t evident in their typically low engagement metrics.9 They’re important for those people featured in the photo and at the event as a record and an acknowledgement of their participation, and for indicating their status by highlighting their access, but the limited broader appeal of the posts suggests that the resources devoted to them should be minimised.

Other types of posts are evidently not (or poorly) targeted at a broader local public. These posts are characterised by the negligible use of local language or cultural connections and an overt emphasis on topics and themes that are of minimal interest to local target populations and more aligned to internal or specialised interests.

Common examples include key messages from governments about matters that are perhaps of global significance and represent core national values or positions on international matters (such as an opinion on certain environmental or human rights issues) but do not, according to the engagement data, resonate locally. These types of posts do no harm and are probably useful as records of, and advocacy for, important international issues. However, if they’re resource intensive, they present a poor return on investment.

One example of content that’s, probably inadvertently, inward-facing is a series of podcasts produced by the Australian Embassy in South Korea using the time of very senior diplomatic officials and promoted on the Embassy’s Facebook page. The podcasts featured interviews in English with significant Australians, including senior government figures. The low engagement metrics on Facebook (and the modest listening figures via Soundcloud) are unsurprising: in a saturated media market it’s difficult to imagine the appeal of podcasts in English featuring guests who (although esteemed and accomplished) are of marginal interest to a Korean audience.

The podcasts weren’t an evidently effective way of engaging with a Korean audience and, after 28 episodes over 18 months, were concluded at the end of 2017. While here it’s characterised as unsuccessful, creativity and bravery in public diplomacy should be supported. The idea of using podcasts is one that has value and could be adopted elsewhere, perhaps targeting specific audiences such as potential international students or investors and promoted via a more professionally oriented platform, such as LinkedIn. The South Korean experiment has the obvious lesson that such efforts can be made more likely to have impact if they’re planned to connect to and target local audiences as well as conveying Australian views and expertise.

Analysis for this report reveals that both outward- and inward-facing publicity posts by DFAT and Defence vary greatly in the engagement rates they enjoy. It’s difficult to see a pattern, and most successful posts are probably a result of good luck, good management and additional localised idiosyncrasies. But the general sense is that audiences largely pay attention to content that’s useful and relevant for them, not necessarily what’s most important to the authors of the content.

3. Engagement

Engagement posts are far less common than publicity posts. This is a bit surprising, as social media has been lauded as a site for interaction, discussion and debate and for making connections.

Some recent scholarship has concluded that diplomats aren’t taking advantage of this potential due to ingrained, institutionalised resistance, based on norms for information control and risk aversion.10 As a probable factor, this report outlines another entrenched problem: Facebook, due to its algorithmic factors that prefer close ties or paid promotion, isn’t often a very good platform for two-way engagement.

There are, however, some excellent examples of how Facebook has been used by Australian diplomats to facilitate a limited yet effective type of engagement through photo competitions. One, in Timor-Leste, invited photographs that characterised and shared affection for that country, thereby demonstrating ‘relational empathy’.11 Another, in the Australian Office in Taipei, invited Taiwanese in Australia to submit photographs of their travels and experiences, resulting in Taiwanese participating in a kind of networked conversation with other Taiwanese about their positive experiences in Australia, via an Australian diplomatic Facebook page. These types of photo-based campaigns could be replicated elsewhere.

Both of these competitions take advantage of a key function of social media—the ability to share images and tag friends—to increase the reach of their content. This turns Facebook users into micro-influencers, quite powerful at a smaller scale, distributing and personally endorsing content in their networks. An obvious advantage is that the content is provided and driven by users, not government officials. The fact that the content providers are from the local community also makes the content itself likely to have local references and appeal.

4. The audience, themselves

The last type of content present on these Facebook pages isn’t authored by the account holders (the diplomats) but by the Facebook users themselves. Usually, this appears in the comments, which can easily veer off onto (some malicious but some benign, even useful) tangents. The US Embassy in Mexico, for example, posts information about visa applications that can prompt reams of comments that ask for advice about people’s precise circumstances. Many of the requests are responded to by other Facebook users, who are able to offer specific advice.

Examples like this underscore the key lesson about Facebook for public diplomacy: social media users are often active audiences and participants who make choices about what content they respond to and how they respond to it based upon how relevant, useful and appealing they find it. This fundamental conclusion is a core lesson for DFAT and similar agencies.
 

Engagement—by the numbers

Ranking nations according to metrics fuels the spurious idea that those nations might be in competition with each other for attention in the digital space. Instead, it’s evident that diplomacy per se is in competition with the practically limitless amount of material published from all manner of sources, much of it antithetical to the aim of international amity, and all diplomats could benefit by learning from each other’s experiences. Instead of treating them as a measure of success, engagement metrics can be useful means of approximating audience size and attention.

On average, the data (in Figures 1–4) indicates that the Facebook audience for the 23 US official diplomatic accounts reviewed is far larger than others, but is also relatively passive. In comparison, Australia’s audience is comparatively more active and engaged. But we should note that all the figures below are global averages, varying considerably by location (again suggesting that a global ranking is unhelpful). The variations between the locations (see Table 1) contain important insights about what types of useful content, and which audiences are more active and engaged, are consequently more valuable.

All the following data is based on the Facebook pages of official diplomatic posts (embassies, consulates and similar offices).12 They’re typically managed by diplomatic staff who are often not public diplomacy specialists and are usually on a 3–4 year posting, usually with considerable input by locally engaged staff.

Figure 1 is based on the numbers of page likes (people who have ‘liked’ a Facebook page) in the host country where an embassy or consulate is located. Figures 2–4 are based on the levels of engagement (reactions, comments, shares) with the content that those embassies and consulates posted on their Facebook pages.

Figure 1: Facebook page likes, January–February 2018 (total, users located in host country)

Note: This data is no longer downloadable from Facebook’s application programming interface due to restrictions introduced by Facebook in 2019. This is one of the ways Facebook has limited public access to data. For example, until early 2018, it was possible to extract data about the location (based on their Facebook profile) of Facebook page followers, making it feasible to analyse the percentage of followers who were located in the host country (that’s the figure used here) or who were located elsewhere, either based in the home country (probably mostly expats) or in a third country. This includes followers who are suspected to be bogus, either paid to follow through click farms or fake accounts attempting to appear real. See D Spry, ‘Facebook diplomacy, click farms and finding “friends” in strange places’, The Strategist, 7 September 2017, online.

Figure 1 is the total for all of the embassies and consulates counted (a list of them is included in Table 1). Figure 2 is the average figure per embassy or consulate.

Figure 2: Average engagement per Facebook page, January–February 2018

The large number of the US Facebook page likes/followers highlighted above results in a relatively high level of engagements per post but not more engagements per user. In the latter category, Australia leads; the US runs last.

Figure 3: Average engagement per Facebook post, January–February 2018

Figure 4: Average engagement per Facebook user, January–February 2018

Table 1 shows Facebook reach (the percentage of a country’s total Facebook users who are following an embassy or consulate Facebook page) for 23 countries. As per Figure 1 (and see endnote 11), these figures include only those Facebook users who are located (according to their profile) in the country where the embassy or consulate is based (for example, followers of the Australian Embassy in Dili who are based in Timor-Leste). The figures in Table 1 are the average figures for the five nations and can vary considerably. For example, for Timor-Leste the average for all five embassies is 10.495% but for Australia it’s considerably higher (approximately 35% when last checked; this is one of the few embassy Facebook pages that demonstrates significant growth).

Table 1 also demonstrates the correlations between Facebook reach and per capita GDP, population size and median age (see the appendix for the methodology). Also, countries that are closer or more strategically intertwined are more likely to follow embassy and consulate Facebook pages (for Australia, Timor-Leste; for the US, Mexico and Iraq). An important finding of this research for Australian officials is that Facebook appears to be more useful for public diplomacy in developing countries that are small, young and geographically close to Australia.

Table 1: Facebook reach across 23 countries via a selection of indicators

The metrics vary by orders of magnitude: in Timor-Leste (on average) a Facebook page will be followed by about 10% of the population who have Facebook accounts; in Myanmar, it’s about 2%; in Taiwan and New Zealand, it’s about 1 in 1,000; in the UK and Canada, it’s about 1 in 10,000. In other words, on average, a Facebook page in Timor-Leste is close to a thousand times more likely to have a local follower than one in the UK or Canada.

For Australian diplomatic posts, the contrast is even starker: in Timor-Leste, around 26% of the local Facebook population follow the Facebook page of the Australian Embassy in Dili; the equivalent in the UK is 0.01%; in Canada, 0.005%. Australia’s Facebook page in Timor-Leste is around 5,000 times more likely to have a local follower than in Canada.

The temptation is to see this as a measure of the performance of Australia’s staff in Dili, Ottawa and London. That temptation should be resisted—there are, as Table 1 suggests, demographic factors (age, size, wealth) to consider when seeking reasons for the large variations in Facebook reach.

These demographic correlations suggest that Facebook diplomacy’s ‘success’ (or, I would suggest, ‘relevance’) isn’t necessarily the result of the public diplomacy staff’s skills and endeavours but more likely a product of external factors: the popularity of Facebook as a means of accessing information among younger populations; a lack of competing sources of information in smaller countries (with smaller media industries); and the funnelling of users onto the Facebook platform in those countries (including Timor-Leste and Cambodia) where Facebook’s Free Basics service provides free but limited internet access.

This implies that, while a Facebook page may be an effective, even a primary, public diplomacy tool in some places, it won’t always be in others: therefore, resources and strategy can be adjusted accordingly. For example, it suggests that the Australian embassies in Dili, Port Moresby and other high-ranking Facebook locations should be supported and encouraged to use Facebook (as they appear to be successfully doing). The high commissions in London, Ottawa and similar locations should maintain a presence but not prioritise Facebook as a means of public diplomacy, as it isn’t an efficient communication channel.

Limitations of using Facebook for diplomacy

However, if these numbers look small enough to question the point of having a Facebook page in some locations at all, it gets worse: average posts prompt engagement from between 1 in 100 and 1 in 1,000 followers. This means that in the UK, for example, the reaction rate is about 1 in 1 million active Facebook users. While reaction rates don’t equate to reach (reach figures aren’t obtainable), they’re indicative of attention and interest, and also contribute to the organic (non-paid) spread of the content.

This is likely to get worse. Changes to the Facebook algorithm since 2014 have made it more difficult to reach large audiences unless content is promoted through paid boosts. This is reflected in the engagement metrics falling or flattening year-on-year in most locations, with a few exceptions.

Therefore, the argument for an active Facebook page shouldn’t rest on the average engagement metrics alone. Facebook posts, as long as they’re prepared using minimal resources, are low risk, low investment and usually low reward. But some posts are quite valuable, even in locations where there’s usually little engagement, potentially serving as an economical means to exert influence with small, but repeated, effects. An examination of the types of posts and the levels of engagement they receive offers some insights.

Defence’s use of social media

A review of available defence organisations’ policies and associated commentary outlines three general areas of social media use:

  1. personal use by personnel, whether or not on deployment or active duty, and their families
  2. professional use by personnel in matters relating to their employment, such as networking and communication for the purposes of professional development and knowledge sharing
  3. official use by personnel acting as representatives of the defence force and in pursuit of the defence force’s aims.

The first type—personal use—prompts concern among military forces for its potential to endanger military personnel and operations, or to damage the reputation of defence organisations. Those risks aren’t confined to official Facebook pages and are as likely to occur elsewhere; infringements are already covered under existing policies (such as preventing harassment and promoting operational and personal security). Posting on social media may bring infractions to light, meaning that they can be addressed, but also increases the risk of exposing the offending content to a wider audience before it can be deleted and the infraction contained.

The UK and US defence forces are especially active in promoting responsible social media use, including by publishing guidelines for personnel.

These concerns are counterbalanced by the capacity for social media to act as a means for military families and friends to stay in touch with loved ones while they’re on deployment. Also, as some American studies suggest, social media are especially beneficial for military spouses who form support networks based on their shared experiences and concerns.13

The second type of use—professional but unofficial use—is evidenced in limited ways on Facebook.

One example is the Facebook page for The Cove,14 a website set up for the purposes of promoting research for military professionals.

The third type, official use, is the focus of this report. The defence forces of the Five Eyes nations all operate numerous Facebook pages. In the case of the US, each branch of the armed services has at least hundreds (US Air Force), if not thousands (US Army), of Facebook pages.15 The pages representing each of the main branches have millions of followers, while pages at the level of operational units (regiments, battalions and the like) vary in size accordingly.

Unsurprisingly, the Facebook pages of the branches of the US military have followers (page likes) an order of magnitude larger than in other nations (Figure 5).

Figure 5: US main military Facebook page likes, March 2018

The militaries of the others have comparable numbers of page followers, but the British Army has a significantly larger cohort than the others (Figure 6).

Figure 6: Main military Facebook page likes, non-US, March 2018

Quantitative analysis of the defence forces’ Facebook pages indicates that they receive considerably more attention and engagement than their diplomatic counterparts. The average Australian diplomatic Facebook page is followed by about 0.02% of the Facebook population in the host country (the notable exceptions are Timor-Leste, 26%, and Papua New Guinea, 7%). The larger defence force pages are followed by a larger portion of the Australian Facebook population: Defence Jobs Australia (3.3%) and the Australian Army (2.4%).

The raw numbers are similarly stark. Defence Jobs Australia has close to half a million followers, the Australian Army more than 360,000, the RAAF more than 280,000 and the RAN more than 120,000. Those numbers increase daily.

The combined figure of the page likes of the ADF Facebook pages analysed for this report is 1.45 million, or close to 10% of the Australian Facebook population (although of course many Facebook users can follow multiple pages and some may come from overseas).

In comparison, major news programs have about 1.5–2 million Facebook followers, and the ABC News Facebook page has close to 4 million. News and magazine pages are the leading Facebook pages for engagement, averaging about 100,000 engagements per page per week; Defence pages averaged 45,000 in total. The Australian Army page alone received 12,500 engagements on average per week—comparable to the music industry average and above education, department stores and politics.16

Other nations’ pages are similarly popular. These figures suggest that Facebook is valuable for defence forces as a means of communicating to their publics. They also suggest that those publics are paying attention to these pages.

Why? Partly, the answer lies in the content posted on the pages and the ways that publics engage with it. Defence department Facebook pages differ from their diplomatic counterparts in important ways—chief among them is the nature of their audiences, which appear more domestic and more closely engaged. Partly, this arises out of the large numbers of current and former personnel and their friends and families. Also, in many democracies, publics have greater levels of emotional connection— trust,17 nostalgia, admiration—with militaries than with other parts of government (including foreign affairs agencies).

Official use of these Facebook pages includes a number of related functions. The main ones are:

  1. publicity, firstly in the sense of promoting the defence force’s values, achievements and legacies, as well as information for potential recruits, and secondly in the sense of maintaining the openness and transparency that (within the parameters of operational and personal security) are expected from defence forces of democratic nations
  2. information sharing with the defence force’s broader community of interest, including family and friends of serving personnel and veterans as well as other stakeholders (such as people residing near bases or training areas), and including sharing details about exercises and deployments
  3. commemorations, including notifications and memorials for service personnel who have died on deployment or exercises, celebrations and thanks for retiring senior service personnel, and days of significance, either national (such as Anzac Day) or specific to the defence force.

This report’s analysis suggests that Facebook performs each of those functions usefully and in ways other forms of media would find difficult. User engagement varies considerably across the Facebook pages analysed. Some general observations include the following:

  • Levels of engagement are generally higher than for public diplomacy pages. In particular, defence content is shared more and attracts more comments.
  • Content on smaller Facebook pages (such as regiment, brigade or group pages) has a higher level of engagement per capita, suggesting a smaller but more engaged user community.
  • Comments appear to be positive and supportive: they express admiration for defence personnel, thanks for service (especially for those who died on duty), patriotism and nostalgia.
  • Military hardware in use has considerable appeal—cinematographic and otherwise.
  • Defence forces are highly regarded for their service (the ‘trust factor’) as well as their embodiment of national identity.
  • Members of defence forces, and their families and loved ones, use defence Facebook pages to express and share emotions, including, commonly, pride and admiration.

Some important posts—including notices about mental health—attract less engagement because those topics are sensitive and Facebook is public. This is an example of how Facebook users are conscious of their online personas and tend to portray themselves cautiously. It isn’t an argument against the value of those posts, which are useful opportunities for defence forces to raise awareness of important issues and available support services.

In action and in memoriam: ADF pages

The ADF Facebook pages attracting the highest engagement fall into two main categories: accounts of activities undertaken by ADF personnel (including community undertakings, training, exercises, deployments and military action) and commemorations of days of significance, the loss of military lives, or both.

The most important commemorative day on the Australian calendar, Anzac Day, is also the dominant topic on Defence Facebook pages, appearing in the top five most engaged posts of all the larger pages.

An exception is the Chief of the Defence Force’s Facebook page, where the most popular posts are those commemorating the return to Australia of fallen Vietnam War veterans and the 20th anniversary of the loss of 18 Army personnel during a Black Hawk helicopter collision in 1996.

On the smaller, unit-level Facebook pages, in addition to Anzac Day, popular posts commemorate important battles in the history of the unit, such as Long Tan in the Vietnam War and Kapyong in the Korean War. Other popular Facebook posts noted Australia Day, Mothers’ Day, Fathers’ Day and Christmas, sometimes connecting them to personnel currently serving overseas.

The popularity of commemorative posts suggests that Facebook facilitates support for ADF personnel and traditions in a public, shareable forum. Anzac Day’s popularity among the larger Facebook pages implies that those pages enjoy widespread popularity, whereas attention to unit-specific commemorations in the smaller pages indicates their importance to those with closer ties to those units, including veterans and their families.

Some posts feature videos of ADF personnel using impressive military equipment. These have evident appeal for military aficionados and, according to the Defence Jobs Australia Facebook page metrics, for potential recruits.

Another popular type of post outlines current actions taken by the ADF. Examples of this type include HMAS Darwin’s seizure, under UN sanctions, of illicit weapons heading to Somalia; assistance provided by HMAS Canberra to Fiji following Cyclone Winston; and Operation OKRA: Strike Vision, involving F/A-18A Hornets destroying facilities operated by Daesh in central Iraq.

Other examples of popular Facebook pages featuring the ADF in action include graduations (the Australian Defence Force Academy), promotions and—especially at the unit level—posts showing personnel assisting local communities and charities.

Five-Eyes defence forces

Commemorations and actions are top posts in other defence forces’ Facebook pages. The US defence forces’ pages, in particular, are notable for their popular displays of military hardware as well as being sites of public, patriotic support for troops.

The most popular post on the US Army Facebook page, on the anniversary on the 6 June 1944 D-Day landings in Normandy, exemplifies this combination of patriotism and military memorialisation. The comments on this post further indicate the commemoration’s personal significance for veterans’ families.

These US Facebook pages demonstrate the significance of the military services and suggest how deeply they’re embedded in American culture, in family histories, national identity and popular culture. Popular UK posts similarly suggest the link between military service, family legacies, history and nationalism—in this case sometimes represented by the British royal family.

Although similar themes are evident in all defence force Facebook pages, some examples of popular content from UK, Canadian and New Zealand pages offer small but significant contrasts with Australian pages.

For example, a New Zealand Defence Force video of a ceremony at the Menin Gate memorial in Ypres, Belgium, featuring personnel performing the haka was shared more than 30,000 times,18 and the most popular New Zealand Navy Facebook post was a link to a news report on the first sailor to get a moko (a full-face traditional Maori tattoo; Figure 7).19 The popularity of these posts reflects support for Maori culture as an intrinsic and valued part of New Zealand and its defence forces.

Figure 7: New Zealand Defence Force personnel perform a haka at Menin Gate, Belgium

25 April 2017, online.

Popular Canadian Facebook posts also showcase diversity and personality. The Canadian Army’s most popular post pays tribute to an indigenous veteran, Sergeant Francis Pegahmagabow of Wasauksing First Nation, a highly decorated World War I scout and sniper.20 Other popular content includes videos of deployed personnel in a snowball fight in Poland,21 a light-sabre fight marking Star Wars Day (#MayTheFourthBeWithYou),22 a warning against venturing onto military property while chasing Pokémon23 (see cover image) and personnel wearing red stilettos to support domestic violence survivors (Figure 8).24

Figure 8: Members of 3rd Canadian Division taking part in the #WalkaMileInHerShoes fundraiser in downtown Edmonton

Source: 3rd Canadian Division, ‘Members of 3rd Canadian Division are taking part in the #WalkaMileInHerShoes fundraiser in downtown Edmonton’, Facebook, 21 September 2017, online.

Defence recruitment

The relative popularity of defence recruitment sites indicates the value of Facebook for promoting military careers. This use of Facebook differs from the pages of the main defence force branches or at unit level, as it’s more akin to advertising and promotion and less like a community site: more bulletin board than discussion boards. It’s likely that many of these posts have been promoted through paid boosts and advertising, which is a common and reasonable use of marketing budgets (Figure 9).

Figure 9: Defence force recruitment page likes, March 2018

Generally, the recruitment pages’ content appears to have similar appeal to the main pages. For example, the most popular posts on the Defence Force Australia page are a 360-degree view of a boat drop from the amphibious ship HMAS Canberra (the second most popular post on Australian defence Facebook pages) and Anzac Day 2016. 

The recruitment Facebook pages are also notable for the high number of posts by Facebook users. Between 20% and 30% of the posts on the Defence Force Australia, RAF and UK Royal Navy recruitment Facebook pages are by users. Many of these user posts are genuine requests about positions and recruitment procedures.

Defence social media policy and strategy

The ADF’s social media guidelines, policies and strategy documents are not public. The last publicly available external review of Defence’s use of social media was released in 2011. 

This aversion to publicness and openness contrasts with the position of DFAT, which has published its public diplomacy25 and digital media strategies26, as well as the defence force of Canada, which has published its social media strategy,27 the defence force of the UK, which has published social media guidelines,28 and the various US forces, which have each published numerous policy and guideline documents.29

The Canadian social media guidelines go so far as to promote transparency and accountability as ‘principles of participation’, aimed at meeting community standards of trust and confidence.

It’s unclear why the ADF doesn’t operate on similar principles.

Conclusion and recommendations

Facebook pages provide opportunities for defence forces to communicate to publics and, at least as importantly, for publics to express their gratitude, admiration and affection to defence forces.

In contrast, diplomatic Facebook pages are targeted at, and receive attention from, foreign publics. Compared to defence, diplomatic Facebook pages receive far less attention, but the levels of attention vary. Specifically, in countries that are smaller, younger, poorer and closer (such as Timor-Leste and Papua New Guinea), Facebook is, based on the data, an important means to inform—and engage with—general publics. Communications strategy should therefore prioritise Facebook in those countries by training personnel, allocating funds to content production and paying heed to the levels and nature of engagement by publics. Elsewhere, such as in Canada and the UK, Facebook is far less important and should be deprioritised in, but not eliminated from, public diplomacy strategies.

The strengths and limitations of Facebook’s usefulness are determined by its algorithm, which prioritises audiences’ pre-existing connections and optimises content that appeals to their needs and desires. It’s essential therefore that Defence and DFAT prioritise those audiences when determining if, when and how to make use of Facebook.

This report argues for a measured, more strategic use of social media. Specific solutions are as follows.

For diplomacy

  1. Review the digital media strategy to account for the location-based variability of Facebook’s usefulness and prioritise resources accordingly.
  2. Encourage diplomatic missions to develop, implement and review localised social media plans using the experience and expertise of locally engaged staff (providing training where required), and redefine the role of Australia-based staff to strategic oversight and governance.
  3. Remove the direction for all heads of mission to be active on social media; encourage those who are active on Facebook to use openness, warmth and personality to create relational empathy.
  4. Create opportunities for training and sharing the skills and experiences of public diplomacy staff.

For defence

  1. Demonstrate and promote transparency and accountability by publishing social media policies.
  2. Recognise the value of social media for the Defence community, especially as a means of providing information and support for currently serving personnel and their families, by supporting the use of Facebook for those purposes by all defence units.
  3. Continue Defence’s impressive work using Facebook as a platform for the community to express support for personnel and veterans, and maintain the dignified, sombre tone of the memorial content.

For diplomacy and defence

  1. Consider cross-promoting content. Defence pages reach the large national audience that diplomacy increasingly needs. Diplomatic Facebook pages—in some locations—provide opportunities for the ADF to promote its actions and values to international audiences, acting as a useful vector for strategic communication.
  2. Refrain from using engagement metrics as success measures for diplomats; use them as proxies for public attention in order to gauge how the value of Facebook varies according to audience type and location.
  3. Prioritise audiences’ use of social media when developing strategies, creating content and allocating resources.

Appendix: Methodology

This research focused exclusively on Facebook. While other social network platforms, especially Twitter, are also relevant, they lie outside the scope of this report.

The research used digital media research methods, which made it possible to gather and analyse large amounts of data indicating Facebook users’ engagement with online content, including which posts received more than average attention, through the examination of Facebook engagement metrics (likes, comments and shares).

This enabled analysis of Facebook users’ interests based on either the content (what types of posts receive the most attention) or the users (who was engaging with content). In turn, this suggested how social media are used and therefore how they can be useful.

The analysis of Facebook use for diplomatic purposes is based on 2016–17 data extracted from Facebook pages of the diplomatic missions of eight ‘publisher’ nations (the five that are the subject of this report, as well as India, Israel and Japan) in 23 ‘host’ nations.30 Restrictions imposed by Facebook in 2019 (and before 2018 data was extracted) mean this form of research isn’t currently replicable. The database used in this research is therefore unique; it’s available from the author.

Unlike the defence Facebook pages, the data for the diplomatic pages includes the location of those Facebook users who have followed the Facebook pages of the diplomatic mission. Again, this feature is no longer possible due to restrictions introduced by Facebook in early 2018, before the defence Facebook pages analysis was undertaken.

This report is based on data that accesses the Facebook application programming interface and obtains Facebook post and comment content (text, and links to images and video), as well as engagement data (reactions, including likes, comments, and shares). Analysis followed a two-stage, mixed-methods approach. First, quantitative data analysis identified trends and outliers. Second, identified outliers (such as high-performing pages and posts) were treated as key case studies and their content was considered more closely using methods based on qualitative media studies.

The analysis of the Facebook pages was contextualised and informed by an examination of publicly available policy and strategy documents as well as background discussion with several currently serving or former defence and diplomatic personnel from Australia and elsewhere. An important note: the engagement metrics are not, and shouldn’t be, considered as indicators of the ‘success’ of a particular Facebook page. Instead, they were used here as indicators of attention, and therefore as a means of assessing what content a specific page’s audience was more interested in and how it made use of that content.


Acknowledgements

The author would like to thank the members of the Australian and international defence and diplomatic communities for their informal advice and support, as well as for their dedication and professionalism. Any errors and all findings, conclusions and opinions contained herein are my responsibility.

What is ASPI?

The Australian Strategic Policy Institute was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally.

ASPI International Cyber Policy Centre

ASPI’s International Cyber Policy Centre (ICPC) is a leading voice in global debates on cyber and emerging technologies and their impact on broader strategic policy. The ICPC informs public debate and supports sound public policy by producing original empirical research, bringing together researchers with diverse expertise, often working together in teams. To develop capability in Australia and our region, the ICPC has a capacity building team that conducts workshops, training programs and large-scale exercises both in Australia and overseas for both the public and private sectors. The ICPC enriches the national debate on cyber and strategic policy by running an international visits program that brings leading experts to Australia.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional.

© The Australian Strategic Policy Institute Limited 2020

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

First published May 2020.

ISSN 2209-9689 (online)
ISSN 2209-9670 (print)

  1. L Mirani, ‘Millions of Facebook users have no idea they’re using the internet’, Quartz, 9 February 2015, online. See also Facebook, ‘Where we’ve launched’. ↩︎
  2. D Spry, ‘Facebook diplomacy: a data-driven, user-focussed approach to Facebook use by diplomatic missions’, Media International Australia, 168(1):62–80. ↩︎
  3. ‘The inquiry: How powerful is Facebook’s algorithm?’, BBC World Service, 24 April 2017, online. ↩︎

National security agencies and the cloud: An urgent capability issue for Australia

This new ASPI report, argues for the development of a national security cloud. If the community doesn’t shift to cloud infrastructure, it’ll cut itself off from the most powerful software and applications available, placing itself in a less capable position using legacy software that vendors no longer support.

The report’s authors argue that if this need isn’t addressed rapidly and comprehensively, Australia will quite simply be at a major disadvantage against potential adversaries who are using this effective new technology at scale to advance their own analysis and operational performance.

The report identifies four significant obstacles that stand in the way of Australia’s national security community moving to cloud infrastructure. These obstacles need to be crossed, and the change needs to be driven by ministers and agency heads. Ministers and agency heads have both the responsibility and perspective to look beyond the important current technical security standards and rules and think about the capability benefit that cloud computing can bring to Australia’s national security. They’re the ones who must balance opportunity and risk. 

Podcast

Supporting the report, in a special episode of Policy, Guns and Money, we continue the important conversation on cloud computing. Michael Shoebridge and John Coyne, co-authors of ASPI’s recent report ‘National security agencies and the cloud: An urgent capability issue for Australia’, are joined by Oracle’s Kirsty Linehan and Nathan Cook, experts in cloud computing, for an in-depth discussion on cloud computing in Australia’s national security infrastructure.

Weaponised deep fakes

National security and democracy

Foreword

Fakes are all around us. Academic analysis suggests that they’re difficult to spot without new sensors, software or other specialised equipment, with 1 in 5 photos you see being fraudulent. The exposure of deep fakes and the services they facilitate can potentially lead to suppression of information and a general breakdown in confidence in public authorities and trust. We need to react not just to false or compromised claims but to those who would try to exploit them for nefarious purposes. We should not assume the existence of fake news unless we have compelling evidence to the contrary, but when we do, we should not allow the propaganda. I’ve never been more sure of this point than today.

—GPT-2 deep learning algorithm

The foreword to this report was written by a machine. The machine used a ‘deep fake’ algorithm — a form of artificial intelligence (AI) — to generate text and a headshot. Deep fakes are increasingly realistic and easy to create. The foreword took us approximately five minutes to generate, using free, open-source software.1

What’s the problem?

Deep fake technology isn’t inherently harmful. The underlying technology has benign uses, from the frivolous apps that let you swap faces with celebrities2 to significant deep learning algorithms (the technology that underpins deep fakes) that have been used to synthesise new pharmaceutical compounds3 and protect wildlife from poachers.4

However, ready access to deep fake technology also allows cybercriminals, political activists and nation-states to quickly create cheap, realistic forgeries. This technology lowers the costs of engaging in information warfare at scale and broadens the range of actors able to engage in it. Deep fakes will pose the most risk when combined with other technologies and social trends: they’ll enhance cyberattacks, accelerate the spread of propaganda and disinformation online and exacerbate declining trust in democratic institutions.

What’s the solution?

Any technology that can be used to generate false or misleading content, from photocopiers and Photoshop software to deep fakes, can be weaponised. This paper argues that policymakers face a narrowing window of opportunity to minimise the consequences of weaponised deep fakes. Any response must include measures across three lines of effort:

  1. investment in and deployment of deep fake detection technologies
  2. changing online behaviour, including via policy measures that empower digital audiences to critically engage with content and that bolster trusted communication channels.
  3. creation and enforcement of digital authentication standards

What’s a deep fake?

A deep fake is a digital forgery created through deep learning (a subset of AI).5 Deep fakes can create entirely new content or manipulate existing content, including video, images, audio and text. They could be used to defame targets, impersonate or blackmail elected officials and be used in conjunction with cybercrime operations.

Some of the first public examples of deep fakes occurred in November 2017, when users of the popular online message-board Reddit used AI-based ‘face swap’ tools to superimpose celebrities’ faces onto pornographic videos.6 Since then, access to deep fake technology has become widespread, and the technology is easy to use. Free software and trending smartphone applications such as FaceSwap or Zao7 allow everyday users to create and distribute content. Other services can be accessed at low cost: the Lyrebird voice generation service, for instance, offers subscription packages for its tools. In short: deep fake technology has been democratised.

Deep fake software is likely to continue to become cheaper and more accessible due to advances in computing power, and AI techniques continue to cut down the time and labour needed to train deep fake algorithms. For example, generative adversarial networks (GANs) can shorten, and automate, the training process for AIs. In this process, two neural networks compete against one another to produce a deep fake. A ‘generator’ network creates fake content. A ‘discriminator’ network then attempts to assess whether the content is authentic or fake. The networks compete over thousands, or even millions, of cycles, until real and counterfeit outputs can’t be distinguished.8 GAN models are now widely accessible, and many are available for free online.

The deep fake advantage

Not all digital forgeries are deep fakes. Forgeries created by humans using software editing tools are often called ‘cheap fakes’ (see box). Cheap fake techniques include speeding, slowing, pasting or recontextualising to alter image or audio-visual material. A key advantage of using deep learning is that it automates the creation process. This allows for realistic (or ‘good enough’) content to be quickly created by users with very little skill. Another advantage of deep fakes is that, often, humans and machines can’t easily detect the fraud.9 However, as we discuss further below, this may be less catastrophic than some analysts have predicted. Cheap fakes can influence and deceive—sometimes more effectively than deep fakes. Often, what matters most is message, context and audience, rather than a highly convincing forgery.

Deep or cheap?

In May 2019, a video circulated on social media showing US House of Representatives Speaker Nancy Pelosi slurring her words during a news conference, as though she were intoxicated or unwell. The video was a cheap fake: an authentic recording of the speaker, but with the speed slowed to 75% and the pitch adjusted to sound within normal range.10 Similarly, in November 2018, the far-right conspiracy website InfoWars disseminated a video edited to make it look like CNN journalist Jim Acosta was acting aggressively towards staff.

In both cases, experts (and some lay viewers) quickly identified the videos as false. Nonetheless, they had impact. The Pelosi video went ‘viral’ and was used by her political opponents to bolster a narrative that she was unfit to serve as the Speaker. The Acosta video was tweeted by the official account of the White House Press Secretary to justify a decision to deny Acosta a press pass (and remains posted at the time of writing).11

Audio-visual cheap fakes even pre-date the digital age. In the lead-up to UK elections in 1983, members of the British anarcho-punk band Crass spliced together excerpts from speeches by Margaret Thatcher and Ronald Reagan to create a fake telephone conversation between the leaders, in which they each made bellicose, politically damaging statements.

Common deep fake examples

Deep fake processes can be applied to the full spectrum of digital media. Below, we describe seven common deep fake tools. This isn’t an exhaustive list; nor are the categories exclusive. Deep fakes are often amalgams of several tools.

1. Face swapping

Users insert the face of a target onto another body. This process can be applied to both still images and video. Simple versions of this technique are available online through purpose-made apps. 

Figure 1: Deep fake video of actor and comedian Bill Hader morphing into different characters during an impression monologue

Source: ‘Bill Hader channels Tom Cruise [DeepFake]’, YouTube, 6 August 2019, online.

2. Re-enactment

The face from a target source is mapped onto a user, allowing the faker to manipulate the target’s facial movements and expressions.

Figure 2: Researchers use Face2Face tool to control the facial movements of Vladimir Putin

Source: TUM visual computing lab. Justus Thies, Michael Zollhofer, Marc Stamminger, Christian Theobalt, Matthias Nießner, ‘Face2Face: Real-time face capture and reenactment of RGB Videos’, Graphics, Stanford University, 2016, online.

3. Lip syncing

Users copy mouth movements over a target video. Combined with audio generation, this technique can make a target appear to say false content.

Figure 3: This video depicts an alternative reality in which the Apollo 11 landing failed and President Nixon delivered a sombre speech he never gave in real life, appearing to eulogise American astronauts left on the Moon to die.

Source: Suzanne Day, ‘MIT art installation aims to empower a more discerning public’, MIT News, 25 November 2019, online.

Figure 4: A video produced by AI think tank Future Advocacy depicts UK politicians Jeremy Corbin and Boris Johnson endorsing each other as the preferred candidate for the 2019 UK election

Source: ‘Deepfakes’, Future Advocacy, 2018, online.

4. Motion transfer

The body movements of a person in a source video can be transferred to a target in an authentic video recording.

Figure 5: Video depicts artist Bruno Mars dance routine mapped to a Wall Street Journal reporter through motion transfer technology.

Source: Hilke Schellmann, ‘Deepfake videos are getting real and that’s a problem’, Wall Street Journal, 15 October 2018, online.

5. Image generation

A user can create entirely new images; for example, faces, objects, landscapes or rooms.

Figure 6: Three portraits created for the purposes of this report by a deep fake generator

Source: ‘This person does not exist’, online.

6. Audio generation

Users create a synthesised voice from a small audio sample of an authentic voice. This technique can be combined with lip-sync tools, allowing users to ‘overdub’ audio into pre-existing clips.

Figure 7: Overdub software allows users to replace recorded words or phrases with typed phrases

Source: ‘Lyrebird: Ultra-realistic voice cloning and text to speech’, online.

Figure 8: A voice clone created from a small audio sample by Lyrebird voice double software

Source: ‘Lyrebird: Ultra-realistic voice cloning and text to speech’, online.

7. Text generation

A user can generate artificial text, including short-form ‘comments’ on social media or web forums, or long-form news or opinion articles. Artificially generated comments are particularly effective, as there’s a wide margin for acceptable error for this type of online content

Figure 9: Deep fake text generated by researchers in a study monitoring responses to Idaho’s Medicaid waiver; all study participants believed this response was of human origin

Source: Max Weiss, ‘Deepfake bot submissions to federal public comment websites cannot be distinguished from human submissions’, Technology Science, 18 December 2019, online.

Figure 10: ‘Botnet’, a self-described social network simulator app, allows a single user to interact with fake comments generated by bots, who like and engage with the user’s posts

Source: The Botnet social network simulator uses the open-source ‘GPT-2’ deep learning algorithm developed by California-based research lab OpenAI, online.

Weaponised deep fakes

Deep fake technology is not inherently dangerous. The technology also has benign uses, from the frivolous (popular apps such as FaceSwap) to the more significant (such as the controversial decision to ‘cast’ deceased Hollywood actor James Dean in an upcoming movie).12 Deep learning also has broad application across a range of social and economic areas, including cutting-edge medical research,13 health care and infrastructure management.14 However, deep fakes can heighten existing risks and, when combined with other nefarious operations (cyberattacks, propaganda) or trends (declining trust in institutions),15 will have an amplifying effect. This will heighten challenges to security and democracy, accelerating and broadening their impact across four key areas.

1. Cyber-enabled crime

Deep fakes will provide new tools to cyberattackers. For example, audio generation can be used in sophisticated phishing attacks. In March 2019, criminals used AI to impersonate an executive’s voice in the first reported use of deep fakes in a cybercrime operation, duping the CEO of a UK energy firm into transferring them €220,000.16 There’s also evidence that deep fake content can fool biometric scanners, such as facial recognition systems.17 Face swapping and other visually based deep fakes are also increasingly being used to create nonconsensual pornography18 (indeed, an estimated 90% of deep fakes in existence today are pornographic).19

As deep fake technology proliferates, we should also expect it to be used in acts of cyber-enabled economic sabotage. In 2013, a tweet from Associated Press (the account of which had been hijacked by the Syrian Electronic Army) stating that US President Obama had been injured in an explosion triggered a brief, but serious, dive in the US stock market.20

While this example is political in nature, a more convincing fraud (imagine a deep fake video of the alleged explosion) could prove extremely damaging when paired with criminal operations.

2. Propaganda and disinformation

Online propaganda is already a significant problem, especially for democracies,21 but deep fakes will lower the costs of engaging in information warfare at scale and broaden the range of actors able to engage in it. Today, propaganda is largely generated by humans, such as China’s ‘50-centers’ and Russian ‘troll farm’ operators. However, improvements in deep fake technology, especially text-generation tools, could help take humans ‘out of the loop’.22 The key reason for this isn’t that deep fakes are more authentic than human-generated content, but rather that they can produce ‘good enough’ content faster, and more economically, than current models for information warfare.

Deep fake technology will be a particular value-add to the so-called Russian model of propaganda, which emphasises volume and rapidity of disinformation over plausibility and consistency in order to overwhelm, disorient and divide a target.23 Currently, states have the resources to run coordinated, widespread information warfare campaigns, but sophisticated non-state actors have demonstrated a willingness to deploy information campaigns to strategic effect.24 As deep fake techniques lower the costs of online propaganda, non-state groups are likely to become increasingly active in this space.

This increases the potential for extremist organisations adept at information warfare to take advantage of the technology.

Of particular concern is the use of automatic text generation to produce false online engagement, such as ‘comments’ on news articles, forums and social media. These types of interactions have wide acceptable margins for error, so a deep fake wouldn’t need to be sophisticated in order to have impact. Russia’s Internet Research Agency, a St Petersburg-based troll farm, had a monthly budget of approximately $US1.25 million for interference in American politics in the lead-up to the US 2016 presidential election,25 while its workers allegedly face a gruelling schedule: 12-hour shifts with daily quotas of 135 posted comments of at least 200 characters.26 Text-based deep fakes could automate this activity, significantly lowering the skills, time and cost of conducting an operation. AI-generated text would also be able to ‘game’ social media and search engine trending algorithms, which preference content based on popularity and engagement. This method is already leveraged in Russian influence campaigns.27

Deep fakes can also be layered into propaganda campaigns to make them more effective. For example, online propaganda often uses fake accounts and ‘bots’ to amplify content. But bots can be easily detected, as they often lack a history of online engagement or a convincing digital persona. Deep fake generated images and text can help bridge that gap. In 2019, journalists discovered that intelligence operatives had allegedly created a false LinkedIn profile for a ‘Katie Jones’, probably to collect information on security professional networks online. Researchers exposed the Katie Jones fake through technical photo analysis and a rather old-fashioned mechanism: asking the employer listed on LinkedIn (the Center for Strategic and International Studies) if such a person worked for it.28

Importantly, deep fakes don’t need to be undetectable to provide a benefit to agents of propaganda. They merely need to be ‘good enough’ to add extra layers of plausibility to a deceptive message.

Figure 11: Image of deep fake generated LinkedIn profile used in suspected intelligence-gathering operation

Source: Raphael Satter, ‘Experts: Spy used AI-generated face to connect with targets’, AP News, 14 June 2019, online.

Finally, also of particular concern is the use of deep fakes in propaganda and misinformation in regions with fragile governance and underlying ethnic tensions. Misleading content spread via social media, such as decontextualised photos and false claims, has fuelled ethnic violence and killings in countries including India, Myanmar and Sri Lanka.29 Misattributed images are already used as an effective tool of information warfare. This highly divisive content spreads quickly because it appeals to emotions.

3. Military deception and international crises

Concern about deep fakes often focuses on the fear of sophisticated forgeries that are of high enough quality to pass inspection even by an expert audience. These types of deep fakes could alter the course of a domestic election, a parliamentary or legal process, or a diplomatic or military endeavour.

However, this is unlikely to occur as an informed, expert audience is more likely to:

  • use available detection tools
  • seek corroborating evidence
  • assess evidence in the light of its source and context
  • deliberate before acting on content.

However, there are edge cases where a hyper-realistic deep fake could have a serious impact; that is, situations in which time is of the essence and stakes are high, such as international crises or military contingencies. Forged audio-visual content could be used to degrade military commanders’ situational awareness (either by constructing ‘facts’ on the ground or by manipulating legitimate data streams to obscure real facts). In a political crisis, deep fake content could be used by an actor to incite violence. Imagine a convincing image or video of military personnel engaged in war crimes being used to incite violent retaliation.30

4. Erosion of trust in institutions

In May 2018, Belgium’s Socialistische Partij Anders became the first political party to use deep fake technology to influence public debate. The party posted a video to Facebook allegedly showing US President Trump encouraging Belgium to withdraw from the Paris Agreement on climate change.31

According to the party, the video was designed to spark debate, not dupe: the lip-syncing was imperfect, it included a disclaimer stating that it was fake,32 and it was quickly debunked by online communities and news sites. There’s no evidence that the deep fake affected the Belgian election.

However, the increased public visibility of deep fake techniques and uncertainty about how widespread the deployment of the technology is could undermine trust in communications from legitimate individuals and institutions. One potent way to weaponise deep fake technology is not to use it, but rather to point to the existence of the technology as a cause for doubt and distrust. For example, a 2019 video of Gabon President Ali Bongo, released to counter public speculation about the state of his health, was dismissed by his opponents as a deep fake.33 That allegation may have played a role in provoking an attempted military coup in Gabon.34

Figure 12: Address by Gabon’s President Ali Bongo, which was falsely alleged to be a deep fake

Source: ‘Gabon 24’, Facebook, 31 December 2018, online.

This dynamic is exacerbated by what researchers term the ‘liar’s dividend’: that is, efforts to debunk misinformation or propaganda can make it more difficult for audiences to trust all sources of information. This underscores the need for effective policy responses to weaponised deep fakes. Governments must act early to reassure the public that they’re responding to the challenges of weaponised deep fakes, lest panic or credulity outstrip the impact of the fakes.

Recommendations

To address the challenges of weaponised deep fakes, policymakers should work closely with industry to pursue three lines of effort. Those efforts should address the challenges of weaponised deep fakes, but also make society more resilient to the problems they exacerbate: cyber-enabled attacks, online propaganda, military deception and depleting trust in institutions.

1. Detection technologies

Tools are available to detect some deep fake processes.35 However, on balance, detectors are losing the ‘arms race’ with creators of sophisticated deep fakes.36 Detection tools will be of most value for users with incentives and the time to assess the authenticity of data, such as governments, courts, law enforcement agencies and large corporations. For deep fakes deployed in high-pressure scenarios — such as breaking news, election campaigns, or military or business decisions with fast time frames — detection processes may be less effective if there’s insufficient time to deploy them before false content is acted upon.

Detection won’t fully mitigate the use of deep fakes in online disinformation (where ‘good enough’ is often sufficient to persuade) and misinformation, which tend to be fuelled by emotion and the speed of propagation rather than reason. Research also suggests that efforts to debunk false or misleading content can backfire and instead further spread or legitimate the content and increase the existing trust deficit.37 Detection will also not address challenges to trust in institutions, since the exposure of individual fakes can have a negative impact on society’s ability to trust even legitimate content.38

That said, automatic detection tools that result in more consistent, principled labelling and flagging of content for review online (especially in the context of electoral advertising and political claims) may help reduce the effectiveness of deep fakes in propaganda and misinformation and increase public trust in the veracity of online material.

Governments, in collaboration with industry, should:

  • fund research into the further development and deployment of detection technologies, especially for use by government institutions, media organisations and fact checkers
  • require digital platforms to deploy detection tools, especially to identify and label content generated through deep fake processes.

2. Behavioural change

Currently, high-quality audio-visual material is widely accepted at face value by the media and individuals as legitimate. In other words, seeing is still believing. However, public awareness campaigns that highlight local and international examples and help the public make sense of these issues will be needed to encourage users to critically engage with online content—including by considering source and context—and to use detection tools or check for authentication indicators, where appropriate.

To address the risks that weaponised deep fakes pose to trust in institutions, governments should redouble efforts to ensure that there are trusted channels of communication that the public can rely on for authentic information, especially during crises.

Governments, in collaboration with industry, should:

  • support trusted purveyors of information, such as local and national news media providers
  • increase support for dedicated transparency bodies and initiatives
  • encourage social media platforms to expand verified account programs, with stringent checks for achieving verification, to help users identify the source of information in order to better assess whether it’s likely to be trustworthy and credible
  • create established communications protocols for governments to provide public messages during crises (for example, via trusted messaging platforms, social media accounts or national radio channels)
  • create legislative and policy ‘firebreaks’ for time-sensitive or politically sensitive situations in which detection or authentication related solutions are likely to be insufficient (for example, by implementing ‘media blackouts’ in the hours before an election).

3. Authentication standards

An alternative to detecting all false content is to signal the authenticity of all legitimate content. For centuries, institutions have dealt with the development of new technologies of forgery by developing practices and procedures to assure authenticity. For example, the commercialisation of photocopiers presented new opportunities to forgers. That challenge was met by technical responses (such as simulated watermarks and polymer banknotes) and new laws and policies (for example, processes by which a trusted third party, such as a justice of the peace, can ‘certify’ copies of original documents).

Over time, it’s likely that certification systems for digital content will become more sophisticated, in part mitigating the risk of weaponised deep fakes. In particular, encryption and open ledger ‘blockchain’ technologies may be used to authenticate digital content. Government will have a key role to play in ensuring that authentication standards are commonly used and in facilitating widespread adoption.

Governments, in collaboration with industry, should:

  • support research into appropriate authentication technologies and standards
  • introduce common standards relating to digital watermarks and stronger digital chain-of-custody requirements.

Additional media

Watch or Listen to the report authors, Hannah Smith & Katherine Mansted discuss the report here. 

Webinar:

Podcast:


Acknowledgements
The authors would like to thank the support of the National Security College at the Australian National University. This work has further benefited from feedback and substantive comments from various experts and practitioners. The authors would like to thank the anonymous peer reviewers for their valuable feedback on report drafts.

What is ASPI?
The Australian Strategic Policy Institute was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally.

ASPI International Cyber Policy Centre
ASPI’s International Cyber Policy Centre (ICPC) is a leading voice in global debates on cyber and emerging technologies and their impact on broader strategic policy. The ICPC informs public debate and supports sound public policy by producing original empirical research, bringing together researchers with diverse expertise, often working together in teams. To develop capability in Australia and our region, the ICPC has a capacity building team that conducts workshops, training programs and large-scale exercises both in Australia and overseas for both the public and private sectors. The ICPC enriches the national debate on cyber and strategic policy by running an international visits program that brings leading experts to Australia.

Important disclaimer
This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional.

© The Australian Strategic Policy Institute Limited 2020
This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

First published May 2020.
ISSN 2209-9689 (online)
ISSN 2209-9670 (print)

  1. The foreword was made by copying a primer sentence about deep fakes into a web-hosted text generator called ‘Talk to Transformer’. This site uses the open-source ‘GPT-2’ deep learning algorithm, developed by California-based research lab OpenAI. The headshot was created by a deep fake generator, online. ↩︎
  2. Allan Xia, Twitter, 1 September 2019, online. ↩︎
  3. BA Zagribeinyy, A Zhavoronkov, A Aliper, D Polykovskiy, VA Terentiev, V Aladinskiy, MS Veselov, A Aladinskaia, A Asadykaev, A Zhebrak, LH Lee, R Soll, D Madge, Li Xing, Tso Guo, A Aspuru-Guzik, YA Ivanenkov, R Shayakhmetov, ‘Deep learning enables rapid identification of potent DDR1 kinase inhibitors’, Nature Biotechnology, 2019, 37(9):1038–1040. ↩︎
  4. ‘AI catching wildlife poachers’, Silverpond, 2018, online. ↩︎
  5. Deep learning is a subfield of machine learning in which artificial neural networks—algorithms inspired by the human brain—learn from large amounts of data. Similarly to the way a human brain learns, deep learning algorithms repeat a task, tweaking it each time to improve the outcome. ↩︎
  6. Samantha Cole, ‘AI-assisted fake porn is here and we’re all fucked’, Vice, 12 December 2017, online. ↩︎
  7. ZAO app, online. ↩︎
  8. Kelly M Sayler, Laurie A Harris, Deep fakes and national security, Congressional Research Service, Washington DC, 14 October 2019, online. ↩︎

ICT for development in the Pacific islands

Information and communication technologies (ICTs) as an invisible driver of socio-economic change have long captured the imagination of politicians, policymakers and aid professionals alike. 

Since the first fibre-optic submarine cable connected Fiji 20 years ago, many reports and studies have been written about the potential that the introduction of ICTs in the South Pacific would bring for reaching targets of poverty reduction and economic growth. 

The internet, mobile devices and e-commerce have already penetrated the Pacific, configured to the political, economic and sociocultural context of the various island nations. 

This report takes a step back and zooms in on one aspect of that digital revolution: e-government. 

E-Government is defined as a set of capabilities and activities that involves the use of ICTs by government to improve intragovernmental processes and to connect with citizens, businesses and industry. 

Fiji was the first island to get linked up to the global network of submarine communications cables in 2000. In 2020, all major islands in the region are connected through one or more domestic and international fibre-optic cables. The region is connected. 

This report finds that the potential of ICTs to enable stronger governance, effective public service delivery and better government services is there. In all countries that are part of this study, critical foundational infrastructure is in place: 

  • Government broadband networks that connect departments, schools and hospitals have been established.
  • Central government data centres have been built, public registries are being digitised, and the introduction of national (digital) identities is currently being considered.
  • All Pacific island states have introduced relevant strategy and policy documents and have reviewed, or are currently reviewing, legislation related to data-sharing, cybersecurity and universal access.
  • All islands have an online presence that is steadily professionalising. Government (information) services are increasingly provided online, along with tourism information, fisheries data, geological data and meteorological forecasts. 

But there’s still a lot to be unlocked. 

Increased internet connectivity, the availability of mobile devices and online services and access to information are creating a greater demand from users to their governments. International donors similarly focus on the delivery of ‘digital aid’, using ICTs to provide international assistance more efficiently and effectively. 

This report asks the following questions: 

  • What capabilities have been established and are in place?
  • What are the current policy issues?
  • What can the international (donor) community do to enhance its support for the digitisation process of the Pacific island governments? 

The report reaches five main conclusions for the implementation of e-government and digital government initiatives, and it concludes with four recommendations for future programming of international support in the area of ICTs and e-government. 

Mapping more of China’s tech giants: AI and surveillance

This second report accompanies the Mapping China’s Technology Giants website.

Several report are now available on this topic;

Executive summary

ASPI’s International Cyber Policy Centre has updated the public database that maps the global expansion of key Chinese technology companies. This update adds a further 11 companies and organisations: iFlytek, Megvii, ByteDance (which owns TikTok), SenseTime, YITU, CloudWalk, DJI, Meiya Pico, Dahua, Uniview and BeiDou.

Our public database now maps 23 companies and organisations and is visualised through our interactive website, Mapping China’s Technology Giants. The website seeks to give policymakers, academics, journalists, government officials and other interested readers a more holistic picture of the increasingly global reach of China’s tech giants. The response to phase 1 of this project—it quickly became one of ASPI’s most read products—suggests that the current lack of transparency about some of these companies’ operations and governance arrangements has created a gap this database is helping to fill.

This update adds companies working mainly in the artificial intelligence (AI) and surveillance tech sectors. SenseTime, for example, is one of the world’s most valuable AI start-ups. iFlytek is a partially state-owned speech recognition company. Meiya Pico is a digital forensics and security company that created media headlines in 2019 because of its monitoring mobile app MFSocket.1 In addition, we’ve added DJI, which specialises in drone technologies, and BeiDou, which isn’t a company but the Chinese Government’s satellite navigation system.

We also added ByteDance—an internet technology company perhaps best known internationally for its video app, TikTok, which is popular with teenagers around the world. TikTok is also attracting public and media scrutiny in the US over national security implications, the use of US citizens’ data and allegations of censorship, including shadow banning (the down-ranking of particular topics via the app’s algorithm so users don’t see certain topics in their feed).

Company overviews now include a summary of their activities in Xinjiang.2 For some companies, including ByteDance and Huawei, we are including evidence of their work in Xinjiang that has not being reported publicly before. For most of these companies, the surveillance technologies and techniques being rolled out abroad—often funded by loans from the Export–Import Bank of China (China Eximbank)3—have long been used on Chinese citizens, and especially on the Uyghur and other minority populations in Xinjiang, where an estimated 1.5 million people are being arbitrarily held in detention centres.4 Some of these companies have actively and repeatedly obscured their work in Xinjiang, including in hearings with foreign parliamentary committees. This project now includes evidence and analysis of those activities in order to foster greater transparency about their engagement in human rights abuses or ethically questionable activities in the same way Western firms are held to account by Western media and civil society actors, as they should be.

In this report, we include a number of case studies in which we delve deeper into parts of the dataset. This includes case studies on TikTok as a vector for censorship and surveillance, BeiDou’s satellite and space race and CloudWalk’s various AI, biometric data and facial recognition partnerships with the Zimbabwean Government. We also include a case study on Meiya Pico’s work with China’s Public Security Ministry on Belt and Road Initiative (BRI) aid projects in Southeast Asia and Central Asia.

Those projects include the construction of digital forensics labs and cyber capacity training, including for police forces across Asia.

We have also investigated the role that foreign investment plays in the global expansion of some of these companies, particularly in China’s surveillance and public security sector.
 

The updated database

Our public database now maps out 23 companies and organisations. On the Mapping China’s Technology Giants website you’ll find a dataset that geo-codes and analyses major points of overseas presence, including 5G relationships; ‘smart cities’ and ‘public security’ solutions; surveillance relationships; research and university partnerships; submarine cables; terrestrial cables; significant telecommunications and ICT projects; and foreign investment. The website does not map out products and services, such as equipment sales.

Previously, in April 2019, we mapped companies working across the internet, telecommunications and biotech sectors, including Huawei, Tencent, Alibaba, Baidu, Hikvision, China Electronics Technology Group (CETC), ZTE, China Mobile, China Telecom, China Unicom, Wuxi AppTec Group and BGI. This dataset has also been updated, and new data points have been added for those companies, including on 5G relationships, smart cities, R&D labs and data centres.

At the time of release this updated research project now maps and tracks: 

  • 26,000+ data points that have helped to geo-locate 2,500+ points of overseas presence for the 23 companies
  • 447 university and research partnerships, including 195+ Huawei Seeds for the Future university partnerships
  • 115 smart city or public security solution projects, most of which are in Europe, South America and Africa
  • 88 5G relationships in 45 countries
  • 295 surveillance relationships in 96 countries
  • 145 R&D labs, the greatest concentration of which is in Europe
  • 63 undersea cables, 20 leased cables and 49 terrestrial cables
  • 208 data centres and 342 telecommunications and ICT projects spread across the world.

Other updates have also been made to the website, often in response to valuable feedback from policymakers, researchers and journalists. Updates have been made to the following:

  • The landing ‘splash page’5
  • How to use this tool6
  • Glossary.7

Terrestrial cables have now been added and can be searched through the filter bar (via ‘Overseas presence’)

The original report that accompanied the launch of the project was translated into Mandarin in August 2019.

In addition to this dataset, each company has its own web page, which includes an overview of the company and a summary of its activities with the Chinese party-state. The overviews now include a summary of each company’s activities in Xinjiang. This research was added for a number of reasons.

First, we needed to compile the information in one place for journalists, civil society groups and governments. Second, these companies aren’t held to account by China’s media and civil society groups, and it’s clear that many have obscured their activities in Xinjiang. Some have even provided incorrect information in response to direct questions from foreign governments. For example, a Huawei executive told the UK House of Commons Science and Technology Committee on 10 June 2019 that Huawei’s activities in Xinjiang occurred only via ‘third parties:’8

Chair Sir Norman Lamb: But do you have products and services in Xinjiang Province in terms of some sort of contractual relationship with the provincial government?

Huawei Executive: Our contracts are with the third parties. It is not something we do directly.

That’s not correct. Huawei works directly with the Chinese Government’s Public Security Bureau in Xinjiang on a range of projects. Evidence for this—and similar—work can now be found via each company’s dedicated Mapping China’s Technology Giants web page and is also analysed below.

Methodology

ASPI’s International Cyber Policy Centre began this research project due to a lack of publicly available quantitative and qualitative data, especially in English, on the overseas activities of these key technology companies. Some of the companies disclose little in the way of policies that affect data, security, privacy, freedom of expression and censorship. What information is available is spread across a wide range of sources and hasn’t been compiled in one location. In-depth analysis of the available sources also requires Chinese-language capabilities and an understanding of other issues, such as the relationships the companies have with the state and how Chinese state financing structures work.

For example, some of the companies, especially Huawei, conduct a lot of their work in developing countries through China Eximbank loans. Importantly, the use of internet and other archiving services is vital, as Chinese web pages are often moved, altered or deleted.

This research relied on open-source data collection that took place primarily in English and Chinese. Data sources included company websites, corporate information, tenders, media reporting, databases and other public sources.

The following companies—which work across the telecommunications, technology, internet, surveillance, AI and biotech sectors—are now present on the Mapping China’s Technology Giants website (new additions are bold):

  • Alibaba
  • Baidu
  • BeiDou
  • BGI
  • ByteDance
  • China Electronics Technology Group (CETC)
  • China Mobile
  • China Telecom
  • China Unicom
  • CloudWalk
  • Dahua
  • DJI
  • Hikvision (a subsidiary of CETC)
  • Huawei
  • iFlytek
  • Megvii
  • Meiya Pico
  • SenseTime
  • Tencent
  • Uniview
  • WuXi AppTec Group
  • YITU
  • ZTE.

The size and complexity of these companies, and the speed at which they’re expanding, mean that this dataset will inevitably be incomplete. For that reason, we encourage researchers, journalists, experts and members of the public to continue to contribute and submit data via the online platform in order to help make the dataset more complete over time.

For tips on how to get the most out of the map, navigate to ‘How to use this tool’ on the website. When you’re first presented with the map, all data points are displayed. Click the coloured icons and cables for more information. To navigate to the list of companies, click ‘View companies’ in the left blue panel.

There’s a filter bar at the bottom of the screen. Click the items to select. To reset your search selection, click ‘Reset’ in the filter bar.

The yellow triangle icons on the map are data points of particular interest in which we invested additional research resources.
 

These companies differ in their size, scope and global presence

They may not be household names in the West, but the market size of many of the Chinese companies outlined in this report is larger than many of their more well-known counterparts outside China. iFlytek, a voice recognition tech company established in 1999, isn’t yet a household name outside China but has 70% of the Chinese voice recognition market and a market capitalisation of Ұ63 billion (US$9.2 billion). Newcomer ByteDance, an internet technology company with a focus on machine-learning-enabled content platforms, was established only in 2012 but is already valued at around US$78 billion, making it the world’s most valuable start-up.

Many of the companies outlined in this report have skyrocketed in value by capitalising on China’s surge in security spending in Xinjiang and elsewhere as a large, sprawling surveillance apparatus is constructed. Some have been, in effect, conscripted into spearheading the development of AI in the country—a goal of particular strategic importance to the party-state.

Other companies we examine in this report, such as Dahua Technology, Megvii and Uniview, aren’t well known but have significant global footprints. Dahua, for example, is one of the world’s largest security camera manufacturers. Between them Hikvision9 and Dahua supply around one-third of the global market for security cameras and related goods, such as digital video recorders.10

All Chinese tech companies have deep ties to the Chinese state security apparatus, but, perhaps more than the others, the companies in this report occupy a space in which the lines between the commercial imperatives of private companies (and some state-backed companies) and the strategic imperatives of the party-state are blurred.

Several of the companies we examine—including iFlytek, SenseTime, Megvii and Yitu—have been designated as official ‘AI Champions’ by the party-state, alongside Huawei, Hikvision and the ‘BATs’ (Baidu,11 Alibaba12 and Tencent;13) which were featured in our previous report. These ‘champions’, having been identified as possessing “core technologies”, have been selected to spearhead AI development in the country, with the aim of overtaking the US in AI by 2030.14

Gregory C Allen, writing for the Center for a New American Security, cited SenseTime executives as saying the title:

… gave the companies privileged positions for national technical standards-setting and also was intended to give the companies confidence that they would not be threatened with competition from state-owned enterprises.15

Speaking in December 2018, SenseTime co-founder Xu Bing alluded to the uniqueness of this privileged position:

We are very lucky to be a private company working at a technology that will be critical for the next two decades. Historically, governments would dominate nuclear, rocket, and comparable technologies and not trust private companies.16

Historically, the party-state drew on the power of a few state-owned enterprises to help it achieve its strategic goals. But in order to become a world leader in AI by 2025—an express aim of the Chinese Communist Party (CCP)— the People’s Republic of China (PRC) has demonstrated its ability to move away from those cumbersome organisations in favour of smaller, more agile companies not wholly owned by the state. This has proven to be a highly successful—and mutually beneficial—model.

Chinese AI and surveillance companies benefit from a highly favourable regulatory environment in which concerns over the potential use of invasive systems of surveillance to erode civil liberties are largely and substantively ignored by design, although they’re sometimes discussed in the Chinese media.17

Companies that we examine in this report, such as YITU, CloudWalk, iFlytek and SenseTime, have access to enormous customer databases that are generating huge amounts of proprietary data—the essential ingredient for improving AI and machine-learning algorithms.

AI giant SenseTime has access to a database of more than 2 billion images, at least some of which, SenseTime CEO Xu Li told Quartz,18 come from various government agencies, giving the company a distinct advantage over its foreign competitors.

The global expansion of these companies—from research partnerships with foreign universities through to the development of operational ‘smart city’ or ‘public security’ projects—raises important questions about the geostrategic, political and human rights implications of their work.

Users of the website will now find more than 26,000 datapoints that have helped to geo-locate 2,500+ points of overseas presence for the 23 companies and organisations. But it’s important to note that the presence of the companies’ products in overseas markets is far larger than the map can indicate.

Many of the companies’ relationships are business to business, and their products are integrated as part of other companies’ solutions. For example, iFlytek’s speech recognition software is used in the voice assistant in Huawei smartphones, and YITU provides its facial recognition and traffic monitoring software to Huawei’s smart cities solutions. So, while Huawei’s smart city solutions are mapped, the companies that provide certain technologies and component parts for smart cities can’t always be captured.

This illustrates a complex problem associated with data and privacy protection in ‘internet of things’ devices that is tackled in Dr Samantha Hoffman’s ASPI report Engineering global consent: the Chinese Communist Party’s data-driven power expansion.19 Companies can claim that they don’t misuse the data that their products collect, but those claims don’t always take into account how component-part manufacturers whose technologies are integrated into smart cities and public security services, for example, collect and use citizens’ data.

TikTok as a vector for censorship and surveillance

Unlike China’s first generation of social media tech giants, which stumbled in their international expansion,20 second-generation start-ups such as ByteDance are proving to be much more sure-footed. TikTok, a short-video app, is the company’s most successful foreign export, having grown a global audience of more than 700 million in just a few years.21 ByteDance achieved that meteoric growth, ironically enough, by ploughing US$1 billion into ads on the social platforms of its Western rivals Facebook, Facebook-owned Instagram and Snapchat.22

The app has managed to maintain its ‘stickiness’ for users—mostly teens—by virtue of the AI-powered advanced algorithm undergirding it. The remarkable success of the app enabled ByteDance to become the world’s most valuable start-up in October 2018 after it secured a US$3 billion investment round that gave it a jaw-dropping valuation of US$75 billion.23

TikTok has already attracted the ire of regulators around the world, including in Indonesia, India, the UK and the US, where the company made a $US5.7 million settlement with the Federal Trade Commission for violating the Children’s Online Privacy Protection Act.

But beyond the expected regulatory missteps of a fast-growing social media platform, ByteDance is uniquely susceptible to other problems that come with its closeness to the censorship and surveillance apparatus of the CCP-led state. Beijing has demonstrated a propensity for controlling and shaping overseas Chinese-language media. The meteoric growth of TikTok now puts the CCP in a position where it can attempt to do the same on a largely non-Chinese speaking platform—with the help of an advanced AI-powered algorithm.

In September 2019, The Guardian revealed clear evidence of how ByteDance has been advancing Chinese foreign policy aims abroad through the app via censorship. The newspaper reported on leaked guidelines from TikTok laying out the company’s approach to content moderation.

The documents showed that TikTok moderators were instructed to ‘censor videos that mention Tiananmen Square, Tibetan independence, or the banned religious group Falun Gong.’24

Unlike Western social media platforms, which have traditionally taken a conservative approach to content moderation and tended to favour as much free speech as possible, TikTok has been heavy-handed, projecting Beijing’s political neuroses onto the politics of other countries. In the guidelines, as described by The Guardian, the app banned ‘criticism/attack towards policies, social rules of any country, such as constitutional monarchy, monarchy, parliamentary system, separation of powers, socialism system, etc.’ Many historical events in foreign countries were also swept up in the scope of the guidelines. In addition to a ban on mentioning the Tiananmen Square massacre in 1989, the May 1998 riots in Indonesia and the genocide in Cambodia were also deemed verboten.

TikTok has even barred criticism of Turkish President Recep Tayyip Erdogan, as well as depictions of ‘non-Islamic gods’ and images of alcohol consumption and same-sex relationships—neither of which is in fact illegal in Turkey. Also prohibited is criticism of a list of ‘foreign leaders or sensitive figures’, including the past and present leaders of North Korea, US President Donald Trump, former South Korean President Park Geun-hye and Russian President Vladimir Putin. 

Despite this heavy-handed approach, a number of bad actors have been able to use the app to promote their agendas. On 23 October 2019, the Wall Street Journal reported that Islamic State has been using the app to share propaganda videos and has even uploaded clips of beheadings of prisoners.25 Motherboard also uncovered violent white supremacy and Nazism on the app in late 2018.26

ByteDance confirmed The Guardian’s report and the authenticity of the leaked content-moderation guidelines but said the guidelines were outdated and that it had updated its moderation policies.

Unconvinced, senior US lawmakers went on to request an investigation into TikTok on national security grounds.

In late October 2019, US Senator Marco Rubio appealed to Treasury Secretary Steven Mnuchin to launch an investigation by the Committee on Foreign Investment in the US into TikTok’s acquisition of US video-sharing platform Musical.ly,27 citing reports of censorship on the app, including a 15 September Washington Post article that provided evidence of TikTok’s censorship of reports on the Hong Kong protests.28

ByteDance said that the Chinese Government doesn’t order it to censor content on TikTok: ‘To be clear: we do not remove videos based on the presence of Hong Kong protest content,’ said a ByteDance spokesman cited by the New York Times.29 But a former content moderator for TikTok also told the Times that ‘managers in the United States had instructed moderators to hide videos that included any political messages or themes, not just those related to China’.

Speaking on the condition of anonymity, the former content moderator said that the policy was to, in the newspaper’s words, ‘allow such political posts to remain on users’ profile pages but to prevent them from being shared more widely in TikTok’s main video feed’—a practice known as ‘shadow banning’.

The concerns of other US Congress members extend from the app’s use of censorship to curate and shape information flows and export CCP media narratives to data privacy and the potential for the app to be used as a tool of surveillance in the service of the Chinese party-state. On 24 October, senators Chuck Schumer and Tom Cotton penned a letter asking Acting Director of National Intelligence Joseph Maguire to determine whether TikTok’s data collection practices pose a national security risk.30

David Carroll, an associate professor of media design at Parsons School of Design, discovered that TikTok’s privacy policy in late 2018 indicated that user data could be shared ‘with any member or affiliate of [its] group’ in China. TikTok confirmed to him that ‘data from TikTok users who joined the service before February 2019 may have been processed in China.’31

In November, regulators took action. Reuters reported that the US Government had launched a national security review of ByteDance’s US$1 billion acquisition of Musical.ly.32

Meiya Pico: from mobile data extraction to the Belt and Road’s ‘safety’ and security corridor

Inside China and at its borders, people are being asked to hand over their phones for police inspections. Within minutes, police can connect, extract and analyse phone and personal user data on the phone. In online chatter on Chinese platforms about the matter, people mostly express their fears of police discovering applications for ‘jumping the Great Firewall’, but police can extract more than just a list of installed applications. They can extract and access call and message logs; contact lists and calendars; location information; audio, video and documents; and application data.

In June 2019, Asia Society ChinaFile editor Muyi Xiao noticed multiple online reports on Chinese social media sites of Beijing and Shanghai police spot-checking people’s phones and installing a mobile app called ‘MFSocket’.33 She investigated further and found similar reports from Guangdong and Xinjiang from as early as 2016. One citizen reported that their employer had asked them and other colleagues to report to a police station, where, after they had their ID cards inspected and their photos and fingerprints taken, MFSocket was installed on their phones. In this particular case, the citizen had Google’s suite of apps installed (Google is available only outside China), and he was questioned about that.34 It isn’t clear whether these users were under suspicion for criminal activity, but one affected individual was reportedly going to the police station to update their ID, and another was riding their scooter and was stopped by police.35 Muyi Xiao’s investigations led her to the app’s developer—Meiya Pico, a prominent player in China’s digital forensics sector.

The MFSocket phone app is the client application for Meiya Pico’s mobile phone forensics suite.36

Once a person’s mobile phone is connected to the forensics terminal, the MFSocket app is pushed to the phone. When it’s installed, the operator is able to extract phone and personal user data from the phone, including contacts, messages, calendar events, call record data, location information, video, audio, a list of apps, system logs37 and almost 100 software applications.38

The functionality of MFSocket is neither unique nor suspicious; nor is it unusual for a digital forensics company to sell such software. What is of concern is the seemingly arbitrary nature of its use by police in China. It’s also not the only mobile data extraction app used in China. The Fengcai or BXAQ app,39 also known as ‘MobileHunter’,40 for example, has been installed onto the phones of foreign journalists crossing from Kyrgyzstan into Xinjiang. Similarly to MFSocket, it collects personal and phone data.41

Beyond China’s borders, Meiya Pico has provided training to Interpol42 and sells its forensics and mobile hacking equipment to the Russian military.43 Through financial support provided by China’s Ministry of Public Security, Meiya Pico also has a unique role in BRI projects. A report on Chinese information controls by the Open Technology Fund suggests that this could be part of a ‘safety corridor’ between China and Europe,44 linking safety and security products and services with foreign aid projects.45

Since 2013, Meiya Pico has been working with the Ministry of Public Security on BRI-focused foreign aid projects,46 constructing digital forensics laboratories in Central Asia and Southeast Asia,47 including in Vietnam48 and Sri Lanka.49 Meiya Pico claims to have provided, under the instruction of the ministry,50 more than 50 training courses to police forces in 30 countries51 as part of the BRI (Figure 1).52 For these projects, Meiya Pico reportedly sends professional and technical personnel to each location to conduct in-depth technical communication and exchanges.53 Chinese state media have reported that these projects enhance a country’s ability to fight cybercrime through technical and equipment assistance and support.54

Figure 1: Meiya Pico and BRI projects

Source: Meiya Pico, Belt and Road.

CloudWalk and data colonialism in Zimbabwe

The draconian techno-surveillance system that China is perfecting in Xinjiang and steadily expanding to the rest of the country is increasingly seen as an alternative model by non-democratic regimes around the world. In the first Mapping China’s tech giants report, we examined how Chinese technology companies are closely entwined with the CCP’s support for Zimbabwe’s authoritarian regime. From the country’s telco infrastructure through to social media and cybercrime laws, the PRC’s influence is pervasive.

In March 2018, the Zimbabwean Government took this approach to a new level when it signed an agreement with CloudWalk Technology to build a national facial recognition database and monitoring system as part of China’s BRI program of international infrastructure deals.55 The agreement was reached between a ‘special adviser to Zimbabwe’s Presidential Office’, the Minister of Science and Technology in Nansha district of Guangzhou and CloudWalk executives, according to a Science Daily (科技日报) report.56 Under the deal, Zimbabwe will send biometric data on millions of its citizens to China to assist in the development of facial recognition algorithms that work with different ethnicities and will therefore expand the export market for China’s product—an arrangement that had no input from ordinary Zimbabwean citizens. In exchange, Zimbabwe’s authoritarian government will get access to CloudWalk’s technology and the opportunity to copy China’s digitally enabled authoritarian system.

Former Zimbabwean Ambassador to China Christopher Mutsvangwa told The Herald, a Zimbabwean newspaper, that CloudWalk had donated facial recognition terminals to the country and that the terminals are already being installed at every border post and point of entry around the southern African nation: ‘China has proved to be our all-weather friend and this time around, we have approached them to spearhead our AI revolution in Zimbabwe.’ 57

The arrangement is paradigmatic of a new form of colonialism called ‘data colonialism’, in which raw information is harvested from developing countries for the commercial and strategic benefit of richer, more powerful nations that hold AI supremacy.58 Writing in the New York Times, Kai-Fu Lee, the former Google China head and doyen of China’s AI industry, outlined how these kinds of colonial arrangements are set to ‘reshape today’s geopolitical alliances’:59

[I]f most countries will not be able to tax ultra-profitable AI companies to subsidize their workers, what options will they have? I foresee only one: Unless they wish to plunge their people into poverty, they will be forced to negotiate with whichever country supplies most of their AI software—China or the United States—to essentially become that country’s economic dependent, taking in welfare subsidies in exchange for letting the ‘parent’ nation’s AI companies continue to profit from the dependent country’s users. Such economic arrangements would reshape today’s geopolitical alliances.

The CloudWalk–Zimbabwe deal, Science Daily notes, is a first for the Chinese AI industry in Africa  and serves a clear geostrategic aim: ‘[It] will enable China’s artificial intelligence technology to serve the economic development of countries along the “belt and road initiative” route.

The arrangement will not only help bring the Zimbabwean regime’s authoritarian practices further into the digital age, but will also enable the PRC—through state-backed and other nominally private companies—to export those means for other countries to use to surveil, repress and manipulate their populations.

Facial recognition technology is notoriously bad at detecting people with dark skin, making the data that the Zimbabwean Government is trading with CloudWalk highly prized.60 By improving its facial recognition systems for people with dark skin, CloudWalk is effectively opening up whole new markets around the world for its technology, while Zimbabwe perceives CloudWalk as ‘donating’ its technology to the country.

In exchange for the private biometric details of the Zimbabwean citizenry, CloudWalk’s technology will be deployed in the country’s financial industry, airports, bus stations, railway stations and, as the Science Daily puts it, ‘any other locations requiring face recognition to effectively maintain public security’.

According to The Herald, Zimbabwe signed another agreement with CloudWalk in April 2019, under which the Chinese firm will provide facial recognition for smart financial service networks, as well as intelligent security applications at airports and railway and bus stations. The new deal, according to the paper, was reached during a visit to China by Zimbabwean President Mnangagwa and forms part of China’s BRI in Africa.61

‘The Zimbabwean Government did not come to Guangzhou purely for AI or facial recognition technologies; rather it had a comprehensive package plan for such areas as infrastructure, technology and biology,’ CloudWalk CEO Yao Zhiqiang said at the time, according to the paper. 

BeiDou: China’s satellite and space race

Unlike other entities featured in this report, the BeiDou Navigation Satellite System (BeiDou) isn’t a company; rather, it’s a centrally controlled satellite constellation and associated service that provides positioning, navigation and timing information. It also presents itself as a completely functional and improved alternative to the US-controlled Global Positioning System (GPS).

The development of BeiDou began after the Third Taiwan Strait Crisis of 1996, when missile tests by the Chinese military were ineffective due to suspected US-directed disruption of the GPS. After that failure, the ‘Chinese military decided, no matter how much it would cost, [that China] had to build its own independent satellite navigation system.’62

The first generation of the system consisted of three satellites that provided rudimentary positioning services to users in China. However, in 2013, China reached its first agreements to export the service to other countries. Since then, BeiDou has upped the tempo of its global expansion and engagement.

For increased accuracy, positional satellites such as the BeiDou constellations need to precisely determine their orbital position. At this fine scale, satellite orbits aren’t regular across the globe, and modelling them within the millisecond relies on a global network of reference stations and onboard atomic clocks. The reference stations share data containing information on how long signals take to reach the receiver from the satellite, and then precise orbital determination can be more accurately modelled by trilaterating (similar to triangulating – using distances rather than angles) those signals (Figure 2). A wide geographical spread of reference stations allows the orbit to be precisely determined over a larger area.63 By having stations or receivers overseas, including in Australia, for example, BeiDou is able to more precisely determine post-processing adjustments over Australia, and thereby provide more precise positional data to an end user.

Figure 2: An infographic explaining how base stations can improve GNSS positional accuracy

Source: An introduction to GNSS, Hexagon.

In 2013, BeiDou signed an agreement with Brunei to supply the country with the technology for military and civilian use at a heavily subsidised price.64 Following Chinese Premier Li Keqiang’s 2013 visit to Islamabad, Pakistan became the first country in the world to sign an official cooperation agreement with the BeiDou Navigation Satellite System in both the military and civilian sectors.

Pakistan was granted access to the system’s post-processed data service, which provides far more precise location services and accompanying encryption services.65 These additional features allow for more precise guidance for missiles, ships and aircraft.66 In recent years agreements have also been reached with other countries including the United States and Russia to establish interoperability between different GNSS satellite constellations.

In the run-up to the 3rd generation of BeiDou’s satellite constellation, the service began to more aggressively pursue internationalisation. Agreements with countries in South and Southeast Asia were signed, providing access to BeiDou services and allowing BeiDou to construct permanent reference stations across the region and increase its positional accuracy outside China’s borders. In 2014, it was announced that China was planning to construct 220 reference stations in Thailand and a network of 1,000 across Southeast Asia.67 These newer stations improve the precise post-processing accuracy of the satellite signals, which in turn increases the precision of signals received by end users.68

In 2014, China Satellite Navigation System Management Office and Geoscience Australia established a similar agreement, but on a smaller scale. They met in Beijing with representatives of Wuhan University. The two sides reportedly agreed to establish a formal cooperation mechanism.69

Wuhan University was to provide Geoscience Australia with three continuously operating reference stations equipped with satellite signal receivers constructed by China Electronic Technology Group (CETC). CETC is one of China’s largest state-owned defence companies and was covered in the original dataset of Mapping China’s Technology Giants.70 By using CETC-constructed receivers, GA was provided access to additional signals that were unavailable to commercial off-the-shelf receivers. GA manages the communications of these sites, and also receives access to the global Wuhan University’s network of overseas tracking data.71

BeiDou’s presence in Australia has previously attracted academic and media scrutiny. Professor Anne-Marie Brady has been critical of Australia’s engagement with BeiDou because of its role in guiding China’s military technologies:72

Australia is playing a small part in helping China to get a GPS system as effective as the US system. China is aiming to have a better one than the US has by 2020, and so is Russia. They need ground stations to coordinate their satellites and they need them in the Pacific. Their first ground station in the Pacific region was built in Perth.

The three BeiDou ground facilities in Australia are at Yarragadee Station (Western Australia; the first one built), Mount Stromlo (Australian Capital Territory) and Katherine (Northern Territory) and are operated by Geoscience Australia. They were built in 2016 and have been operating for over three years.73 No data is sent directly from these (or any) receivers back to the BeiDou satellites, and detailed positional and signal data is provided publicly. These data streams are widely used by industry and civilian end-users.

The stations are a small part of Australia’s GNSS network, which then publicly provides precise positional and signal data. But it’s worth noting that Wuhan University has close links to the People’s Liberation Army (PLA) and has been previously accused by the US and Taiwanese Governments of carrying out cyberattacks.74

Foreign investment

The detention of an estimated 1.5 million members of ethnic minority groups,75 chiefly Uyghur, in so-called re-education camps in China’s far western region of Xinjiang is a human rights violation on a massive scale.76 For Chinese security companies, however, it is a win.

Many of the AI and surveillance companies added to our Mapping China’s Technology Giants project have capitalised on China’s surge in security spending, particularly in Xinjiang, in recent years.

Spending on security-related construction in Xinjiang tripled in 2017, according to an analysis of government expenditure by Adrian Zenz for the Jamestown Foundation.77

For Chinese security, AI and surveillance companies, Xinjiang has become, as Charles Rollet put it in Foreign Policy, ‘both a lucrative market and a laboratory to test the latest gadgetry’.78 The projects there, he notes, ‘include not only security cameras but also video analytics hubs, intelligent monitoring systems, big data centres, police checkpoints, and even drones.’

But China’s burgeoning surveillance state isn’t limited to Xinjiang. The Ministry of Public Security has ploughed billions of dollars into two government plans, called Skynet project (天网工程)79 and Sharp Eyes project (雪亮工程),80 that aim to comprehensively surveil China’s 1.4 billion people by 2020 through a video camera network using facial recognition technology.

China will add 400 million security cameras through 2020, according to Morgan Stanley, making investing in companies such as Hikvision and Dahua—which have received government contracts totalling more than US$1 billion81—extremely enticing for investors seeking high returns. Crucially, the gold rush hasn’t been limited to Chinese firms and investors.

Foreign investors, either passively or actively, are also profiting from China’s domestic security and surveillance spending binge. Investment funds controlling around US$1.9 trillion that measure their performance against MSCI’s benchmark Emerging Markets Index funnel capital into companies such as Hikvision82, Dahua83 and iFlytek,84 which have profited from the development of Xinjiang detention camps.

The market valuation of SenseTime, one of a few companies handpicked by the party-state to lead the way in China’s AI development, soared in 2018 on the back of increased government funding for its national facial recognition surveillance system.

Those massive government contracts have helped SenseTime attract top venture capital and private equity firms as well as strategic investors around the world, including Japanese tech conglomerate Softbank Group’s Saudi-backed Vision Fund. US venture fund IDG Capital supplied ‘tens of millions of dollars’ in initial funding to the company in August 2014.85

Other major shareholders include e-commerce giant Alibaba Group Holding Ltd, London-based Fidelity International (a subsidiary of Boston-based Fidelity Investments), Singaporean state investment firm Temasek Holdings, US private equity firms Silver Lake Partners and Tiger Global Management, and the venture capital arm of US telco Qualcomm.

More than 17 US universities and public pension plans have put money into vehicles run by some of these venture capital funds, according to an Australian Financial Review report citing historical PitchBook data.86

SenseTime rival, Megvii Technology, has also benefited from foreign investment, including from a Macquarie Group fund that sunk $US30 million ($44 million) into the facial recognition start-up.87

Macquarie declined to comment when questioned about the investment by the Australian Financial Review. Other firms such as Goldman Sachs Group Inc, have stated they’re reviewing their involvement in Megvii’s planned initial public offering after the U.S. government placed it on the US Entity List for alleged complicity in Beijing’s human rights abuses in China.88

Two of America’s biggest public pension funds—the California State Teachers’ Retirement System and the New York State Teachers’ Retirement System—own stakes in Hikvision, as the Financial Times reported in March 2019.89 Since at least 2018, Meiya Pico shares have been included in the FTSE  Russell Global Equity Index.90

Even if these companies aren’t listed on foreign bourses or are receiving money from foreign venture capital funds, they might still be getting investments from companies such as the BATs—Baidu, Alibaba and Tencent—that are traded on US stock exchanges.91

But, more often than not, the investments are made directly and wittingly by active funds that are seeking to maximise profits off the back of the boom in surveillance technologies used across China. To put it plainly, Western capital markets have funded mass detentions and an increasingly sophisticated repressive apparatus in China.

Some funds that have done their human rights and national security due diligence have started to divest themselves of some of these companies. At least seven US equity funds have divested from Hikvision, for instance.92 But many have not.

‘A lot of investors talk about ethical investing but when it comes to Hikvision and Xinjiang they are happy to fill their boots,’ one fund manager who sold out of Hikvision told the Financial Times in March 2019. ‘It is pretty hypocritical.’93
 

All roads lead to Xinjiang

In November 2019, internal Communist Party documents—obtained by the International Consortium of Investigative Journalists (ICIJ)—provided documentary evidence of how authorities in Xinjiang are using data and artificial intelligence to pioneer a new form of social control.94 The documents showed how authorities are using a data management system called the Integrated Joint Operation Platform (IJOP)—previously reported on by Human Rights Watch—to predictively identify those suspected of harbouring extremist views and criminal intent.95 Among the documents, a bulletin published on 25 June 2017, reveals how the IJOP system detected about 24,412 “suspicious” people in southern Xinjiang during one particular week. Of those people, 15,683 were sent to “education and training” — a euphemism for detention camps—and 706 were “criminally detained”.96

A month before this leak, in October 2019, the US Government added many of the AI and surveillance companies in this dataset—including Dahua Technology, iFlytek, Megvii Technology, SenseTime, Xiamen Meiya Pico Information Co. Ltd, Yitu Technologies and Hikvision97—to the US Entity List because of their roles in human rights violations in Xinjiang.98

However, Chinese tech companies’ activities in Xinjiang go beyond surveillance and extend to areas like propaganda and other coercive measures.

For example, we have found that TikTok’s parent company ByteDance—which is not on the US entity list for human rights violations in Xinjiang—collaborates with public security bureaus across China, including in Xinjiang where it plays an active role in disseminating the party-state’s propaganda on Xinjiang.

Xinjiang Internet Police reportedly “arrived” on Douyin—a ByteDance and video-sharing app—and built a “new public security and Internet social governance model” in 2018.99 In April 2019, the Ministry of Public Security’s Press and Publicity Bureau signed a strategic cooperation agreement with ByteDance to promote the “influence and credibility” of police departments nationwide.100 Under the agreement, all levels and divisions of police units from the Ministry of Public Security to county-level traffic police would have their own Douyin account to disseminate propaganda. The agreement also reportedly says ByteDance would increase its offline cooperation with the police department, however it is unclear what this offline cooperation is.

Tech companies have been piling into Xinjiang since the early 2010s. Huawei has been working for the Karamay Police Department on cloud computing projects since 2011,101 despite its debunked claims to work only with third parties.102 ZTE held its first Smart Cities Forum in Urumqi in 2013,103 and its ‘safe city’ solution has been largely used in surveilance and policing.104 In 2010, iFlytek set up a subsidiary in Xinjiang and a laboratory to develop speech recognition technology,105 especially in minority languages—technologies that are now used by the Xinjiang Government to track and identify minority populations.106

A surveillance industry boom was born out of the central government’s 2015 policy to prioritise ‘stability’ in Xinjiang107 and the national implementation of the Sharp Eyes surveillance project from 2015 to 2020.108 As of late 2017, 1,013 local security companies were working in Xinjiang;109 that figure excludes some of the largest companies operating in the region, such as Dahua and Hikvision, which had already won multimillion-dollar bids to build systems to surveil streets and mosques.110

Also in 2017, even with the central government halting some of the popular ‘PPP’ projects (public– private partnerships that channel private money into public infrastructure projects) that were debt hazards111 and tech companies becoming more cautious about investing in those projects, Xinjiang was an exception for about a year. Tech companies continued to hunt for opportunities in Xinjiang because funding for surveillance-related PPP projects in Xinjiang comes directly from defence and counterterrorism expenditure.112 However, in 2018, the debt crackdown eventually reached Xinjiang and a number of PPP projects there were also suspended. 113

A significant policy that encourages technology companies to profit from the situation in Xinjiang is the renewed ‘Xinjiang Aid’ scheme (援疆政策). Dating from the 1980s, these policies channel funds from other provincial governments to Xinjiang. Since the mass detentions in 2017 this scheme has encouraged companies in other provinces to open subsidiaries or factories in Xinjiang—factories that former detainees are forced to work in.114

A company can contribute to the Xinjiang Aid program, and the broader situation in the region, in many different ways. In 2014, for example, Alibaba began to provide cloud computing technologies for the Xinjiang Government in areas of policing and counterterrorism.115 In 2018, as part of Zhejiang Province’s Xinjiang Aid efforts, Alibaba was set to open large numbers of e-commerce service stations in Xinjiang, selling clothes and electronics.116 There’s no direct evidence that suggests Alibaba sells products sourced from forced labour. But clothing companies that have recently opened up factories in Xinjiang, because of favourable polices and an abundance of local labour—which can include forced labour117—have relied on Alibaba’s platforms to sell clothes to China, North America, Europe and the Middle East.118

Most of ByteDance’s activities in Xinjiang fall under the “Xinjiang Aid” initiative and the company’s cooperation with Xinjiang authorities is focused on Hotan, a part of Xinjiang that has been the target of some of the most severe repression. The area is referred to by the party-state as the most “backward and resistant”.119 According to satellite imagery analysis conducted by ASPI, there are approximately a dozen suspected detention facilities in the outskirts of Hotan.120 The city has seen an aggressive campaign of cemetery, mosque and traditional housing demolition since November 2018, which continues today.

In November 2019, Beijing Radio and Television Bureau announced its “Xinjiang Aid” measures in Hotan, to “propagate and showcase Hotan’s new image”—after more than two years of mass detention and close surveillance of ethnic minorities had taken place there. These measures include guiding and helping local Xinjiang authorities and media outlets to use ByteDance’s news aggregation app for Jinri Toutiao (Today’s Headlines) and video-sharing app Douyin to gain traction online.121 A Tianjin Daily article reported this April that after listening to talks by representatives from ByteDance’s Jinri Toutiao division, Hotan Propaganda Bureau official Zhou Nengwen (周能文) said he was excited to use the Douyin platform to promote Hotan’s products and image.122

Technology companies actively support state projects, even when those projects have nothing to do with tech. Also under the Xinjiang Aid umbrella, telecom companies such as China Unicom send their ‘most politically reliable’ employees to Xinjiang123 and deploy fanghuiju (访惠聚) units to villages in Xinjiang. ‘Fanghuiju’ is a government initiative that sends cadres from government agencies, state-owned enterprises and public institutions to regularly visit and surveil people.124

The China Unicom fanghuiju units were reportedly tasked with changing the villages, including villagers’ thoughts that are religious or go against CCP doctrines.125 Adding some of China’s more well-known technology and surveillance companies to the US Entity List was largely symbolic—after Huawei, Dahua and Hikvision were blacklisted in the US, Uniview’s president told reporters that, at a time when ‘leading Chinese technology companies are facing tough scrutiny overseas’, companies such as Uniview had the opportunity to grow and pursue their overseas strategies.126

Unfortunately, it’s extremely difficult for international authorities to sanction the circa 1,000 homegrown local Xinjiang security companies. However, as companies such as Huawei seek to expand overseas, foreign governments can play a more active role in rejecting those that participate in the Chinese Government’s repressive Xinjiang policies.

For example, the timeline of Huawei’s Xinjiang activities should be taken into consideration during debates about Huawei and 5G technologies. Huawei’s work in Xinjiang is extensive and includes working directly with the Chinese Government’s public security bureaus in the region. The announcement of one Huawei public security project in Xinjiang—made in 2018 through a government website in Urumqi127—quoted a Huawei director as saying, ‘Together with the Public Security Bureau, Huawei will unlock a new era of smart policing and help build a safer, smarter society.’128 In fact, some of Huawei’s promoted ‘success cases’ are Public Security Bureau projects in Xinjiang, such as the Modular Data Center for the Public Security Bureau of Aksu Prefecture in Xinjiang.129 Huawei also provides police in Xinjiang with technical support to help ‘meet the digitization requirements of the public security industry’.130

In May 2019, Huawei signed a strategic agreement with the state-owned media group Xinjiang Broadcasting and Television Network Co. Ltd at Huawei’s headquarters in Shenzhen. The agreement, which aims at maintaining social stability and creating positive public opinion, covered areas including internet infrastructure, smart cities and 5G.131

In 2018, when the Xinjiang Public Security Department and Huawei signed the agreement to establish an ‘intelligent security industry’ innovation lab in Urumqi. Fan Lixin, a Public Security Department official, said at the signing ceremony that Huawei had been supplying reliable technical support for the department.132 In 2016, Xinjiang’s provincial government signed a partnership agreement with Huawei.133 The two sides agreed to jointly develop cloud computing and big-data industries in Xinjiang. As mentioned above, Huawei began to work in cloud computing in Karamay (a Huawei cloud-computing ‘model city’ in Xinjiang)134 as early as 2011 in several sectors, including public security video surveillance.

In 2014, Huawei participated in an anti-terrorism BRI-themed conference in Urumqi as ‘an important participant of’ a program called ‘Safe Xinjiang’—code for a police surveillance system. Huawei was said to have built the police surveillance systems in Karamay and Kashgar prefectures and was praised by the head of Xinjiang provincial police department for its contributions in the Safe Xinjiang program.

Huawei was reportedly able to process and analyse footage quickly and conduct precise searches in the footage databases (for example, of the colour of cars or people and the direction of their movements) to help solve criminal cases.135

Since mass detentions began in Xinjiang over two years ago, state-affiliated technology companies such as those covered in this report have greatly expanded their remit and become a central part of the surveillance state in Xinjiang. Xinjiang’s crackdown on religious and ethnic minorities has been completed across the region. It has used and continues to use several different mechanisms of coercive control, such as arbitrary detention, coerced labour practices136 and at-home forced political indoctrination. Technology companies are intrinsically linked with many of those efforts, as the state’s crackdown offers ample opportunities for incentivised expansion and profitability.137
 

Conclusion

The aim of this report is to promote a more informed debate about the growth of China’s tech giants and to highlight areas where their expansion raises political, geostrategic, ethical and human rights concerns.

The Chinese tech companies in this report enjoy a highly favourable regulatory environment and are unencumbered by privacy and human rights concerns. Many are engaged in deeply unethical behaviour in Xinjiang, where their work directly supports and enables mass human rights abuses.

The CCP’s own policies and official statements make it clear that it perceives the expansion of Chinese technology companies as a crucial component of its wider project of ideological and geopolitical expansion, and that they are not purely commercial actors.138 The PRC’s suite of intelligence and security laws which can compel individuals and entities to participate in intelligence work139, and the CCP committees embedded within the tech companies (Chinese media has reported Huawei has more than 300 for example140) highlight the inextricable links between industry and the Chinese party-state.

These close ties make it difficult for them to be politically neutral actors. For western governments and corporations, developing risk mitigation strategies is essential, particularly when it comes to critical technology areas.

Some of these companies lead the world in cutting-edge technology development, particularly in the AI and surveillance sectors. But this technology development is focused on servicing authoritarian needs, and as these companies go global (an expansion often funded by PRC loans and aid) this technology is going global as well. This alone should give Western policymakers pause.

Increasing technological competition has the potential to deliver many benefits across the spectrum, but the benefits will not always accrue without good policy. If the West is going to continue to support the global expansion of these companies, it should, at a minimum, better understand the spectrum of policy risks and hold these companies to the same levels of accountability and transparency as it does its own corporations.


Acknowledgements

Thank you to Dr Samantha Hoffman and Nathan Ruser for their research contributions to this report and to the broader Mapping China’s Technology Giants project. Thank you to Fergus Hanson, Michael Shoebridge and anonymous peer reviewers for their valuable feedback on report drafts. And thank you to Cheryl Yu and Ed Moore for their research and data collection efforts.

What is ASPI?

The Australian Strategic Policy Institute was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally.

ASPI International Cyber Policy Centre

ASPI’s International Cyber Policy Centre (ICPC) is a leading voice in global debates on cyber and emerging technologies and their impact on broader strategic policy. The ICPC informs public debate and supports sound public policy by producing original empirical research, bringing together researchers with diverse expertise, often working together in teams. To develop capability in Australia and our region, the ICPC has a capacity building team that conducts workshops, training programs and large-scale exercises both in Australia and overseas for both the public and private sectors. The ICPC enriches the national debate on cyber and strategic policy by running an
international visits program that brings leading experts to Australia.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional.

© The Australian Strategic Policy Institute Limited 2019

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

  1. ‘Chinese police use app to spy on citizens’ smartphones’, Financial Times, 3 July 2019, online. ↩︎
  2. Mapping China’s Tech Giants, ‘Explore a company’, online. ↩︎
  3. China Eximbank is wholly owned by the Chinese Government. More detail can be found in Danielle Cave, Samantha Hoffman, Alex Joske, Mapping China’s technology giants, ASPI, Canberra, 2019, 10, online. ↩︎
  4. Lucas Niewenhuis, ‘1.5 million Muslims are in China’s camps—scholar’, SupChina, 13 March 2019, online. ↩︎
  5. Mapping China’s Tech Giants, ‘Welcome to Mapping China’s Tech Giants’, online. ↩︎
  6. Mapping China’s Tech Giants, ‘How to use this tool’, online. ↩︎
  7. Mapping China’s Tech Giants, ‘Glossary’, online. ↩︎
  8. Science and Technology Committee, ‘Oral evidence: UK telecommunications infrastructure’, HC 2200, House of Commons, 10 June 2019, online. ↩︎

A new Sino-Russian high-tech partnership

Authoritarian innovation in an era of great-power rivalry

What’s the problem?

Sino-Russian relations have been adapting to an era of great-power rivalry. This complex relationship, categorised as a ‘comprehensive strategic partnership of coordination for a new era’, has continued to evolve as global strategic competition has intensified.1 China and Russia have not only expanded military cooperation but are also undertaking more extensive technological cooperation, including in fifth-generation telecommunications, artificial intelligence (AI), biotechnology and the digital economy.

When Russia and China commemorated the 70th anniversary of the establishment of diplomatic relations between Soviet Union and the People’s Republic of China in October 2019,2 the celebrations highlighted the history of this ‘friendship’ and a positive agenda for contemporary partnership that is pursuing bilateral security, ‘the spirit of innovation’, and ‘cooperation in all areas’.3

Such partnerships show that Beijing and Moscow recognise the potential synergies of joining forces in the development of these dual-use technologies, which possess clear military and commercial significance. This distinct deepening of China–Russia technological collaborations is also a response to increased pressures imposed by the US. Over the past couple of years, US policy has sought to limit Chinese and Russian engagements with the global technological ecosystem, including through sanctions and export controls. Under these geopolitical circumstances, the determination of Chinese and Russian leaders to develop indigenous replacements for foreign, particularly American technologies, from chips to operating systems, has provided further motivation for cooperation.

These advances in authoritarian innovation should provoke concerns for democracies for reasons of security, human rights, and overall competitiveness. Notably, the Chinese and Russian governments are also cooperating on techniques for improved censorship and surveillance and increasingly coordinating on approaches to governance that justify and promote their preferred approach of cyber sovereignty and internet management, to other countries and through international standards and other institutions. Today’s trends in technological collaboration and competition also possess strategic and ideological implications for great-power rivalry.

What’s the solution?

This paper is intended to start an initial mapping and exploration of the expanding cooperative ecosystem involving Moscow and Beijing.4 It will be important to track the trajectory and assess the implications of these Sino-Russian technological collaborations, given the risks and threats that could result from those advances. In a world of globalised innovation, the diffusion of even the most sensitive and strategic technologies, particularly those that are dual-use in nature and driven by commercial developments, will remain inherently challenging to constrain but essential to understand and anticipate.

  • To avoid strategic surprise, it’s important to assess and anticipate these technological advancements by potential adversaries. Like-minded democracies that are concerned about the capabilities of these authoritarian regimes should monitor and evaluate the potential implications of these continuing developments.
  • The US and Australia, along with allies and partners, should monitor and mitigate tech transfer and collaborative research activities that can involve intellectual property (IP) theft and extra-legal activities, including through expanding information-sharing mechanisms. This collaboration should include coordinating on export controls, screening of investments, and restrictions against collaboration with military-linked or otherwise problematic institutions in China and Russia.
  • It’s critical to continue to deepen cooperation and coordination on policy responses to the challenges and opportunities that emerging technologies present. For instance, improvements in sharing data among allies and partners within and beyond the Five Eyes nations could be conducive to advancing the future development of AI in a manner that’s consistent with our ethics and values.
  • Today, like-minded democracies must recognise the threats from advances in and the diffusion of technologies that can be used to empower autocratic regimes. For that reason, it will be vital to mount a more unified response to promulgate norms for the use of next-generation technologies, particularly AI and biotech.

Background: Cold War antecedents to contemporary military-technological cooperation

The history of Sino-Russian technological cooperation can be traced back to the early years of the Cold War. The large-scale assistance provided by the Soviet Union to China in the 1950s involved supplying equipment, technology and expertise for Chinese enterprises, including thousands of highly qualified Soviet specialists working across China.5 Sino-Russian scientific and technical cooperation, ranging from the education of Chinese students in the Soviet Union to joint research and the transfer of scientific information, contributed to China’s development of its own industrial, scientific and technical foundations. Initially, China’s defence industry benefited greatly from the availability of Soviet technology and armaments, which were later reverse-engineered and indigenised. The Sino-Soviet split that started in the late 1950s and lasted through the 1970s interrupted those efforts, which didn’t resume at scale until after the end of the Cold War.6

Russia’s arms sales to China have since recovered to high levels, and China remains fairly reliant upon certain Russian defense technologies. This is exemplified by China’s recent acquisition of the S-400 advanced air defence system,7 for which China’s Central Military Commission Equipment Development Department was sanctioned by the US.8 Traditionally, China has also looked to Russia for access to aero-engines.9 Today, China’s tech sector and defence industry have surpassed Russia in certain sectors and technologies. For instance, China has developed unmanned aerial vehicles (UAVs) that are far more advanced than those currently operational in Russia.10 Nonetheless, the Russian military has been unwilling to acquire Chinese UAVs, instead deciding to attempt to develop indigenous counterparts in mid-range and heavy unmanned combat models.11 Nonetheless, for Russia, nearto mid-term access to certain Chinese products, services and experience may become the very lifeline that Russia’s industry, government and military will require in order to wean themselves off high-tech imports12, although even that approach may be challenged by limited availability of Chinese components.13

Underscoring the apparent strength of this evolving relationship, China and Russia have recently elevated their military-to-military relationship. In September 2019, the Russian and Chinese defence ministers agreed to sign official documents to jointly pursue military and military–technical cooperation.14 According to the Russian Defence Minister, ‘the results of the [bilateral] meeting will serve the further development of a comprehensive strategic partnership between Russia and China.’15

Reportedly, Russia plans to aid China in developing a missile defense warning system, according to remarks by President Putin in October 2019.16 At the moment, only the United States and Russian Federation have fully operationalized such technology, and according to Moscow, sharing this technology with Beijing could ‘cardinally increase China’s defense capability’.17 For China, access to Russian lessons learned in new conflicts such as Syria may prove extremely valuable as Beijing digests key data and lessons.18 Of course, this technological cooperation has also extended into joint exercises, including joint air patrols and naval drills.19

A strategic partnership for technological advancement

The strategic partnership between China and Russia has increasingly concentrated on technology and innovation.20 Starting with the state visit of Xi Jinping to Moscow in May 2015, in particular, the Chinese and Russian governments have signed a series of new agreements that concentrate on expanding into new realms of cooperation, including the digital economy.21 In June 2016, China’s Ministry of Science and Technology and Russia’s Ministry of Economic Development signed the ‘Memorandum of Understanding on Launching Cooperation in the Domain of Innovation’.22 With the elevation of the China–Russia relationship as a ‘comprehensive strategic partnership of coordination for a new era’, the notion of these nations as being linked in a ‘science and technology cooperation partnership for shared innovation’ (作共同创新的科技合作伙伴) has been elevated as one of the major pillars of this relationship.23

To some degree, this designation has been primarily rhetorical and symbolic, but it has also corresponded with progress and greater substance over time. The Chinese and Russian governments have launched a number of new forums and mechanisms that are intended to promote deeper collaboration, including fostering joint projects and partnerships among companies. Over time, the Sino-Russian partnership has become more and more institutionalised.24 This policy support for collaboration in innovation has manifested in active initiatives that are just starting to take shape.

This section outlines five areas where the Sino-Russian relationship is deepening, including in dialogues and exchanges, the development of industrial science and technology (S&T) parks, and the expansion of academic cooperation.

Dialogues and exchanges

Concurrently, a growing number of dialogues between Chinese and Russian governments and departments have attempted to promote exchanges and partnerships, and those engagements have also become particularly prominent since 2016. While the initiatives listed below remain relatively nascent, these new mechanisms constitute a network of science, technology, engineering and mathematics (STEM) cooperation that could continue to expand in the years to come and provide the two countries with new vehicles for engagement and information sharing across their respective scientific communities.

  • Starting in 2016, the Russian–Chinese High-Tech Forum has been convened annually. During the 2017 forum, both sides worked on the creation of direct and open dialogue between tech investors of Russia and China, as well as on the expansion and diversification of cooperation in the field of innovations and high technologies.25 During the 2018 forum, proposed initiatives for expanded cooperation included the introduction of new information technologies. This forum wasn’t merely a symbolic indication of interest in cooperation but appeared to produce concrete results, including the signing of a number of bilateral agreements.26 In particular, the Novosibirsk State University of Architecture and Civil Engineering signed an agreement with Chinese partners on the development of technologies for construction and operation in cold conditions.27 The specific projects featured included China’s accession to the Russian project of a synchrotron accelerator.28
  • Beginning in 2017, the Sino-Russian Innovation Dialogue has been convened annually by China’s Ministry of Science and Technology and Russia’s Ministry of Economic Development.29 In the first dialogue, in Beijing, more than 100 Chinese and Russian enterprises participated, from industries that included biomedicine, nanotechnology, new materials, robotics, drones and AI, showcasing their innovative technologies and concluding new agreements for cooperation. During the second dialogue, in Moscow, the Russian and Chinese governments determined the 2019–2024 China–Russia Innovation Cooperation Work Plan.30 Each country regards the plan as an opportunity for its own development, as it combines the advantages of China’s industry, capital and market with the resources, technology and talents of Russia.31 Contemporaneously, forums have been convened in parallel on ‘Investing in Innovations’ and have brought together prominent investors and entrepreneurs.32 When the third dialogue was convened in Shanghai in September 2019, the agenda included a competition in innovation and entrepreneurship, a forum on investment cooperation and a meeting for ‘matchmaking’ projects and investments.33 The 70th anniversary of diplomatic relations will also be commemorated with the Sino-Russian Innovation Cooperation Week.34

Science and technology parks

The establishment of a growing number of Sino-Russian S&T parks has been among the most tangible manifestations of growing cooperation. Moscow and Beijing believe that scientific and industrial parks can create a foundation and an infrastructure that’s critical to sustained bilateral cooperation. Since so many of these efforts remain relatively nascent, it’s too early to gauge their success—yet the growing number of such efforts reflects growing bilateral cooperation.

  • As early as 2006, the Changchun Sino-Russian Science and Technology Park was established as a base for S&T cooperation and innovation. It was founded by the Jilin Provincial Government and the Chinese Academy of Sciences, in cooperation with the Russian Academy of Sciences’ Siberian Branch and the Novosibirsk state of the Russian Federation.35 The park has specialised in creating new opportunities for collaboration and for the transfer and commercialisation of research and technology.36 Over more than a decade, it has built an ‘innovation team’ composed of colleges and universities, scientific research institutions and private enterprises.37
  • In June 2016, the plan for the China–Russia Innovation Park was inaugurated with support from the Shaanxi Provincial Government, the Russian Direct Investment Fund and the Sino-Russian Investment Fund. The park was completed in 2018, with information technology, biomedical and artificial intelligence enterprises invited to take part. According to the development plan, the park aims at research and development of new technologies and the integration of new tech with the social infrastructure of both countries.38
  • Also in June 2016, the Sino-Russian Investment Fund and the Skolkovo Foundation signed an agreement to build a medical robot centre and to manufacture medical robots in China with support from experts at the Russian Academy of Sciences’ School of Design and Technology.39 The state-funded Skolkovo initiative, launched in 2010, is Russia’s leading technology innovation space. The foundation manages many high-tech projects that include deep machine learning and neural network techniques.40
  • In June 2016, the China–Russia Silk Road Innovation Park was established in the Xixian New District of Xian.41 This initiative is framed as an opportunity to construct a modern industrial system as the main line of development, ‘striv[ing] to create an innovation and entrepreneurship centre with the highest degree of openness and the best development environment in the Silk Road Economic Belt’. This park welcomes entrepreneurs from China and Russia.
  • In December 2017, S&T parks from China and Russia agreed to promote the construction of a Sino-Russian high-tech centre at Skolkovo, which aims to become Russia’s Silicon Valley.42 The Skolkovo Foundation, which manages the site, agreed to provide the land, while Tus-Holdings Co Ltd and the Russia–China Investment Fund will jointly finance the project. This high-tech centre is intended to serve as a platform to promote new start-ups, including by attracting promising Chinese companies.
  • In October 2018, the Chinese city of Harbin also emerged as a major centre for Sino-Russian technological cooperation.43 This initiative is co-founded by GEMMA, which is an international economic cooperation organisation registered in Russia, and the Harbin Ministry of Science and Technology.44 At present, 19 companies are resident in the centre, which is expected to expand and receive robust support from the local government. Harbin’s Nangan District has expressed interest in cooperation with Russian research institutes in the field of AI.45
  • The cities of Harbin and Shenzhen have been selected for a new ‘Two Countries, Four Cities’ program, which is intended to unite the potentials of Moscow, Yekaterinburg, Harbin and Shenzhen.46 As of 2019, there are plans for the opening of another Russian innovation centre in the city of Shenzhen—a high-tech park that will concentrate on information technology47—enabling resident companies to enter the China market with their own software and technologies, such as big data and automation systems for mining.48

Joint funds

China and Russia are also increasing investments into special funds for research on advanced technology development.

  • The Russia–China Investment Fund for Regional Development signed on as an anchor investor in two new funds at Skolkovo Ventures to the tune of US$300 million in October 2018.49 This fund will also pour money into Skolkovo’s funds for emerging companies in information technology, which each currently have US$50 million in capital.50
  • The Russia–China Science and Technology Fund was established as a partnership between Russia’s ‘Leader’ management company and Shenzhen Innovation Investment Group to invest as much as 100 million yuan (about US$14 million) into Russian companies looking to enter the China market.51
  • The Chinese and Russian governments have been negotiating to establish the Sino-Russian Joint Innovation Investment Fund.52 In July 2019, the fund was officially established, with the Russian Direct Investment Fund and the China Investment Corporation financing the $1 billion project.53

Contests and competitions

Engagement between the Chinese and Russian S&T sectors has also been promoted through recent contests and competitions that have convened and displayed projects with the aim of facilitating cooperation.

  • In September 2018, the first China–Russia Industry Innovation Competition was convened in Xixian New District.54 The competition focused on the theme of ‘Innovation Drives the Future’, highlighting big data, AI and high-end manufacturing.55 The projects that competed included a flying robot project from Beijing University of Aeronautics and Astronautics and a brain-controlled rehabilitation robot based on virtual reality and functional electrical stimulation.
  • In April 2019, the Roscongress Foundation together with VEB Innovations and the Skolkovo Foundation launched the second round of the EAST BOUND contest, which gives Russian start-ups an opportunity to tell foreign investors about their projects. This time, the contest will support AI developments.56 The finalists spoke at SPIEF–2019 (the St Petersburg International Economic Forum) and presented their projects to a high-profile jury consisting of major investors from the Asia–Pacific region.57

Expansion of academic cooperation

In July 2018, the Russian and Chinese academies of sciences signed a road-map agreement to work on six projects.58 The agreement joins together some of the largest academic and research institutions around the world and includes commitments to expand research collaboration and pursue personnel exchanges. The Chinese Academy of Sciences has more than 67,900 scientists engaged in research activities,59 while the Russian Academy of Sciences includes 550 scientific institutions and research centres across the country employing more than 55,000 scientists.60

These projects include a concentration on brain functions that will include elements of AI.61 The Russian side is motivated by the fact that China occupies a world-leading position in the field of neuroscience,62 including through the launch of the China Brain Project.63 The Russian Academy of Sciences delegation visited laboratories in Shanghai in August 2019 and commented on their counterpart academy’s achievements:

Brain research is a whole range of tasks, starting with genetics and ending with psychophysical functions. This includes the study of neurodegenerative diseases and the creation of artificial intelligence systems based on neuromorphic intelligence. Participation in this project is very important for Russia. China is investing a lot in this and has become a world leader in some areas …64

Priorities for partnership

Chinese–Russian technological cooperation extends across a range of industries, and the degree of engagement and productivity varies across industries and disciplines. As Sino-Russian relations enter this ‘new era’, sectors that have been highly prioritised include, but are not limited to, telecommunications; robotics and AI; biotechnology; new media; and the digital economy.

Next-generation telecommunications

The ongoing feud between the US and China over the Huawei mobile giant has contributed to unexpectedly rapid counterbalancing cooperation between Russia and China. In fact, President Vladimir Putin went on the record about this issue, calling the American pressure on the Chinese company the ‘first technological war of the coming digital age’.65 Encountering greater pressure globally, and this year in particular, Huawei has expanded its engagement with Russia, looking to leverage its STEM expertise through engaging with Russian academia. Since 2018, Huawei has opened centres first in Moscow, St Petersburg and Kazan and then in Novosibirsk and Nizhny Novgorod.66

Huawei also began monitoring the research capabilities of Russian universities, searching for potential joint projects, and in August 2019 the company signed a cooperation agreement on AI with Russia’s National Technology Initiative, which is a state-run program to promote high-tech development in the country.67 Based on a competition run by the Huawei Academy and Huawei Cloud, Russia’s best academic STEM institutions were selected.68 In May 2019, Huawei and the Siberian Branch of the Russian Academy of Sciences outlined areas and means of future cooperation.69

Underscoring its bullishness, China recently announced plans for a fourfold increase in its R&D staff in Russia going forward. In May 2019, the Huawei Innovation Research Program in Russia was launched, and Russian institutions have received 140 technological requests from Huawei in various areas of scientific cooperation.70 By the end of 2019, the company intends to hire 500 people, and within five years it will attract more than 1,000 new specialists.71 Huawei now has two local R&D centres in Moscow and St Petersburg, where 400 and 150 people work, respectively.72 By the end of the year, it plans to open three new R&D centres, and Russia will then be ranked among the top three Huawei R&D centres, after Europe and North America.73 The company plans to engage in close cooperation with Russian scientific communities, universities and other research centres.

At present, Russia doesn’t appear to share deep American concerns about security related to Huawei technology.74 Huawei has started actively expanding its 5G testing in the Russian Federation, partnering with Russia’s Vimplecom to test a 5G pilot area in downtown Moscow starting in August 2019.75 Commentators have stated that Russia, which isn’t considered a technological leader, has ‘the potential to get ahead globally’ now that it has Chinese high-tech enterprises as allies.76 During the summer of 2019 at SPIEF, Huawei continued to discuss with Skolkovo plans to develop 5G network technology at the innovation centre, and also to do research in AI and internet of things (IoT) projects.77

In fact, at that forum, Russia and China outlined a large-scale cooperation program in order to prepare a road map for future investment and cooperation on issues such as cybersecurity and the IoT.78 As US pressure on Huawei continues, there’s even a possibility that the Chinese company might abandon the Android operating system (OS) altogether and replace it with the Russian Avrora OS.79 If this transaction goes through, it would be the first time that a Russian OS has contributed to a significant global telecoms player.

Whether Huawei can become a trusted name in Russia’s tech sector and defence industries remains to be seen. There are also reasons to question whether Russia truly trusts the security of Huawei’s systems, but it may be forced to rely upon them, absent better options. As an illustration of potential complications, in August 2019, Russia’s MiG Corporation, which builds Russia’s fighter jets, was caught in a legal battle with one of its subcontractors over software and hardware equipment.80 The subcontractor in question, Bulat, has been one of Russia’s most active companies in riding the wave of the ‘import substitution’ drive in effect since Western sanctions were imposed on the Russian defence industry. However, in this case, Bulat didn’t offer Russian-made technology; rather, it used Huawei’s servers and processors.81 Although MiG did not say publicly why it didn’t pay Bulat, it appears that the aircraft corporation actually requested Chinese technology for its operations. 82

Big data, robotics and artificial intelligence

For China and Russia, AI has emerged as a new priority in technological cooperation. For instance, the countries are seeking to expand the sharing of big data through the Sino-Russian Big Data Headquarters Base Project,83 while another project has been launched to leverage AI technologies, particularly natural language processing, to facilitate cross-border commercial activities, intended for use by Chinese and Russian businesses.84 China’s Ambassador to Russia, Li Hui, said at an investment forum in the autumn of 2018 that the two countries should increase the quality of bilateral cooperation and emphasise the digital economy as a new growth engine, highlighting opportunities for collaboration in AI, along with big data, the internet and smart cities.85 Ambassador Li emphasised:

Russia has unique strength in technological innovation and has achieved significant innovations in many fields of science and technology. China and Russia have unique economic potential and have rich experience in cooperation in many fields. Strengthening collaboration, promoting mutual investment, actively implementing promising innovation projects, expanding direct links between the scientific, business and financial communities of the two countries is particularly important today.86

This bilateral AI development will benefit from each country’s engineers and entrepreneurs.87 From Russia’s perspective, the combined capabilities of China and Russia could contribute to advancing AI, given the high-tech capabilities of Russia’s R&D sector.88 While Russia’s share of the global AI market is small, that market is growing and maturing.89 In Russia, a number of STEM and political figures have spoken favourably about the potential of bilateral R&D in AI. At the World Robotics Forum in August 2017, Vitaly Nedelskiy, the president of the Russian Robotics Association, delivered a keynote speech in which he emphasised that ‘Russian scientists and Chinese robot companies can join hands and make more breakthroughs in this field of robotics and artificial intelligence. Russia is very willing to cooperate with China in the field of robotics.’90 According to Song Kui, the president of the Contemporary China– Russia Regional Economy Research Institute in northeast China’s Heilongjiang Province, ‘High-tech cooperation including AI will be the next highlight of China–Russia cooperation.’91

In fact, bilateral cooperation in robotics development has some Russian developers and experts cautiously optimistic. According to the chief designer at Android Technologies, the Russian firm behind the FEDOR (Skybot F-850) robot that was launched to the International Space Station on 22 August 2019, ‘medicine may be the most promising for cooperation with China in the field of robotics.’92

However, hinting at potential copyright issues with respect to China, he further clarified:

[M]edical robotics is better protected from some kind of copying, because if we [Russians] implement some components or mechatronic systems here [in China], then we can sell no more than a few pieces … But since medical robotics is protected by technology, protected by the software itself, which is the key, the very methods of working with patients, on the basis of this, this area is more secure and most promising for [Russian] interaction with the Chinese.93

Revealingly, concerns about copying are a constraint but might not impede joint initiatives, given the potential for mutual benefit nonetheless.

Indeed, advances in AI depend upon massive computing capabilities, enough data for machines to learn from, and the human talent to operate those systems.94 Today, China leads the world in AI subcategories such as connected vehicles and facial and audio recognition technologies, while Russia has manifest strengths in industrial automation, defence and security applications, and surveillance.95 Based on recent activities and exchanges, there are a growing number of indications that Chinese–Russian collaboration in AI is a priority that should be expected to expand.

  • In August 2017, the Russian Robotics Association signed agreements with the China Robotics Industry Alliance and the China Electronics Society with support from China’s Minister of Industry and Information Technology and Russia’s Minister of Industrial Trade.96
  • In October 2017, Chinese and Russian experts participated in a bilateral engagement, hosted by the Harbin Institute of Technology and the Engineering University of the Russian Federation, that focused on robotics and intelligent manufacturing, exploring opportunities for future cooperation in those technologies.97
  • In April 2018, Russia hosted the Industrial Robotics Workshop for the first time.98 The workshop participants included the leading suppliers of technology and robotic solutions, including Zhejiang Buddha Technology.99 The Chinese participants noted that the Chinese market in robotics is now stronger than ever and advised Russian colleagues to seek help from the state.100
  • In May 2019, NtechLab, which is one of Russia’s leading developers in AI and facial recognition, and Dahua Technology, which is a Chinese manufacturer of video surveillance solutions, jointly presented a wearable camera with a face recognition function, the potential users of which could include law enforcement agencies and security personnel.101 According to NtechLab, the company sees law enforcement agencies and private security enterprises among its potential customers.102
  • In September 2019, Russian and Chinese partners discussed cooperation in AI at the sixth annual bilateral ‘Invest in Innovation’ forum held in Shanghai. The forum outlined the possibility of a direct dialogue between venture investors and technology companies in Russia and China.103 There, the head of Russian Venture Company (a state investor) noted that ‘artificial intelligence seems to be promising, given the potential of the Chinese market, the results of cooperation, and the accumulated scientific potential of Russia.’104

Biotechnology

Chinese and Russian researchers are exploring opportunities to expand collaboration in the domain of biotechnology. In September 2018, Sistema PJSFC (a publicly traded diversified Russian holding company), CapitalBio Technology (an industry-leading Chinese life science company that develops and commercialises total healthcare solutions), and the Russia–China Investment Fund agreed to create the largest innovative biotechnology laboratory in Russia.105 The laboratory will focus on genetic and molecular research. Junquan Xu, the CEO of CapitalBio Technology, said:

[W]e are honoured to have this opportunity to cooperate with the Russia–China Investment Fund and Sistema … We do believe that the establishment of the joint laboratory will further achieve resource sharing, complementary advantages and improve the medical standards.106

New media and communications

Chinese and Russian interests also converge on issues involving new media. In 2019, Russia intends to submit to the Chinese side a draft program of cooperation in the digital domain.107 China recently hosted the 4th Media Forum of Russia and China in Shanghai with the goal of creating a common digital environment conducive to the development of the media of the two countries, the implementation of joint projects and the strengthening of joint positions in global markets.108 In fact, China’s side discussed joint actions aimed at countering Western pressure against the Russian and Chinese media.109 Both Russia and China aim to develop common approaches and response measures to improve their capacity to promote their point of view—a dynamic that the Chinese Communist Party characterises as ‘discourse power’ (话语权).110 According to Alexey Volin, the Russian Deputy Minister of Digital Development, Telecommunications and Mass Media:

If Twitter, YouTube or Facebook follow the path of throwing out Russian and Chinese media from their environment, then we will have nothing else to do but create new distribution channels, how to think about alternative social networks and instant messengers.111

Such cooperation in new media, internet governance, and propaganda extends from technical to policy-oriented engagements. For instance, at SPIEF–2019, Sogou Inc. (an innovator in research and a leader in China’s internet industry) announced the launch of the world’s first Russian-speaking AI news anchor, which was developed through a partnership with ITAR-TASS, which is Russia’s official news agency, and China’s Xinhua news agency.112 According to the official announcement, the Russian-speaking news anchor features Sogou’s latest advances in speech synthesis, image detection and prediction capabilities, introducing more engaging and interactive content for Russian audiences.113 ‘AI anchors,’ which are starting to become a fixture and feature of China’s media ecosystem, can contribute to the landscape of authoritarian propaganda. During the World Internet Conference in October 2018, China and Russia also plan to sign a treaty involving the Cyberspace Administration of China and Roskomnadzor about ‘combatting illegal internet content.’114

The digital economy

China’s tech giants see business opportunities in Russia’s nascent digital economy. Russia’s data centres are gaining increased capabilities as Chinese companies move into this market. Over the past year, more than 600 Tencent racks have been installed in IXcellerate Moscow One, becoming its largest project. Tencent’s infrastructure will be used for the development of its cloud services and gaming. This project opens up new prospects for Tencent in Russia, which has the highest number of internet users in Europe (about 100 million—a 75% penetration rate).115 All provided services, including the storage and processing of personal data, are expected to be in full compliance with Russian legislation.116 In late 2018, Alibaba Group Holding Ltd started establishing a US$2 billion joint venture with billionaire Alisher Usmanov’s internet services firm Mail.ru Group Ltd to strengthen the Chinese company’s foothold in Russian e-commerce.117 Usmanov is one of Russia’s richest and most powerful businessmen, and his fortunes depend upon the Kremlin’s goodwill as much as on his own business acumen. In this deal, Alibaba signed an accord with Mail.ru to merge their online marketplaces in Russia, which is home to 146 million people. The deal was backed by the Kremlin through the Russian Direct Investment Fund, and the local investors will collectively control the new business.118

Problems in partnership and obstacles to technological development

To date, Sino-Russian cooperation in S&T has encountered some problems. Those issues have included not only insufficient marketisation but also initial Russian reservations about China’s One Belt, One Road initiative, which has been closely linked to scientific and technological collaboration.119 Additionally, there’s evidence that there may still be significant trust issues that impede adopting or acquiring Chinese-made high-tech products for the Russian markets. For example, in a February 2019 interview, Evgeny Dudorov, the CEO of Android Technologies (which built the FEDOR robot), said in a public interview that his company did not want to adopt Chinese robotics parts ‘due to their poor quality’.120

China’s track record over IP theft may be a concern, but it doesn’t seem that Russia is presently as anxious as others about this issue.For instance, Vladimir Lopatin, the Director of the Intellectual Property Department at the Russian Republican Centre for Intellectual Property, sounded a warning about Chinese activities back in 2013:

[T]he prevailing practice of theft and illegal use of Russian intellectual property in the production of counterfeit products by Chinese partners has led to a widespread critical decline in the level of confidence in them from Russian academic and university science centres and enterprises. This is a significant factor in restraining the implementation of strategic initiatives of innovative cooperation between the two countries …121

However, such sentiment does not appear to be so widespread at present. For instance, the Russian media typically concentrates on US–China IP disputes while presenting Sino-Russian high-tech activity in a primarily positive light. Moscow today may be merely resigned, given the long history of Chinese reverse-engineering of Russian defence technologies, but it’s notable that the Chinese Government is publicising promises to enforce IP protection vis-a-vis its Russian counterpart, implying that perhaps a detente has been reached.122 At this point, Russia seems to be more concerned about China possibly stealing its best and brightest scientists—in September 2019, the head of the Russian Academy of Sciences expressed concern that Beijing seems to be successful in starting to attract Russian STEM talent with better pay and work conditions.123 He also seemed concerned that, due to its better organisation and development goals, China was becoming a ‘big brother’ to Russia in not just economic but scientific development and called for a study of China’s overall STEM success.124

At the same time, such bilateral cooperation isn’t immune to the internal politics and certain economic realities in both nations. For instance, in what was obviously an unexpected setback, Tencent admitted back in 2017 it was ‘deeply sorry’ that its social media app WeChat had been blocked in Russia, adding that it was in touch with authorities to try to resolve the issue.125 Russian telecoms watchdog Roskomnadzor listed WeChat on the register of prohibited websites, according to information posted on the regulator’s website. ‘Russian regulations say online service providers have to register with the government, but WeChat doesn’t have the same understanding [of the rules],’ Tencent said in a statement at the time. Equally important is Russia’s ongoing uphill battle in import-substitution of high-tech and industrial components, as a result of the sanctions imposed by the West in 2014 and 2015. Despite significant progress, Russia is still reliant upon Western technology procured by direct or indirect means, and Moscow is not always keen to embrace Chinese high-tech as a substitute.

In Russia, the most lucrative companies are entangled within semi-monoplistic structures close to the Russian Government. Those players are few in number and tend to wield enormous influence in the Russian economy. As a result, the possible high-tech contact nodes between Moscow and Beijing lead through a small number of offices belonging to the most powerful and connected individuals. The true test of the Sino-Russian bilateral relationship concerning high-tech products and services may be in attempting to expand to the medium- and small-sized businesses and enterprises offering the most nimble and capable solutions. For example, the head of Russian Venture Company, a state investor, noted the difficulties in creating tools for a joint venture fund:

We did not resolve the problem of investing in a Russian venture fund. Withdrawing money from China to Russian jurisdictions under an understandable partnership and an understandable instrument is nevertheless difficult.126

Moreover, for both China and Russia, a significant challenge remains: promising young scientists in both countries would prefer to work elsewhere, namely in the US. Some recent polls and anecdotal evidence point to a continuously strong desire for emigration among the best educated, and especially among those with already established international professional relationships.127 This is especially true for Russia. However, as its National Technology Initiative has observed:

We believe that everybody for whom the Californian comfort, sun, wine, mountains and oceans are important has already left Russia. Others realise that the wine, mountains and sea in Sevastopol are just as good.128

For China, the current paradox is that, while Beijing offers plenty of incentives for its STEM community to stay in the country, many researchers choose, in fact, to work overseas, particularly in American institutions.129 The establishment of numerous S&T initiatives outlined in this paper is meant to offset that trend, but the trajectory of so many efforts launched recently remains to be seen.

Conclusions and implications

The Chinese–Russian high-tech partnership may continue to progress in the coming years, as both countries look to leverage each other’s capabilities to advance high-tech developments. China is clearly approaching Russia for its STEM R&D and S&T proficiencies, and Russia seems to be happy to integrate itself more into Chinese high-tech capabilities, and yet it is Beijing that emerges as a dominant player in this bilateral cooperation, while Russia tends to find itself in a position of relative disadvantage. Russia lacks such giants as China’s Baidu, Tencent and Alibaba, which are starting to expand globally, including into the Russian market.130 Nonetheless, as the Russian Government seeks to jump-start its own indigenous innovation, China is seen as a means to an end—and vice versa.

After all, Russian Deputy Prime Minister Maxim Akimov told reporters on the sidelines of the VI Russia–China Expo in Harbin that Russia is interested in cooperation with China in the cybersecurity sphere and in the development of technology solutions: ‘We keep a close eye on the experience of Chinese colleagues.’131

However, the future trajectory of this relationship could be complicated by questions of status and standing, not to mention politics and bureaucracy, as such projects, financing and research accelerate.

Russia may benefit from its embrace of China’s technology prowess and financing, but the full range of risks and potential externalities is still emerging and perhaps poorly understood. As Sino-Russian partnership has deepened, observers of this complex relationship have often anticipated some kind of ‘break’ in the ongoing Russo-Chinese ‘entente’.132 Many commentators find it difficult to believe that countries with such global ambitions and past historical grievances can place much trust in each other.

Certainly, there have been subtle indications of underlying friction, including Russia’s initial reluctance to embrace Xi’s signature One Belt, One Road initiative, to which Moscow has since warmed, or so it seems.

Going forward, high-tech cooperation between Moscow and Beijing appears likely to deepen and accelerate in the near term, based on current trends and initiatives. In a world of globalised innovation, scientific knowledge and advanced technologies have been able to cross borders freely over the past quarter of a century. China and Russia have been able to take advantage of free and open STEM development, from life sciences to information technology and emerging technologies, applying the results to their own distinctive technological ecosystems. Today, however, as new policies and countermeasures are introduced to limit that access, China and Russia are seeking to develop and demonstrate the dividends from a new model for scientific cooperation that relies less and less on foreign, and especially American, expertise and technology, instead seeking independence in innovation and pursuing developments that may have strategic implications.

Policy considerations and recommendations

In response to these trends and emerging challenges, like-minded democracies, particularly the Five Eyes states, should pursue courses of action that include the following measures.

  • Track the trajectory of China–Russia tech collaborations to mitigate the risks of technological surprise and have early warning of future threats. This calls for better awareness of Sino-Russian joint high-tech efforts among the Five Eyes states, in conjunction with allies and partners and relevant stakeholders, that goes beyond the hype of media headlines by developing better expertise on and understanding of the strengths and weaknesses of Russian and Chinese technological developments.
  • Monitor and respond to tech transfer activities that involve IP theft or the extra-legal acquisition of technologies that have dual-use or military potential, including those activities where there is a nexus between companies and universities with Russian and Chinese links. The US and Australia, along with their allies and partners, should coordinate on export controls, screening of investment and restrictions against collaborations with military-linked or otherwise problematic institutions in China and Russia. Otherwise, unilateral responses will prove inadequate to counter the global threat of Chinese industrial espionage, which is undertaken through a range of tech transfer tactics and is truly international in scope at scale.133
  • Deepen cooperation among allies and partners on emerging technologies, including by pursuing improvements in data sharing. The US and Australia should promote greater technological collaboration between Five Eyes governments in the high-tech sectors that are shared priorities in order to maintain an edge relative to competitors. For instance, arrangements for sharing of data among allies and partners could contribute to advances in important applications of AI. To compete, it will be critical to increase funding for STEM and high-tech programs and education in the Five Eyes countries.
  • Promulgate norms and ethical frameworks for the use of next-generation technologies, particularly AI, that are consistent with liberal values and democratic governance. In the process, the US and Australia, along with concerned democracies worldwide, should mount a more coordinated response to Russian and Chinese promotion of the concept of cyber sovereignty as a means of justifying repressive approaches to managing the internet and their advancement of AI for censorship and surveillance.

Acknowledgements

The authors would like to thank Danielle Cave, Fergus Hanson, Alex Joske, Rob Lee and Michael Shoebridge for helpful comments and suggestions on the paper.

What is ASPI?

The Australian Strategic Policy Institute was formed in 2001 as an independent, non‑partisan think tank. Its core aim is to provide the Australian Government with fresh ideas on Australia’s defence, security and strategic policy choices. ASPI is responsible for informing the public on a range of strategic issues, generating new thinking for government and harnessing strategic thinking internationally.

ASPI International Cyber Policy Centre

ASPI’s International Cyber Policy Centre (ICPC) is a leading voice in global debates on cyber and emerging technologies and their impact on broader strategic policy. The ICPC informs public debate and supports sound public policy by producing original empirical research, bringing together researchers with diverse expertise, often working together in teams. To develop capability in Australia and our region, the ICPC has a capacity building team that conducts workshops, training programs and large-scale exercises both in Australia and overseas for both the public and private sectors. The ICPC enriches the national debate on cyber and strategic policy by running an international visits program that brings leading experts to Australia.

Important disclaimer

This publication is designed to provide accurate and authoritative information in relation to the subject matter covered. It is provided with the understanding that the publisher is not engaged in rendering any form of professional or other advice or services. No person should rely on the contents of this publication without first obtaining advice from a qualified professional.

© The Australian Strategic Policy Institute Limited 2019

This publication is subject to copyright. Except as permitted under the Copyright Act 1968, no part of it may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Enquiries should be addressed to the publishers. Notwithstanding the above, educational institutions (including schools, independent colleges, universities and TAFEs) are granted permission to make copies of copyrighted works strictly for educational purposes without explicit permission from ASPI and free of charge.

  1. ‘China, Russia agree to upgrade relations for new era’, Xinhua, 6 June 2019, online. ↩︎
  2. ‘Russia and China celebrate 70 years of the establishment of diplomatic relations’ [Россия и Китай отмечают 70-летие установления дипотношений], TVC.ru, 30 September 2019, online. ↩︎
  3. Official evening commemorating 70th years of diplomatic relations between Russia and China (Вечер, посвящённый 70-летию установления дипломатических отношений между Россией и Китаем), Official website of the Russian President, June 5, 2019 ↩︎
  4. This paper uses entirely open sources, and there are inherently limitations in the information that is accessible. Nonetheless, we hope this is a useful overview that leverages publicly available information to explore current trends. ↩︎

Tag Archive for: Critical & Emerging Technology

Nothing Found

Sorry, no posts matched your criteria